Use of Incorrectly-Resolved Name or Reference SNYK-RHEL9-PYTHON3LIBS-10415418 #7738
Description
NVD Description
Note: Versions mentioned in the description apply only to the upstream python3-libs package and not the python3-libs package as distributed by RHEL.
See How to fix? for RHEL:9 relevant fixed versions and status.
When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.
Remediation
Upgrade RHEL:9 python3-libs to version 0:3.9.21-2.el9_6.1 or higher.
This issue was patched in RHSA-2025:10136.
References
- https://access.redhat.com/security/cve/CVE-2025-4435
- python/cpython@3612d8f
- python/cpython@9e0ac76
- Multiple tarfile extraction filter bypasses (
filter="tar"/filter="data") python/cpython#135034 - gh-135034: Normalize link targets in tarfile, add
os.path.realpath(strict='allow_missing')python/cpython#135037 - https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/
- python/cpython@19de092
- python/cpython@aa9eb5f
- python/cpython@28463db
- python/cpython@4633f3f
- python/cpython@9c1110e
- python/cpython@dd8f187