Critical Security Update for Python 3.9: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:10136: Important: python3.9 security update. Affects python-unversioned-command versions < 3.9.21-2.el9_6.1. Fixed in 3.9.21-2.el9_6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.9 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data types, and extensive libraries, making it a versatile choice for developers. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this version, necessitating immediate attention and updates.
Vulnerability Detail
The vulnerabilities in Python 3.9 stem from issues within the tarfile module, which can lead to unauthorized file access and manipulation. Specific vulnerabilities include the ability to extract filtered members when errorlevel=0 (CVE-2025-4435), bypass extraction filters to modify file metadata outside the extraction directory (CVE-2024-12718), and arbitrary writes via tarfile realpath overflow (CVE-2025-4517). These vulnerabilities could allow attackers to create symlinks to arbitrary targets, posing significant risks to system integrity and data security.
How To Fix
Minimum fixed version
3.9.21-2.el9_6.1
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the tarfile module for untrusted input until the update is applied. Implement strict validation of file paths and permissions when dealing with file extraction.
Conclusion
The vulnerabilities identified in Python 3.9 pose significant risks to applications relying on this version. Immediate action is required to update to the patched version to safeguard against potential exploits. Utilizing tools like Vulert can aid in monitoring and alerting for such vulnerabilities in real-time.
See every vulnerability recorded for python-unversioned-command →
FAQ
The main vulnerabilities include issues with the tarfile module that allow unauthorized file access and manipulation, leading to potential security breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid using the tarfile module for untrusted input and implement strict validation of file paths.
These vulnerabilities can lead to unauthorized access and manipulation of files, potentially compromising system integrity and data security.
For more details, refer to the CVE pages listed in the vulnerability report, which provide in-depth information about each specific issue.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
