Critical Security Flaws in Python 3.12: Essential Update Required
Summary
ALSA-2025:10031: Important: python3.12 security update. Affects python3.12 versions < 3.12.11-1.el8_10. Fixed in 3.12.11-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is a widely-used, interpreted programming language known for its versatility and ease of use. It supports various programming paradigms, including procedural, object-oriented, and functional programming. Python is equipped with a rich standard library and is commonly used for web development, data analysis, artificial intelligence, and more. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this version.
Vulnerability Detail
The vulnerabilities in Python 3.12 include multiple issues related to the tarfile module, which can lead to serious security risks. These include the ability to bypass extraction filters, arbitrary writes via realpath overflow, and the potential for creating symlinks to arbitrary targets outside the extraction directory. These vulnerabilities could allow attackers to manipulate file metadata, leading to unauthorized access or data corruption.
How To Fix
Minimum fixed version
3.12.11-1.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the tarfile module for extracting files from untrusted sources until the update is applied. Additionally, implement strict validation of file paths and metadata to mitigate risks.
Conclusion
The identified vulnerabilities in Python 3.12 pose significant risks to applications using this version. It is crucial to apply the necessary updates to mitigate these risks and ensure the security of your software. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include extraction filter bypasses, arbitrary writes, and the ability to create symlinks to arbitrary targets outside the extraction directory.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
If an immediate update is not possible, avoid using the tarfile module for untrusted files and implement strict validation of file paths.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities, providing an easy way to stay informed.
The vulnerabilities can lead to unauthorized access, data corruption, and potential exploitation of the system, making it critical to address them promptly.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
