CVE-2025-4138
High · 7.5CVSS
7.5
EPSS
1.5%
Published
Jun 3, 2025
CISA due date
—
Cloudanix analysis
Monitor only
SSVC: Track
Python's tar archive handling can be tricked into placing files in the wrong folders when opening untrusted archives, which could let attackers tamper with important system files.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Data Exposure
- Component
- Library
- Class
- Path Traversal
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Bypasses tarfile extraction filters allowing symlink targets to escape the destination directory and permitting unauthorized modification of file metadata during extraction of untrusted tar archives via TarFile.extractall or extract with filter='data' or 'tar'.
Why it matters to the business
Attackers can write files to arbitrary locations on systems that extract untrusted tar archives, risking data leakage, tampering, or corruption of critical files and configurations.
How an attack unfolds
An attacker crafts a malicious tar archive containing symlinks that point outside the intended extraction directory. A victim application using the affected Python tarfile module with the specified filters extracts the archive, allowing the symlinks to be followed and files to be written or metadata altered outside the destination.
How to fix it
Upgrade Python to a build containing commit 19de092debb3d7e832e5672cc2f7b788d35951da or later. Avoid extracting untrusted tar archives until patched; consider using stricter custom filters or alternative extraction methods.
How to confirm the fix worked
Verify the installed Python version or source includes commit 19de092debb3d7e832e5672cc2f7b788d35951da. Test extraction of a crafted tar containing symlinks with filter='data' to confirm paths remain confined to the destination directory.
Typical attack path
- Attacker prepares tar archive with malicious symlinks targeting paths outside extraction root
- Victim process invokes TarFile.extractall or extract using filter='data' or 'tar' on the archive
- Filter is ignored due to the flaw, permitting symlink traversal
- Files are extracted or metadata is modified at attacker-chosen locations
How to detect it
Review application logs for tar extraction operations on external or untrusted archives. Monitor file system events for unexpected symlinks or files created outside designated extraction directories. Check for metadata changes on files not explicitly targeted by extraction logic.
What your security team should do
- Immediately update all Python installations to the fixed commit or newer release
- Audit code and dependencies that perform tar extraction on untrusted data
- Implement runtime monitoring for unexpected file writes outside expected directories during extraction operations
The record
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:10 | python-unversioned-command | 0 | 3.12.9-2.el10_0.2 |
| AlmaLinux:10 | python3 | 0 | 3.12.9-2.el10_0.2 |
| AlmaLinux:10 | python3-debug | 0 | 3.12.9-2.el10_0.2 |
| AlmaLinux:10 | python3-devel | 0 | 3.12.9-2.el10_0.2 |
| AlmaLinux:10 | python3-idle | 0 | 3.12.9-2.el10_0.2 |
| AlmaLinux:10 | python3-libs | 0 | 3.12.9-2.el10_0.2 |
| AlmaLinux:10 | python3-test | 0 | 3.12.9-2.el10_0.2 |
| AlmaLinux:10 | python3-tkinter | 0 | 3.12.9-2.el10_0.2 |
| AlmaLinux:8 | platform-python | 0 | 3.6.8-70.el8_10.alma.1 |
| AlmaLinux:8 | platform-python-debug | 0 | 3.6.8-70.el8_10.alma.1 |
| AlmaLinux:8 | platform-python-devel | 0 | 3.6.8-70.el8_10.alma.1 |
| AlmaLinux:8 | python3-idle | 0 | 3.6.8-70.el8_10.alma.1 |
| AlmaLinux:8 | python3-libs | 0 | 3.6.8-70.el8_10.alma.1 |
| AlmaLinux:8 | python3-test | 0 | 3.6.8-70.el8_10.alma.1 |
| AlmaLinux:8 | python3-tkinter | 0 | 3.6.8-70.el8_10.alma.1 |
| AlmaLinux:8 | python3.11 | 0 | 3.11.13-1.el8_10 |
| AlmaLinux:8 | python3.11-debug | 0 | 3.11.13-1.el8_10 |
| AlmaLinux:8 | python3.11-devel | 0 | 3.11.13-1.el8_10 |
| AlmaLinux:8 | python3.11-idle | 0 | 3.11.13-1.el8_10 |
| AlmaLinux:8 | python3.11-libs | 0 | 3.11.13-1.el8_10 |
| AlmaLinux:8 | python3.11-rpm-macros | 0 | 3.11.13-1.el8_10 |
| AlmaLinux:8 | python3.11-test | 0 | 3.11.13-1.el8_10 |
| AlmaLinux:8 | python3.11-tkinter | 0 | 3.11.13-1.el8_10 |
