Critical Security Update for Python 3.12: Multiple Vulnerabilities Addressed
Summary
ALSA-2025:10140: Important: python3.12 security update. Affects python-unversioned-command versions < 3.12.9-2.el10_0.2. Fixed in 3.12.9-2.el10_0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language that supports various system calls and libraries. It is known for its simplicity and versatility, making it a popular choice for developers across different domains. However, recent vulnerabilities have been identified in Python 3.12, particularly affecting the tarfile module, which can lead to serious security risks if not addressed promptly.
Vulnerability Detail
The vulnerabilities in Python 3.12 include issues such as arbitrary writes via tarfile realpath overflow, extraction filter bypass allowing symlink creation to arbitrary targets, and the ability to modify file metadata outside the extraction directory. These vulnerabilities stem from flaws in the tarfile module, which can be exploited by attackers to manipulate files and directories, potentially leading to unauthorized access and data breaches.
How To Fix
Minimum fixed version
3.12.9-2.el10_0.2
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the tarfile module for extracting files from untrusted sources until the update is applied. Ensure that any file operations are conducted in a controlled environment to minimize risk.
Conclusion
In summary, multiple critical vulnerabilities have been identified in Python 3.12, particularly affecting the tarfile module. It is crucial to update to the patched version to mitigate risks. Utilizing tools like Vulert can help monitor and alert for vulnerabilities in your software effectively.
See every vulnerability recorded for python-unversioned-command →
FAQ
The vulnerabilities involve the tarfile module, allowing attackers to exploit file extraction processes to manipulate files and directories.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can receive real-time alerts about vulnerabilities.
Failure to address these vulnerabilities may lead to unauthorized access, data breaches, and exploitation of your application by malicious actors.
Yes, you should upgrade to version 3.12.9-2.el10_0.2 to ensure that all vulnerabilities are patched.
Yes, you can use the Vulert playground to check for vulnerabilities in your application without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
