Critical Security Update for Python 3.12: Multiple Vulnerabilities Addressed
Summary
RLSA-2025:10189: Important: python3.12 security update. Affects python3.12 versions < 0:3.12.9-1.el9_6.1. Fixed in 0:3.12.9-1.el9_6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports modules, classes, exceptions, and dynamic data types, making it suitable for various applications, from web development to data analysis. However, recent vulnerabilities have been identified in Python 3.12 that could allow attackers to exploit the tarfile module, leading to potential unauthorized access and manipulation of files.
Vulnerability Detail
The vulnerabilities in Python 3.12 stem from issues in the tarfile module, which can lead to arbitrary file writes and extraction filter bypasses. Specifically, attackers may exploit these vulnerabilities to extract filtered members, modify file metadata outside the extraction directory, and create symlinks to arbitrary targets. The vulnerabilities are tracked under CVEs: CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, and CVE-2025-4517. The CVSS score for these vulnerabilities is 7.6, indicating a high severity level that could lead to significant impacts on system integrity and confidentiality.
How To Fix
Minimum fixed version
0:3.12.9-1.el9_6.1
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the tarfile module for untrusted archives until the update is applied. If you must use it, ensure that you validate the contents of the archive and restrict the extraction paths to prevent unauthorized access.
Conclusion
In summary, Python 3.12 has several critical vulnerabilities that require immediate attention. Updating to the patched version is essential to safeguard your applications from potential exploits. Utilize tools like Vulert to monitor your software for vulnerabilities and ensure your systems remain secure.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include arbitrary file writes, extraction filter bypasses, and the ability to create symlinks to arbitrary targets, which can lead to unauthorized access and manipulation of files.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for any affected packages.
The CVSS score for the vulnerabilities in Python 3.12 is 7.6, indicating a high severity level.
Yes, as a workaround, avoid using the tarfile module for untrusted archives and validate the contents before extraction.
For more details, refer to the CVE pages associated with the vulnerabilities, which provide comprehensive information about the issues and their impacts.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
