CVE-2025-13462
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
Mar 12, 2026
CISA due date
—
The record
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python310 | 0 | 3.10.20-150400.4.107.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python310-core | 0 | 3.10.20-150400.4.107.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python310 | 0 | 3.10.20-150400.4.107.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python310-core | 0 | 3.10.20-150400.4.107.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python311-core | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | python | 0 | 2.7.18-150000.111.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | python-base | 0 | 2.7.18-150000.111.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311 | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311-core | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | python310 | 0 | 3.10.20-150400.4.107.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | python310-core | 0 | 3.10.20-150400.4.107.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | python39 | 0 | 3.9.25-150300.4.99.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | python39-core | 0 | 3.9.25-150300.4.99.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | python311 | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | python311-core | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | python312 | 0 | 3.12.13-150600.3.53.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | python312-core | 0 | 3.12.13-150600.3.53.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | python310 | 0 | 3.10.20-150400.4.107.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | python310-core | 0 | 3.10.20-150400.4.107.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | python39 | 0 | 3.9.25-150300.4.99.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | python39-core | 0 | 3.9.25-150300.4.99.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | python311 | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | python311-core | 0 | 3.11.15-150600.3.53.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | python312 | 0 | 3.12.13-150600.3.53.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | python312-core | 0 | 3.12.13-150600.3.53.1 |
| openSUSE:Leap 15.6 | python | 0 | 2.7.18-150000.111.1 |
| openSUSE:Leap 15.6 | python-base | 0 | 2.7.18-150000.111.1 |
| openSUSE:Leap 15.6 | python-doc | 0 | 2.7.18-150000.111.1 |
| openSUSE:Leap 15.6 | python310 | 0 | 3.10.20-150400.4.107.1 |
| openSUSE:Leap 15.6 | python310-core | 0 | 3.10.20-150400.4.107.1 |
| openSUSE:Leap 15.6 | python310-documentation | 0 | 3.10.20-150400.4.107.1 |
| openSUSE:Leap 15.6 | python311 | 0 | 3.11.15-150600.3.53.1 |
| openSUSE:Leap 15.6 | python311-core | 0 | 3.11.15-150600.3.53.1 |
| openSUSE:Leap 15.6 | python311-documentation | 0 | 3.11.15-150600.3.53.1 |
| openSUSE:Leap 15.6 | python312 | 0 | 3.12.13-150600.3.53.1 |
| openSUSE:Leap 15.6 | python312-core | 0 | 3.12.13-150600.3.53.1 |
| openSUSE:Leap 15.6 | python312-documentation | 0 | 3.12.13-150600.3.53.1 |
| openSUSE:Leap 15.6 | python39 | 0 | 3.9.25-150300.4.99.1 |
| openSUSE:Leap 15.6 | python39-core | 0 | 3.9.25-150300.4.99.1 |
| openSUSE:Leap 15.6 | python39-documentation | 0 | 3.9.25-150300.4.99.1 |
| openSUSE:Leap 16.0 | python313 | 0 | 3.13.13-160000.1.1 |
| openSUSE:Leap 16.0 | python313-core | 0 | 3.13.13-160000.1.1 |
| openSUSE:Leap 16.0 | python313-documentation | 0 | 3.13.13-160000.1.1 |
| openSUSE:Leap 16.0 | python313-nogil | 0 | 3.13.13-160000.1.1 |
| openSUSE:Leap 16.0 | python313-nogil-nogil-core | 0 | 3.13.13-160000.1.1 |
| openSUSE:Tumbleweed | python310 | 0 | 3.10.20-3.1 |
| openSUSE:Tumbleweed | python311 | 0 | 3.11.15-4.1 |
| openSUSE:Tumbleweed | python312 | 0 | 3.12.13-4.1 |
| openSUSE:Tumbleweed | python313 | 0 | 3.13.12-3.1 |
| openSUSE:Tumbleweed | python314 | 0 | 3.14.3-4.1 |
| openSUSE:Tumbleweed | python315 | 0 | 3.15.0~a7-3.1 |
Related vulnerabilities
- CVE-2026-4519 The webbrowser.open() API would accept leading dashes in the URL which could be handled… Also affects python310
- CVE-2026-3479 DISPUTED: The project has clarified that the documentation was incorrect, and that… Also affects python310
- CVE-2026-4224 When an Expat parser with a registered ElementDeclHandler parses an inline document type… Also affects python310
- CVE-2026-3644 The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was… Also affects python310
- CVE-2026-0672 When using http.cookies.Morsel, user-controlled cookie values and parameters can allow… Also affects python310
- CVE-2026-0865 User-controlled header names and values containing newlines can allow injecting HTTP… Also affects python310
- CVE-2025-15367 The poplib module, when passed a user-controlled command, can have additional commands… Also affects python310
- CVE-2025-15366 The imaplib module, when passed a user-controlled command, can have additional commands… Also affects python310