Critical Metadata Modification Vulnerability in Jython and Python Packages
Summary
CVE-2024-12718: Allows modifying some file metadata (e.g. Affects python3 across 9 version ranges.
< 3.11.13-r0
< 9c1110ef6652687d7c55f590f909720eddde965a
< 9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a
< 19de092debb3d7e832e5672cc2f7b788d35951da
< 3612d8f51741b11f36f8fb0494d79086bac9390a
< 4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e
< 28463dba112af719df1e8b0391c46787ad756dd9
< aa9eb5f757ceff461e6e996f12c89e5d9b583b01
< dd8f187d0746da151e0025c51680979ac5b4cfb1
Fixed in 3.11.13-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jython is an implementation of the Python programming language that runs on the Java platform. It allows seamless integration of Java and Python code, enabling developers to leverage both ecosystems. The tarfile module in Python, which is used for reading and writing tar archives, has introduced an extraction filter feature in versions 3.12 and later. This feature, while useful, has also introduced a vulnerability that can be exploited if untrusted tar archives are processed incorrectly.
Vulnerability Detail
The vulnerability, identified as CVE-2024-12718, allows attackers to modify file metadata, such as the last modified date, or file permissions of files outside the extraction directory when using the tarfile module with specific filters. This issue arises when using the TarFile.extractall() or TarFile.extract() methods with the filter parameter set to 'data' or 'tar'. Only Python versions 3.12 and later are affected, and for Python 3.14 or later, the default filter value has changed to 'data', which may inadvertently expose users to this vulnerability. The implications of this vulnerability can lead to unauthorized access or manipulation of files, posing a significant security risk.
How To Fix
Minimum fixed version
3.11.13-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the tarfile module's extract methods with the filter parameter set to 'data' or 'tar'. Instead, consider extracting tar files using a different method or library that does not expose this vulnerability.
Conclusion
CVE-2024-12718 poses a significant security risk for users of Jython and Python packages that utilize the tarfile module with specific filters. It is crucial to update to patched versions of the affected packages and to implement workarounds until updates can be applied. Regular monitoring of vulnerabilities using tools like Vulert can help maintain security.
See every vulnerability recorded for python3 →
FAQ
CVE-2024-12718 is a vulnerability that allows unauthorized modification of file metadata and permissions when extracting untrusted tar archives using specific filters in the tarfile module.
Only Python versions 3.12 and later are affected by this vulnerability. Python versions prior to 3.12 do not include the extraction filter feature.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, avoid using the vulnerable features of the tarfile module as a temporary workaround.
The risks include unauthorized access to sensitive files and the ability to manipulate file metadata, which could lead to further exploitation or data breaches.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