| AlmaLinux:8 | python3.12 | 0 | 3.12.11-1.el8_10 |
| AlmaLinux:8 | python3.12-debug | 0 | 3.12.11-1.el8_10 |
| AlmaLinux:8 | python3.12-devel | 0 | 3.12.11-1.el8_10 |
| AlmaLinux:8 | python3.12-idle | 0 | 3.12.11-1.el8_10 |
| AlmaLinux:8 | python3.12-libs | 0 | 3.12.11-1.el8_10 |
| AlmaLinux:8 | python3.12-rpm-macros | 0 | 3.12.11-1.el8_10 |
| AlmaLinux:8 | python3.12-test | 0 | 3.12.11-1.el8_10 |
| AlmaLinux:8 | python3.12-tkinter | 0 | 3.12.11-1.el8_10 |
| AlmaLinux:8 | python39 | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-Cython | 0 | 0.29.21-5.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-Cython | 0 | 0.29.21-5.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-PyMySQL | 0 | 0.10.1-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-attrs | 0 | 20.3.0-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-cffi | 0 | 1.14.3-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-cffi | 0 | 1.14.3-2.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-chardet | 0 | 3.0.4-19.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-cryptography | 0 | 3.3.1-3.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-debug | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-devel | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-idle | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-idna | 0 | 2.10-4.module_el8.10.0+3849+a48d89aa |
| AlmaLinux:8 | python39-iniconfig | 0 | 1.1.1-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-libs | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-lxml | 0 | 4.6.5-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-lxml | 0 | 4.6.5-1.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-mod_wsgi | 0 | 4.7.1-7.module_el8.10.0+3989+a618fe15.1 |
| AlmaLinux:8 | python39-more-itertools | 0 | 8.5.0-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-numpy | 0 | 1.19.4-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-numpy | 0 | 1.19.4-3.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-numpy-doc | 0 | 1.19.4-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-numpy-f2py | 0 | 1.19.4-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-numpy-f2py | 0 | 1.19.4-3.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-packaging | 0 | 20.4-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pip | 0 | 20.2.4-9.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-pip-wheel | 0 | 20.2.4-9.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-pluggy | 0 | 0.13.1-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-ply | 0 | 3.11-10.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-psutil | 0 | 5.8.0-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-psutil | 0 | 5.8.0-4.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-psycopg2 | 0 | 2.8.6-3.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-psycopg2-doc | 0 | 2.8.6-3.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-psycopg2-tests | 0 | 2.8.6-3.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-py | 0 | 1.10.0-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pybind11 | 0 | 2.7.1-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pybind11 | 0 | 2.7.1-1.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-pybind11-devel | 0 | 2.7.1-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pybind11-devel | 0 | 2.7.1-1.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-pycparser | 0 | 2.20-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pyparsing | 0 | 2.4.7-5.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pysocks | 0 | 1.7.1-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pytest | 0 | 6.0.2-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pyyaml | 0 | 5.4.1-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pyyaml | 0 | 5.4.1-1.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-requests | 0 | 2.25.0-3.module_el8.9.0+3634+fb2a896c |
| AlmaLinux:8 | python39-rpm-macros | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-scipy | 0 | 1.5.4-5.module_el8.9.0+3634+fb2a896c |
| AlmaLinux:8 | python39-setuptools | 0 | 50.3.2-7.module_el8.10.0+4040+9207bbc0 |
| AlmaLinux:8 | python39-setuptools-wheel | 0 | 50.3.2-7.module_el8.10.0+4040+9207bbc0 |
