{"id":135918,"date":"2025-06-06T03:05:07","date_gmt":"2025-06-06T01:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-python-module-tarfile-dopuskayushhaya-zapis-v-lyubye-chasti-fs"},"modified":"2025-06-06T03:05:07","modified_gmt":"2025-06-06T01:05:07","slug":"uyazvimost-v-python-module-tarfile-dopuskayushhaya-zapis-v-lyubye-chasti-fs","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-python-module-tarfile-dopuskayushhaya-zapis-v-lyubye-chasti-fs","title":{"rendered":"Vulnerability in the Python TarFile module allowing writing to any part of the filesystem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Five vulnerabilities have been identified in the standard Python tarfile module, which provides functions for reading and writing tar archives, one of which has been assigned a critical severity level. The vulnerabilities have been resolved in releases of Python 3.13.4 and 3.12.11. The most dangerous vulnerability (CVE-2025-4517) allows for writing files to any part of the filesystem when unpacking a specially crafted archive. In system scripts that use tarfile and are run with root permissions (for instance, in package management utilities and isolated containers), this vulnerability can be exploited to escalate privileges or escape the isolated container. <\/p>\n
The vulnerability affects projects where the tarfile module is used to extract untrusted tar archives, utilizing the TarFile.extractall() or TarFile.extract() functions with the 'filter=' parameter set to 'data' or 'tar'. The issue arises from improper handling of the '..' sequence in the link name. This problem affects Python versions starting from 3.12. The 'filter='data'' mode is applied by default in the Python 3.14 branch currently in development (release scheduled for autumn). <\/p>\n
Other vulnerabilities in TarFile: <\/p>\n
\n
CVE-2025-4330 \u2014 the potential for bypassing the data extraction filter, which may lead to the extraction of a symbolic link from the archive pointing outside the base directory where extraction is performed.\n
CVE-2025-4138 \u2014 the possibility of creating arbitrary symbolic links outside the base directory when extracting archives with the 'filter='data'' parameter.\n
CVE-2024-12718 \u2014 the potential for modifying metadata (e.g., modification time) of files outside the base directory when extracting archives with the 'filter='data'' parameter or changing permissions (chmod) when extracting archives with the 'filter='tar'' parameter.\n
CVE-2025-4435 \u2014 if the TarFile.errorlevel parameter is set to 0 during archive extraction, elements of the archive falling under the specified filter were extracted instead of being ignored, contrary to documentation. <\/ul>\n