A Python module tarfile, included in the standard distribution, which provides functions for reading and writing tar archives, has revealed five vulnerabilities, one of which has been classified as critical. The vulnerabilities were fixed in Python versions 3.13.4 and 3.12.11. The most dangerous vulnerability (CVE-2025-4517) allows writing files to any part of the filesystem when unpacking a specially crafted archive. In system scripts that use tarfile and are executed with root privileges (e.g., in package handling utilities and isolated containers), this vulnerability can be exploited to escalate privileges or escape from the isolated container.
The vulnerability affects projects where the tarfile module is used to unpack untrusted tar archives, using the TarFile.extractall() or TarFile.extract() function with the ‘filter=’ set to ‘data’ or ‘tar’. The vulnerability is caused by improper handling of the ‘..’ sequence in a link name. This issue affects Python versions starting from 3.12. The ‘filter=’data’’ mode is applied by default in the Python 3.14 branch, currently in development (release expected in the fall).
Other vulnerabilities in TarFile:
- CVE-2025-4330 — a bypass of the data extraction filter, which can lead to extracting a symbolic link from the archive that points outside the base directory to which the unpacking is performed.
- CVE-2025-4138 — the ability to create arbitrary symbolic links outside the base directory when unpacking archives with the ‘filter=’data’’ parameter.
- CVE-2024-12718 — the ability to modify metadata (e.g., modification time) of files outside the base directory when unpacking archives with the ‘filter=’data’’ parameter or change permissions (chmod) when unpacking archives with the ‘filter=’tar’’ parameter.
- CVE-2025-4435 — if the TarFile.errorlevel parameter is set to 0 during archive unpacking, contrary to the documentation, the elements of the archive that fall under the specified filter were unpacked instead of being ignored.
Forrás: opennet.ru
