Critical Security Update for Python 3.12: Multiple Vulnerabilities Addressed
Summary
RLSA-2025:10140: Important: python3.12 security update. Affects python3.12 versions < 0:3.12.9-2.el10_0.2. Fixed in 0:3.12.9-2.el10_0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports modules, classes, exceptions, and dynamic data types, making it suitable for various applications, from web development to data analysis. However, recent vulnerabilities have been identified in Python 3.12, specifically related to the tarfile module, which can lead to serious security risks if not addressed promptly.
Vulnerability Detail
The vulnerabilities in Python 3.12 include multiple issues with the tarfile module that allow for arbitrary file manipulations. These vulnerabilities stem from improper handling of extraction filters, which can be exploited to bypass security measures, leading to unauthorized access to file metadata and the potential for arbitrary writes. Specific CVEs include CVE-2025-4435, CVE-2024-12718, CVE-2025-4330, CVE-2025-4517, and CVE-2025-4138, each presenting unique risks that could compromise system integrity and confidentiality.
How To Fix
Minimum fixed version
0:3.12.9-2.el10_0.2
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the tarfile module for extracting files from untrusted sources until the update is applied. This can help mitigate the risk of exploitation while waiting for the patch.
Conclusion
In summary, the vulnerabilities discovered in Python 3.12 pose significant security risks that must be addressed promptly. Updating to the latest patched version is crucial to safeguard your systems. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring your software remains secure.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include arbitrary file manipulations via the tarfile module, allowing attackers to bypass extraction filters and potentially write to unauthorized locations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score for these vulnerabilities is 7.6, indicating a high severity level.
Yes, if exploited, these vulnerabilities could lead to unauthorized access and potential data loss or corruption.
If an immediate update is not possible, refrain from using the tarfile module with untrusted data sources to minimize risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
