p PatchFirst

CVE-2025-4435

CVE-2025-4435 · Tarfile extracts filtered members when errorlevel=0

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.

CVSS 7.5 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • python

    Versions
    • ≥ 0, < 3.9.23: Affected (python)
    • ≥ 3.10.0, < 3.10.18: Affected (python)
    • ≥ 3.11.0, < 3.11.13: Affected (python)
    • ≥ 3.12.0, < 3.12.11: Affected (python)
    • ≥ 3.13.0, < 3.13.4: Affected (python)
    • ≥ 3.14.0a1, < 3.14.0b3: Affected (python)

    Update to 3.10.18; Update to 3.11.13; Update to 3.12.11; Update to 3.13.4; Update to 3.14.0b3; Update to 3.9.23

  • pypy3 Debian:13

    Versions
    • 7.3.19+dfsg-2
    • 7.3.20+dfsg-1
    • 7.3.20+dfsg-2
    • 7.3.20+dfsg-3
    • 7.3.20+dfsg-4
    • 7.3.21+dfsg-1
    • 7.3.21+dfsg-2
    • 7.3.21+dfsg-3
    • 7.3.21+dfsg-4
    • 7.3.22+dfsg-1
    • 7.3.23+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypy3 Debian:14

    Versions
    • 7.3.19+dfsg-2
    • 7.3.20+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 7.3.20+dfsg-2

    Update to 7.3.20+dfsg-2

  • python3.13 Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.13.4-1

    Update to 3.13.4-1

  • python3.13 Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.13.4-1

    Update to 3.13.4-1

  • python3.12 Ubuntu:24.04:LTS

    Versions
    • 3.12.0-1
    • 3.12.0-5
    • 3.12.0-6
    • 3.12.0-7
    • 3.12.1-2
    • 3.12.2-1
    • 3.12.2-4build3
    • 3.12.2-4build4
    • 3.12.2-5ubuntu3
    • 3.12.3-1
    • 3.12.3-1ubuntu0.1
    • 3.12.3-1ubuntu0.2
    • 3.12.3-1ubuntu0.3
    • 3.12.3-1ubuntu0.4
    • 3.12.3-1ubuntu0.5
    • 3.12.3-1ubuntu0.6
    Affected ranges
    • ECOSYSTEM: < 3.12.3-1ubuntu0.7

    Update to 3.12.3-1ubuntu0.7

  • python3.14 Ubuntu:25.10

    Versions
    • 3.14.0~a7-0ubuntu1
    • 3.14.0~b1-1
    • 3.14.0~b3-1
    • 3.14.0~rc1-1
    • 3.14.0~rc2-1
    • 3.14.0~rc3-1
    Affected ranges
    • ECOSYSTEM: < 3.14.0-1

    Update to 3.14.0-1

Original sources

Check your server →