| AlmaLinux:8 | python39-six | 0 | 1.15.0-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-test | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-tkinter | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-toml | 0 | 0.10.1-5.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-urllib3 | 0 | 1.25.10-5.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-wcwidth | 0 | 0.2.5-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-wheel | 0 | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-wheel-wheel | 0 | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:9 | python-unversioned-command | 0 | 3.9.21-2.el9_6.1 |
| AlmaLinux:9 | python3 | 0 | 3.9.21-2.el9_6.1 |
| AlmaLinux:9 | python3-debug | 0 | 3.9.21-2.el9_6.1 |
| AlmaLinux:9 | python3-devel | 0 | 3.9.21-2.el9_6.1 |
| AlmaLinux:9 | python3-idle | 0 | 3.9.21-2.el9_6.1 |
| AlmaLinux:9 | python3-libs | 0 | 3.9.21-2.el9_6.1 |
| AlmaLinux:9 | python3-test | 0 | 3.9.21-2.el9_6.1 |
| AlmaLinux:9 | python3-tkinter | 0 | 3.9.21-2.el9_6.1 |
| AlmaLinux:9 | python3.11 | 0 | 3.11.11-2.el9_6.1 |
| AlmaLinux:9 | python3.11-debug | 0 | 3.11.11-2.el9_6.1 |
| AlmaLinux:9 | python3.11-devel | 0 | 3.11.11-2.el9_6.1 |
| AlmaLinux:9 | python3.11-idle | 0 | 3.11.11-2.el9_6.1 |
| AlmaLinux:9 | python3.11-libs | 0 | 3.11.11-2.el9_6.1 |
| AlmaLinux:9 | python3.11-test | 0 | 3.11.11-2.el9_6.1 |
| AlmaLinux:9 | python3.11-tkinter | 0 | 3.11.11-2.el9_6.1 |
| AlmaLinux:9 | python3.12 | 0 | 3.12.9-1.el9_6.1 |
| AlmaLinux:9 | python3.12-debug | 0 | 3.12.9-1.el9_6.1 |
| AlmaLinux:9 | python3.12-devel | 0 | 3.12.9-1.el9_6.1 |
| AlmaLinux:9 | python3.12-idle | 0 | 3.12.9-1.el9_6.1 |
| AlmaLinux:9 | python3.12-libs | 0 | 3.12.9-1.el9_6.1 |
| AlmaLinux:9 | python3.12-test | 0 | 3.12.9-1.el9_6.1 |
| AlmaLinux:9 | python3.12-tkinter | 0 | 3.12.9-1.el9_6.1 |
| Alpine:v3.19 | python3 | 0 | 3.11.13-r0 |
| Alpine:v3.20 | python3 | 0 | 3.12.11-r0 |
| Alpine:v3.21 | python3 | 0 | 3.12.11-r0 |
| Alpine:v3.22 | python3 | 0 | 3.12.11-r0 |
| Bitnami | libpython | 0 | 3.9.23 |
| Bitnami | python | 0 | 3.9.23 |
| Bitnami | python-min | 0 | 3.9.23 |
| Chainguard | python-3.13 | 0 | 3.13.4-r0 |
| Chainguard | python-3.13-base | 0 | 3.13.4-r0 |
| Chainguard | python-3.13-base-dev | 0 | 3.13.4-r0 |
| Chainguard | python-3.13-dev | 0 | 3.13.4-r0 |
| Chainguard | python-3.13-doc | 0 | 3.13.4-r0 |
| Chainguard | python-3.13-privileged-netbindservice | 0 | 3.13.4-r0 |
| Chainguard | python-3.13-tk | 0 | 3.13.4-r0 |
| Debian:11 | jython | 0 | No fix |
| Debian:11 | python2.7 | 0 | No fix |
| Debian:11 | python3.9 | 0 | No fix |
| Debian:12 | jython | 0 | No fix |
| Debian:12 | pypy3 | 0 | No fix |
| Debian:12 | python3.11 | 0 | No fix |
| Debian:13 | jython | 0 | No fix |
| Debian:13 | pypy3 | 0 | No fix |
| Debian:13 | python3.13 | 0 | No fix |
| Debian:14 | pypy3 | 0 | No fix |
| Debian:14 | python3.13 | 0 | 3.13.4-1 |
| Mageia:9 | python3 | 0 | 3.10.18-1.4.mga9 |
| SUSE:Enterprise Storage 7.1 | python3 | 0 | 3.6.15-150300.10.97.2 |
| SUSE:Enterprise Storage 7.1 | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Enterprise Storage 7.1 | python39 | 0 | 3.9.23-150300.4.75.1 |
| SUSE:Enterprise Storage 7.1 | python39-core | 0 | 3.9.23-150300.4.75.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | python3 | 0 | 3.6.15-150300.10.97.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | python39 | 0 | 3.9.23-150300.4.75.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | python39-core | 0 | 3.9.23-150300.4.75.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python3 | 0 | 3.6.15-150300.10.97.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python310 | 0 | 3.10.18-150400.4.82.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python310-core | 0 | 3.10.18-150400.4.82.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python311 | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python311-core | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | python311-documentation | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python3 | 0 | 3.6.15-150300.10.97.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python310 | 0 | 3.10.18-150400.4.82.