Critical Security Update for Python3: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:10128: Important: python3 security update. Affects platform-python versions < 3.6.8-70.el8_10.alma.1. Fixed in 3.6.8-70.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports various system calls, libraries, and windowing systems, making it a popular choice for developers. However, recent vulnerabilities have been identified in Python's tarfile module, which could lead to serious security risks if not addressed promptly.
Vulnerability Detail
The vulnerabilities in Python's tarfile module include issues such as arbitrary writes via tarfile realpath overflow and the ability to bypass extraction filters, allowing attackers to modify file metadata or create symlinks to arbitrary targets outside the extraction directory. These vulnerabilities stem from flaws in how tarfile handles filtered members and extraction processes, potentially leading to unauthorized access or data manipulation.
How To Fix
Minimum fixed version
3.6.8-70.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update platform-pythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the tarfile module for untrusted archives until the update is applied. Additionally, ensure that extraction directories are properly secured to mitigate potential risks.
Conclusion
In summary, the recent vulnerabilities identified in Python3's tarfile module pose significant security risks that must be addressed promptly. Updating to the patched version is crucial to maintaining the integrity and security of applications relying on Python. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for platform-python →
FAQ
The main vulnerabilities include arbitrary writes, extraction filter bypasses, and the ability to create symlinks to arbitrary targets outside the extraction directory.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
These vulnerabilities can lead to unauthorized access, data manipulation, and potential exploitation of the system, posing significant security risks.
Yes, a patch is available in the form of an update to version 3.6.8-70.el8_10.alma.1 for the affected Python packages.
If immediate updates are not possible, consider avoiding the use of the tarfile module for untrusted archives and ensure that extraction directories are secured.
Related vulnerabilities
Recent vulnerabilities recorded for platform-python.
