{"id":135918,"date":"2025-06-06T03:05:07","date_gmt":"2025-06-06T01:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-python-module-tarfile-dopuskayushhaya-zapis-v-lyubye-chasti-fs"},"modified":"2025-06-06T03:05:07","modified_gmt":"2025-06-06T01:05:07","slug":"uyazvimost-v-python-module-tarfile-dopuskayushhaya-zapis-v-lyubye-chasti-fs","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-python-module-tarfile-dopuskayushhaya-zapis-v-lyubye-chasti-fs","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb modulin TarFile t\u00eb Python, e cila lejon shkrimin n\u00eb \u00e7do pjes\u00eb t\u00eb sistemit t\u00eb skedar\u00ebve","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb modulin tarfile, i cili vjen me Python dhe ofron funksione p\u00ebr t\u00eb lexuar dhe shkruar arkiva tar, jan\u00eb identifikuar pes\u00eb dob\u00ebsi, nj\u00ebra prej t\u00eb cilave i \u00ebsht\u00eb caktuar nj\u00eb nivel kritik rreziku. Dob\u00ebsit\u00eb jan\u00eb eliminuar n\u00eb versionet Python 3.13.4 dhe 3.12.11. Dob\u00ebsia m\u00eb e rrezikshme (CVE-2025-4517) lejon q\u00eb gjat\u00eb shp\u00ebrb\u00ebrjes s\u00eb nj\u00eb arkive t\u00eb ve\u00e7ant\u00eb t\u00eb formatit, t\u00eb shkruhen skedar\u00eb n\u00eb \u00e7do pjes\u00eb t\u00eb sistemit t\u00eb skedar\u00ebve. N\u00eb skriptet sistemore q\u00eb p\u00ebrdorin tarfile dhe q\u00eb ekzekutohen me t\u00eb drejta root (p.sh., n\u00eb mjete p\u00ebr menaxhimin e paketimeve dhe kontejner\u00ebve t\u00eb izoluar), dob\u00ebsia mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb rritur privilegjet e saj ose p\u00ebr t\u00eb dal\u00eb jasht\u00eb kontejnerit t\u00eb izoluar. <\/p>\n
Vulnerabiliteti prek projekte ku moduli tarfile p\u00ebrdoret p\u00ebr t\u00eb nxjerr\u00eb arkiva tar t\u00eb pasigurt, duke p\u00ebrdorur funksionin TarFile.extractall() ose TarFile.extract() me parametrin \u00abfilter=\u00bb, t\u00eb vendosur n\u00eb vler\u00ebn \u00abdata\u00bb ose \u00abtar\u00bb. Vulnerabiliteti shkaktohet nga trajtimi i pamjaftuesh\u00ebm i sekuenc\u00ebs \u00ab..\u00bb n\u00eb emrin e lidhjes. Problemi prek versionet e Python q\u00eb nga 3.12. M\u00ebnyra \u2018filter=\u2019data\u2019\u2019 aplikohet si parazgjedhje n\u00eb deg\u00ebn e Python 3.14, e cila \u00ebsht\u00eb n\u00eb zhvillim (l\u00ebshimi \u00ebsht\u00eb planifikuar p\u00ebr vjesht\u00ebn). <\/p>\n
Vulnerabilitete t\u00eb tjera n\u00eb TarFile: <\/p>\n
\n
CVE-2025-4330 \u2014 mund\u00ebsia p\u00ebr t\u00eb anashkaluar filtrin e t\u00eb dh\u00ebnave t\u00eb nxjerra, q\u00eb mund t\u00eb \u00e7oj\u00eb n\u00eb nxjerrjen nga arkiva t\u00eb nj\u00eb lidhjeje simbolike q\u00eb tregon p\u00ebrtej katalogut baz\u00eb n\u00eb t\u00eb cilin kryhet nxjerrja.\n
CVE-2025-4138 \u2014 mund\u00ebsia p\u00ebr t\u00eb krijuar lidhje simbolike t\u00eb rast\u00ebsishme p\u00ebrtej katalogut baz\u00eb gjat\u00eb nxjerrjes s\u00eb arkivave me parametrin \u2018filter=\u2019data\u2019.\n
CVE-2024-12718 \u2014 mund\u00ebsia p\u00ebr t\u00eb modifikuar metadata (p.sh., koh\u00ebn e modifikimit) t\u00eb skedar\u00ebve jasht\u00eb katalogut baz\u00eb gjat\u00eb shkarkimit t\u00eb arkivave me parametrin 'filter=\u00bbdata\u00ab' ose t\u00eb drejtat e aksesit (chmod) gjat\u00eb shkarkimit t\u00eb arkivave me parametrin 'filter=\u00bbtar\u00ab'.\n
CVE-2025-4435 \u2014 n\u00ebse gjat\u00eb shkarkimit t\u00eb arkivit parametrin TarFile.errorlevel e vendosim n\u00eb 0, at\u00ebher\u00eb n\u00eb kund\u00ebrshtim me dokumentacionin, elementet e arkivit q\u00eb bien n\u00ebn filtrin e caktuar shkarkoheshin, e jo injoroheshin. <\/ul>\n