{"id":135918,"date":"2025-06-06T03:05:07","date_gmt":"2025-06-06T01:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-python-module-tarfile-dopuskayushhaya-zapis-v-lyubye-chasti-fs"},"modified":"2025-06-06T03:05:07","modified_gmt":"2025-06-06T01:05:07","slug":"uyazvimost-v-python-module-tarfile-dopuskayushhaya-zapis-v-lyubye-chasti-fs","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-python-module-tarfile-dopuskayushhaya-zapis-v-lyubye-chasti-fs","title":{"rendered":"Sebezhet\u0151s\u00e9g a TarFile Python modulban, amely \u00edr\u00e1sra enged\u00e9lyez b\u00e1rmilyen f\u00e1jlrendszerbeli r\u00e9szhez","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A Python module tarfile, included in the standard distribution, which provides functions for reading and writing tar archives, has revealed five vulnerabilities, one of which has been classified as critical. The vulnerabilities were fixed in Python versions 3.13.4 and 3.12.11. The most dangerous vulnerability (CVE-2025-4517) allows writing files to any part of the filesystem when unpacking a specially crafted archive. In system scripts that use tarfile and are executed with root privileges (e.g., in package handling utilities and isolated containers), this vulnerability can be exploited to escalate privileges or escape from the isolated container.    <\/p>\n<p>A sebezhet\u0151s\u00e9g \u00e9rinti azokat a projekteket, amelyekben a tarfile modul megb\u00edzhatatlan tar-arch\u00edvumok kicsomagol\u00e1s\u00e1ra szolg\u00e1l, a TarFile.extractall() vagy TarFile.extract() f\u00fcggv\u00e9nyek haszn\u00e1lat\u00e1val, amikor a &#171;filter=&#187; be\u00e1ll\u00edt\u00e1s &#171;data&#187; vagy &#171;tar&#187; \u00e9rt\u00e9kre van \u00e1ll\u00edtva. A sebezhet\u0151s\u00e9g a &#171;..&#187; szekvencia nem megfelel\u0151 kezel\u00e9s\u00e9b\u0151l ad\u00f3dik a hivatkoz\u00e1s nev\u00e9ben. A probl\u00e9ma a Python 3.12 verzi\u00f3t\u00f3l kezd\u0151d\u0151en \u00e9rinti. A &#8216;filter=&#187;data&#187;&#8216; sz\u0171r\u0151 alap\u00e9rtelmezett m\u00f3don alkalmaz\u00e1sra ker\u00fcl a fejleszt\u00e9s alatt \u00e1ll\u00f3 Python 3.14 \u00e1gon (a kiad\u00e1s tervezett id\u0151pontja \u0151sz).     <\/p>\n<p>Other vulnerabilities in TarFile:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2025-4330 &#8212; a kinyer\u00e9s sz\u0171r\u00e9s\u00e9nek megker\u00fcl\u00e9se, ami szimbolikus hivatkoz\u00e1sok kicsomagol\u00e1s\u00e1hoz vezethet, amelyek a kiemelt alapmappa f\u00f6l\u00e9 mutatnak.\n<li class=\"l\"> CVE-2025-4138 &#8212; a tetsz\u0151leges szimbolikus hivatkoz\u00e1sok l\u00e9trehoz\u00e1s\u00e1nak lehet\u0151s\u00e9ge az alapmappa f\u00f6l\u00f6tt, amikor arch\u00edvumokat csomagolnak ki &#8216;filter=&#187;data&#187;&#8216; be\u00e1ll\u00edt\u00e1ssal.\n<li class=\"l\"> CVE-2024-12718 &#8212; a f\u00e1jlok metaadatainak (p\u00e9ld\u00e1ul m\u00f3dos\u00edt\u00e1si id\u0151) megv\u00e1ltoztat\u00e1s\u00e1nak lehet\u0151s\u00e9ge az alapmappa f\u00f6l\u00f6tti arch\u00edvumok kicsomagol\u00e1sakor, amikor az &#8216;filter=&#187;data&#187;&#8216; be\u00e1ll\u00edt\u00e1ssal, illetve a hozz\u00e1f\u00e9r\u00e9si jogok (chmod) m\u00f3dos\u00edt\u00e1sa a &#8216;filter=&#187;tar&#187;&#8216; be\u00e1ll\u00edt\u00e1ssal rendelkez\u0151 arch\u00edvumok kicsomagol\u00e1sa sor\u00e1n.\n<li class=\"l\"> CVE-2025-4435 &#8212; ha az arch\u00edvum kicsomagol\u00e1sakor a TarFile.errorlevel param\u00e9ter 0-ra van \u00e1ll\u00edtva, akkor az ir\u00e1nyelvnek megfelel\u0151en a megadott sz\u0171r\u0151nek megfelel\u0151 elemek kicsomagol\u00e1sra ker\u00fclnek, nem pedig figyelmen k\u00edv\u00fcl hagyva.    <\/ul>\n<p>Forr\u00e1s: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=63365\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u043c \u0432 \u0448\u0442\u0430\u0442\u043d\u0443\u044e \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0443 Python \u043c\u043e\u0434\u0443\u043b\u0435 tarfile, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 tar-\u0430\u0440\u0445\u0438\u0432\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Python 3.13.4 \u0438 3.12.11. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-4517) \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0430\u0440\u0445\u0438\u0432\u0430 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043b\u044e\u0431\u0443\u044e \u0447\u0430\u0441\u0442\u044c \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-135918","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u043c \u0432 \u0448\u0442\u0430\u0442\u043d\u0443\u044e \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0443 Python \u043c\u043e\u0434\u0443\u043b\u0435 tarfile, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 tar-\u0430\u0440\u0445\u0438\u0432\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-python-module-tarfile-dopuskayushhaya-zapis-v-lyubye-chasti-fs\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"hu_HU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Python-\u043c\u043e\u0434\u0443\u043b\u0435 TarFile, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u043b\u044e\u0431\u044b\u0435 \u0447\u0430\u0441\u0442\u0438 \u0424\u0421 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u043c \u0432 \u0448\u0442\u0430\u0442\u043d\u0443\u044e \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0443 Python \u043c\u043e\u0434\u0443\u043b\u0435 tarfile, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 tar-\u0430\u0440\u0445\u0438\u0432\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-python-module-tarfile-dopuskayushhaya-zapis-v-lyubye-chasti-fs\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-06-06T01:05:07+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-06-06T01:05:07+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerability in the Python TarFile module allowing write access to any part of the filesystem | ProHoster","description":"A Python module tarfile, included in the standard distribution, which provides functions for reading and writing tar archives, has revealed five vulnerabilities, one of which has been classified as critical.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-python-module-tarfile-dopuskayushhaya-zapis-v-lyubye-chasti-fs","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Python-\u043c\u043e\u0434\u0443\u043b\u0435 TarFile, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u043b\u044e\u0431\u044b\u0435 \u0447\u0430\u0441\u0442\u0438 \u0424\u0421 | ProHoster","og:description":"\u0412\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u043c \u0432 \u0448\u0442\u0430\u0442\u043d\u0443\u044e \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0443 Python \u043c\u043e\u0434\u0443\u043b\u0435 tarfile, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 tar-\u0430\u0440\u0445\u0438\u0432\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-python-module-tarfile-dopuskayushhaya-zapis-v-lyubye-chasti-fs","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-06-06T01:05:07+00:00","article:modified_time":"2025-06-06T01:05:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"135918","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:11:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:11:21","updated":"2026-01-23 13:11:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/135918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=135918"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/135918\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=135918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=135918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=135918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}