REDHAT-BUG-2384043: Medium severity Python Software Foundation CPython vulnerability
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives.
This vulnerability can be mitigated by including the following patch after importing the “tarfile” module:
import tarfile
def blockpatched(self, count): if count < 0: # pragma: no cover raise tarfile.InvalidHeaderError("invalid offset") return blockpatched.origblock(self, count)
blockpatched.origblock = tarfile.TarInfo.block tarfile.TarInfo.block = blockpatched
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Mitigate by applying the provided runtime patch after importing the "tarfile" module: set _block_patched._orig_block = tarfile.TarInfo._block, then define _block_patched(self, count) that calls the original block when count < 0, and finally assign tarfile.TarInfo._block = _block_patched.
CPython tarfile module TarInfo._block monkey-patch = _block_patched (wrapper calling tarfile.TarInfo._block, with negative count handling to avoid infinite loop)
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2384043?
The severity of REDHAT-BUG-2384043 is critical due to the potential for infinite loops and deadlocks.
How do I fix REDHAT-BUG-2384043?
To fix REDHAT-BUG-2384043, update your CPython installation to the latest version where the defect has been addressed.
What versions of CPython are affected by REDHAT-BUG-2384043?
REDHAT-BUG-2384043 affects specific versions of CPython that incorporate the vulnerable tarfile implementation.
Can REDHAT-BUG-2384043 be exploited remotely?
Yes, remote exploitation is possible if a user processes maliciously crafted tar archives.
Is there a workaround for REDHAT-BUG-2384043?
The best workaround for REDHAT-BUG-2384043 is to avoid processing untrusted tar archives until a patch is applied.