Critical Security Update for Python 3.12: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:10189: Important: python3.12 security update. Affects python3.12 versions < 3.12.9-1.el9_6.1. Fixed in 3.12.9-1.el9_6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data types, and extensive libraries that facilitate rapid development. However, recent vulnerabilities have been identified that could compromise the integrity and security of applications relying on this version.
Vulnerability Detail
The vulnerabilities in Python 3.12 stem from issues in the tarfile module, which can lead to security breaches such as arbitrary file writes, extraction filter bypasses, and symlink creation to arbitrary targets outside the extraction directory. These vulnerabilities (CVE-2025-4435, CVE-2024-12718, CVE-2025-4330, CVE-2025-4517, CVE-2025-4138) can be exploited by malicious actors to manipulate file metadata or execute unauthorized actions, posing significant risks to system security.
How To Fix
Minimum fixed version
3.12.9-1.el9_6.1
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict the use of the tarfile module for untrusted data until the update is applied. Additionally, validate the integrity of files before extraction to mitigate risks.
Conclusion
The vulnerabilities identified in Python 3.12 pose significant risks to applications utilizing this version. It is crucial to update to the latest patched version to safeguard against potential exploits. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert to ensure ongoing security.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include arbitrary writes, extraction filter bypasses, and symlink creation to arbitrary targets, which can lead to unauthorized access and manipulation of files.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, consider restricting the use of the tarfile module for untrusted data and validating file integrity before extraction.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities allows for potential exploitation by malicious actors if not addressed promptly.
The impact includes potential unauthorized access to sensitive data, manipulation of files, and overall compromise of system security, which can lead to further attacks.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
