3.3

CVE-2025-13462

tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Python ≫ Python Version < 3.13.13
Python ≫ Python Version >= 3.14.0 < 3.14.4
Python ≫ Python Version3.15.0 Updatealpha1
Python ≫ Python Version3.15.0 Updatealpha2
Python ≫ Python Version3.15.0 Updatealpha3
Python ≫ Python Version3.15.0 Updatealpha4
Python ≫ Python Version3.15.0 Updatealpha5
Python ≫ Python Version3.15.0 Updatealpha6
Python ≫ Python Version3.15.0 Updatealpha7
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.059
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 3.3 1.8 1.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
cna@python.org 2 0 0
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

https://github.com/python/cpython/issues/141707
Issue Tracking
https://github.com/python/cpython/pull/143934
Patch
Issue Tracking
https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/
Vendor Advisory
Mailing List
https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab
Patch
https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017
Patch
https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7
Patch
https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114
Patch
https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406
Patch
https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084
Patch