CVE-2025-4435: Tarfile extracts filtered members when errorlevel=0
Tarfile extracts filtered members when errorlevel=0
Other sources
When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.20+dfsg-2 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.4-1 - Upgrade
Upgrade
debian/jythonto a version that resolves this vulnerability.Fixed in 2.7.3+repack1-1 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.11+dfsg-2+deb12u3Fixed in 8.0.1+dfsg-1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u8Fixed in 3.11.2-6+deb12u9 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4435?
The severity of CVE-2025-4435 is considered moderate due to incorrect extraction behavior impacting security through unintended file access.
How do I fix CVE-2025-4435?
To fix CVE-2025-4435, update your Python TarFile module to the latest version that implements the correct extraction logic.
What systems are affected by CVE-2025-4435?
CVE-2025-4435 specifically affects the Python TarFile module in its vulnerable versions.
What are the implications of CVE-2025-4435?
CVE-2025-4435 can lead to unauthorized file extraction, potentially exposing sensitive data to attackers.
Is there a workaround for CVE-2025-4435?
As a workaround for CVE-2025-4435, avoid using TarFile.errorlevel = 0 until the issue is resolved in an updated version.