Critical Security Flaws in Python 3.11: Multiple Vulnerabilities Addressed
Summary
ALSA-2025:10148: Important: python3.11 security update. Affects python3.11 versions < 3.11.11-2.el9_6.1. Fixed in 3.11.11-2.el9_6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.11 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data types, and extensive libraries that facilitate rapid development. However, recent vulnerabilities have been identified that could compromise the security of applications using this version.
Vulnerability Detail
The vulnerabilities in Python 3.11 include multiple security issues related to the tarfile module. These issues allow for arbitrary file writes, bypassing of extraction filters, and the creation of symbolic links to arbitrary targets outside the extraction directory. Specifically, CVE-2025-4435 allows tarfile to extract filtered members when errorlevel=0, while CVE-2024-12718 and CVE-2025-4330 enable bypassing extraction filters. CVE-2025-4517 introduces arbitrary writes via tarfile realpath overflow, and CVE-2025-4138 allows for the creation of symlinks to arbitrary targets. These vulnerabilities could lead to unauthorized access and manipulation of files, posing significant risks to system integrity.
How To Fix
Minimum fixed version
3.11.11-2.el9_6.1
This is the first release that contains the fix.
sudo dnf update python3.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the tarfile module for extracting files from untrusted sources until the update is applied. Additionally, implementing strict file permission checks can help mitigate risks associated with these vulnerabilities.
Conclusion
The vulnerabilities identified in Python 3.11 pose significant risks to applications relying on this version. It is crucial to update to the latest patched version to mitigate these risks. Users should also consider using Vulert to monitor for vulnerabilities in their software without needing to access the code directly.
See every vulnerability recorded for python3.11 →
FAQ
The main vulnerabilities include arbitrary file writes, extraction filter bypasses, and symlink creation to arbitrary targets, which can compromise system security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
These vulnerabilities can lead to unauthorized access, data manipulation, and potential system compromise, making it critical to apply the security update.
Yes, a patch is available in version 3.11.11-2.el9_6.1 of Python 3.11, which addresses these security issues.
If immediate updating is not possible, refrain from using the tarfile module with untrusted sources and implement strict file permission checks as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11.
