REDHAT-BUG-2370014: Medium severity pypi/tarfile vulnerability
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature.
Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to "data", so if you are relying on this new default behavior then your usage is also affected.
Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
When extracting untrusted tar archives with tarfile, do not rely on the Python 3.14+ default filter='data'; explicitly set the tarfile extraction filter parameter (filter=...) to an appropriate value rather than 'data' or 'tar'.
Python tarfile module (TarFile.extractall()/TarFile.extract()) filter = (set explicitly to avoid the default 'data') - Compensating control
When evaluating source distributions, avoid installing source distributions that include suspicious links (e.g., symlinks that target outside the destination directory).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2370014?
REDHAT-BUG-2370014 has a high severity due to the potential impact on file system integrity and security.
How do I fix REDHAT-BUG-2370014?
To fix REDHAT-BUG-2370014, update your Python version to a patched release that addresses this vulnerability.
What specific Python versions are affected by REDHAT-BUG-2370014?
REDHAT-BUG-2370014 affects Python versions from 3.12 and up to 3.14.
What is the risk of using TarFile.extractall() related to REDHAT-BUG-2370014?
Using TarFile.extractall() can expose your system to unauthorized access and file manipulation if untrusted archives are extracted.
Can I mitigate the impacts of REDHAT-BUG-2370014 without upgrading?
Mitigation for REDHAT-BUG-2370014 is limited, but you can avoid extracting untrusted tar archives to reduce risk.