Critical Security Update for Python 3.11: Multiple Vulnerabilities Addressed
Summary
RLSA-2025:10026: Important: python3.11 security update. Affects python3.11 versions < 0:3.11.13-1.el8_10. Fixed in 0:3.11.13-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.11 is an interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports modules, classes, exceptions, and dynamic data types, making it a popular choice for developers. However, recent vulnerabilities have been identified that could compromise the security of applications using this version.
Vulnerability Detail
The vulnerabilities in Python 3.11 stem from issues within the 'tarfile' module, which can lead to arbitrary file writes and extraction filter bypasses. Specifically, CVE-2025-4435 allows tarfile to extract filtered members when errorlevel=0, while CVE-2024-12718 and CVE-2025-4330 enable bypassing extraction filters to modify file metadata and create symlinks outside the extraction directory. These vulnerabilities can lead to severe security breaches, including unauthorized access to sensitive data.
How To Fix
Minimum fixed version
0:3.11.13-1.el8_10
This is the first release that contains the fix.
sudo dnf update python3.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the 'tarfile' module for untrusted archives until the package is updated. Additionally, ensure that your application has proper access controls in place to mitigate potential risks.
Conclusion
In summary, Python 3.11 has several critical vulnerabilities that need to be addressed promptly. Users are encouraged to update to the latest patched version to ensure the security of their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for python3.11 →
FAQ
The main vulnerabilities include arbitrary writes via tarfile realpath overflow, extraction filter bypasses, and the ability to create symlinks to arbitrary targets outside the extraction directory.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for the vulnerabilities in Python 3.11 is 7.6, indicating a high level of severity.
If an immediate update is not possible, implement strict access controls and avoid using the affected modules until a patch can be applied.
The vulnerabilities were identified by the Rocky Enterprise Software Foundation and Red Hat, who are responsible for providing the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.11.
