Critical Directory Traversal Vulnerability in Python Packages: CVE-2007-4559
Summary
UBUNTU-CVE-2007-4559: Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. Affects python2.7 versions 2.7.5-8ubuntu3 – 2.7.6-8ubuntu0.6+esm9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is extensively utilized in web development, data analysis, artificial intelligence, and more. The vulnerability in question affects various Python packages, specifically those that utilize the tarfile module, which is responsible for reading and writing tar archives. This vulnerability allows attackers to exploit the functionality of the tarfile module, leading to potential unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability, identified as CVE-2007-4559, is a directory traversal issue in the extract and extractall functions of the tarfile module in Python. It allows user-assisted remote attackers to overwrite arbitrary files on the system by using a '..' (dot dot) sequence in filenames within a TAR archive. This can lead to severe consequences, including data loss, unauthorized access, and system compromise. The vulnerability has a CVSS score of 9.8, indicating its critical nature and the urgency for remediation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the extract and extractall functions of the tarfile module with untrusted TAR archives. If you must use these functions, ensure that the input is sanitized to prevent directory traversal attacks. For example, you can implement a check to validate the file paths before extraction.
Conclusion
In summary, CVE-2007-4559 is a critical directory traversal vulnerability affecting various Python packages. It is essential to update the affected packages to their patched versions to mitigate the risk of exploitation. Additionally, users should be cautious when handling TAR archives and consider using Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2007-4559 is a critical directory traversal vulnerability in the tarfile module of Python that allows attackers to overwrite arbitrary files using specially crafted TAR archives.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized file access, data loss, and system compromise, making it critical to address promptly.
You can update your Python packages using the terminal commands: sudo apt update followed by sudo apt upgrade <package_name>.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
