Infinite Loop Vulnerability in Python3's tarfile Module
Summary
ALPINE-CVE-2019-20907: In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. Affects python3 versions < 3.8.5-r0. Fixed in 3.8.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The 'tarfile' module in Python allows users to read and write tar archive files, making it essential for file compression and distribution. However, certain versions of Python3, specifically those prior to 3.8.5, contain a vulnerability that can be exploited through crafted TAR archives, leading to potential denial of service due to infinite loops.
Vulnerability Detail
In Lib/tarfile.py of Python versions up to 3.8.3, an attacker can create a malicious TAR archive that, when opened using tarfile.open, triggers an infinite loop. This occurs because the _proc_pax function lacks proper header validation, allowing the crafted archive to bypass checks and cause the application to hang indefinitely. The vulnerability is identified as CVE-2019-20907 and has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
3.8.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid opening untrusted TAR archives using the tarfile module until you can update to a secure version. Additionally, consider validating the contents of TAR files before processing them.
Conclusion
The vulnerability identified as CVE-2019-20907 in Python's tarfile module poses a significant risk by allowing crafted TAR archives to cause infinite loops. It is crucial for users to update to version 3.8.5-r0 or later to mitigate this risk. For those unable to update immediately, employing workarounds and validating TAR files is recommended.
See every vulnerability recorded for python3 →
FAQ
CVE-2019-20907 is a vulnerability in the tarfile module of Python that allows an attacker to create a TAR archive that causes an infinite loop when opened.
Python versions up to 3.8.3 are affected by this vulnerability. Versions 3.8.5 and above contain the fix.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update Python right away, avoid processing untrusted TAR files and validate their contents before use.
The vulnerability can lead to denial of service, as the application may hang indefinitely when processing a malicious TAR archive.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