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python310-core | 0 | 3.10.18-150400.4.82.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python311 | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python311-core | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | python311-documentation | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | python3 | 0 | 3.6.15-150300.10.97.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | python311 | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | python311-core | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | python311-documentation | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | python3 | 0 | 3.6.15-150300.10.97.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | python311 | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | python311-core | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | python311-documentation | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise Micro 5.2 | python3 | 0 | 3.6.15-150300.10.97.2 |
| SUSE:Linux Enterprise Micro 5.2 | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise Micro 5.3 | python3 | 0 | 3.6.15-150300.10.97.2 |
| SUSE:Linux Enterprise Micro 5.3 | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise Micro 5.4 | python3 | 0 | 3.6.15-150300.10.97.2 |
| SUSE:Linux Enterprise Micro 5.4 | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise Micro 5.5 | python3 | 0 | 3.6.15-150300.10.97.2 |
| SUSE:Linux Enterprise Micro 5.5 | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | python3 | 0 | 3.6.15-150300.10.97.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | python311-core | 0 | 3.11.13-150600.3.30.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python3 | 0 | 3.6.15-150300.10.97.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python311-core | 0 | 3.11.13-150600.3.30.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | python311 | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | python311-core | 0 | 3.11.13-150400.9.60.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP6 | python311 | 0 | 3.11.13-150600.3.30.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP6 | python311-core | 0 | 3.11.13-150600.3.30.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP6 | python312 | 0 | 3.12.11-150600.3.30.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP6 | python312-core | 0 | 3.12.11-150600.3.30.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311 | 0 | 3.11.13-150600.3.30.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311-core | 0 | 3.11.13-150600.3.30.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python313 | 0 | 3.13.5-150700.4.11.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python313-core | 0 | 3.13.5-150700.4.11.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | python36 | 0 | 3.6.15-84.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | python36-core | 0 | 3.6.15-84.1 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | python3 | 0 | 3.6.15-150300.10.97.2 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | python3-core | 0 | 3.6.15-150300.10.97.1 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | python39 | 0 | 3.9.23-150300.4.75.1 |
Related vulnerabilities
- CVE-2025-8291 The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory… Also affects python-unversioned-command
- CVE-2025-8194 There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and… Also affects python-unversioned-command
- CVE-2024-12718 Allows modifying some file metadata (e.g. Also affects python-unversioned-command
- CVE-2025-4517 Allows arbitrary filesystem writes outside the extraction directory during extraction… Also affects python-unversioned-command
- CVE-2025-4330 Allows the extraction filter to be ignored, allowing symlink targets to point outside the… Also affects python-unversioned-command
- CVE-2025-4435 When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior… Also affects python-unversioned-command
- CVE-2024-11168 The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts… Also affects platform-python
- CVE-2024-9287 A vulnerability has been found in the CPython `venv` module and CLI where path names… Also affects platform-python