Tarfile extracts filtered members when errorlevel=0

Common Vulnerabilities and Exposures assigned an identifier CVE-2007-4559 to the following vulnerability:

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

References:

Issue and additional attack vectors were discussed in following thread on python-dev mailinglist:

http://mail.python.org/pipermail/python-dev/2007-August/074290.html

Upstream bug tracking possible fixes for the issue:

http://bugs.python.org/issue1044