REDHAT-BUG-2372426: High severity pypi/tarfile vulnerability
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature.
Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to "data", so if you are relying on this new default behavior then your usage is also affected.
Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
When using Python tarfile to extract untrusted tar archives with TarFile.extractall() or TarFile.extract(), do not use filter="data" (or "tar"); instead use a restrictive extraction filter so symlink targets cannot point outside the destination directory and file metadata cannot be modified.
Python tarfile module filter (TarFile.extractall()/TarFile.extract()) = value other than "data" (e.g., enable a restrictive extraction filter instead of default "data") - Compensating control
When evaluating source distributions, avoid installing source distributions that contain suspicious links (e.g., symlinks pointing outside the destination directory).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2372426?
The severity of REDHAT-BUG-2372426 is classified as high due to the potential for arbitrary file extraction and metadata modification.
How do I fix REDHAT-BUG-2372426?
To fix REDHAT-BUG-2372426, update to the latest version of Python which includes the patch for this vulnerability.
Which versions of Python are affected by REDHAT-BUG-2372426?
REDHAT-BUG-2372426 affects Python versions 3.12 and 3.14 that utilize the tarfile module.
What are the risks associated with REDHAT-BUG-2372426?
The risks include unauthorized access to file system locations and modification of sensitive file metadata.
What is the exploit mechanism of REDHAT-BUG-2372426?
The exploit mechanism involves the tarfile module's extractall() method allowing symlink targets to bypass directory restrictions.