REDHAT-BUG-263261: Medium severity Python TarFile vulnerability

Published Aug 29, 2007

Updated

Common Vulnerabilities and Exposures assigned an identifier CVE-2007-4559 to the following vulnerability:

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

References:

Issue and additional attack vectors were discussed in following thread on python-dev mailinglist:

http://mail.python.org/pipermail/python-dev/2007-August/074290.html

Upstream bug tracking possible fixes for the issue:

http://bugs.python.org/issue1044

Affected Software

1 affected component

Python TarFile

Event History

Aug 29, 2007

Data Sourced

via Red Hat·01:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-263261?

The severity of REDHAT-BUG-263261 is considered high due to the potential for remote code execution.

How do I fix REDHAT-BUG-263261?

To fix REDHAT-BUG-263261, ensure you update your Python tarfile module to the latest version that addresses this vulnerability.

What causes REDHAT-BUG-263261?

REDHAT-BUG-263261 is caused by a directory traversal vulnerability in the 'extract' and 'extractall' functions of the Python tarfile module.

Which versions of Python are affected by REDHAT-BUG-263261?

Specific versions of the Python tarfile module are affected, and you should check the security advisories for a complete list of vulnerable versions.

Is REDHAT-BUG-263261 related to CVE-2007-4559?

Yes, REDHAT-BUG-263261 is associated with CVE-2007-4559, which identifies the same directory traversal vulnerability.