Extraction Flaw in Jython and Python Packages: CVE-2025-4435
Summary
CVE-2025-4435: When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. Affects pypy3 across 8 version ranges.
< 9c1110ef6652687d7c55f590f909720eddde965a
< 9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a
< 19de092debb3d7e832e5672cc2f7b788d35951da
< 3612d8f51741b11f36f8fb0494d79086bac9390a
< 4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e
< 28463dba112af719df1e8b0391c46787ad756dd9
< aa9eb5f757ceff461e6e996f12c89e5d9b583b01
< dd8f187d0746da151e0025c51680979ac5b4cfb1
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jython is an implementation of the Python programming language designed to run on the Java platform. It allows seamless integration of Python code with Java applications. The affected versions of Jython and Python packages in Debian ecosystems are vulnerable to a flaw in the TarFile extraction process, which can lead to unintended file extractions.
Vulnerability Detail
The vulnerability arises from a misconfiguration in the TarFile.errorlevel setting. When set to 0, the expected behavior is to skip filtered members during extraction. However, in the affected versions, members that should be filtered are still extracted, potentially leading to unauthorized access to sensitive files. This flaw can be exploited by attackers to manipulate the extraction process, resulting in security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually verify the contents of tar files before extraction to ensure that no sensitive files are included. Additionally, consider setting TarFile.errorlevel to a value other than 0 if feasible, to avoid unintended extractions.
Conclusion
CVE-2025-4435 presents a significant risk to users of Jython and Python packages in Debian due to a flaw in the tar file extraction process. It is crucial for users to update their packages promptly and consider workarounds until updates can be applied.
See every vulnerability recorded for pypy3 →
FAQ
CVE-2025-4435 is a vulnerability affecting Jython and Python packages in Debian that allows unintended file extractions during the tar file extraction process.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The main risk is unauthorized access to sensitive files that should not be extracted, which can lead to data breaches and security incidents.
Yes, users are advised to update their Jython and Python packages to the latest versions available in the Debian repositories to mitigate this vulnerability.
If immediate updates are not possible, consider implementing manual checks on tar files and adjusting the TarFile.errorlevel setting as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypy3.
