Sitelet https://github.com/python/cpython/issues/135034
Skip to content

Multiple tarfile extraction filter bypasses (filter="tar"/filter="data") #135034

Closed
Closed
Multiple tarfile extraction filter bypasses (filter="tar"/filter="data")#135034
Labels
triagedThe issue has been accepted as valid by a triager.type-securityA security issue

Description

@sethmlarson
sethmlarson
opened on Jun 2, 2025

Bug description:

Public issue for fixing CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, and CVE-2024-12718. See full advisory on security-announce.

[edit @encukou]: Also addresses CVE-2025-4435. Sorry for leaving that out of the commit messages.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

Activity

sethmlarson
added
type-securityA security issue
on Jun 2, 2025
picnixz
added
triagedThe issue has been accepted as valid by a triager.
on Jun 2, 2025
ambv
added a commit that references this issue on Jun 2, 2025

pythongh-135034: Normalize link targets in tarfile, add `os.path.real…

0c16f5f
Yhg1s
added 2 commits that reference this issue on Jun 3, 2025

gh-135034: Normalize link targets in tarfile, add `os.path.realpath(s…

3612d8f

[3.13] pythongh-135034: Normalize link targets in tarfile, add `os.pa…

2637f45
ambv
added a commit that references this issue on Jun 3, 2025

pythongh-135034: Normalize link targets in tarfile, add `os.path.real…

553d40f
Yhg1s
added 3 commits that reference this issue on Jun 3, 2025

[3.12] pythongh-135034: Normalize link targets in tarfile, add `os.pa…

c358142

[3.11] pythongh-135034: Normalize link targets in tarfile, add `os.pa…

371b4ea

[3.10] pythongh-135034: Normalize link targets in tarfile, add `os.pa…

4d959a0
ambv
added a commit that references this issue on Jun 3, 2025

[3.14] gh-135034: Normalize link targets in tarfile, add `os.path.rea…

9e0ac76
Yhg1s
added 2 commits that reference this issue on Jun 3, 2025

[3.9] pythongh-135034: Normalize link targets in tarfile, add `os.pat…

a12f367

[3.9] pythongh-135034: Normalize link targets in tarfile, add `os.pat…

ab834f4
ambv
added 2 commits that reference this issue on Jun 3, 2025

[3.13] gh-135034: Normalize link targets in tarfile, add `os.path.rea…

aa9eb5f

[3.12] gh-135034: Normalize link targets in tarfile, add `os.path.rea…

19de092
encukou
added a commit that references this issue on Jun 3, 2025

[3.12] pythongh-135034: Remove test_realpath_permission

ac560d1
ambv
added 4 commits that reference this issue on Jun 3, 2025

[3.12] gh-135034: Remove test_realpath_permission (GH-135093)

28463db

[3.11] gh-135034: Normalize link targets in tarfile, add `os.path.rea…

4633f3f

[3.10] gh-135034: Normalize link targets in tarfile, add `os.path.rea…

9c1110e

[3.9] gh-135034: Normalize link targets in tarfile, add `os.path.real…

dd8f187
sethmlarson
changed the title [-](TODO) Empty tracking issue[/-] [+]Multiple tarfile extraction filter bypasses (`filter="tar"`/`filter="data"`)[/+] on Jun 3, 2025
pablogsal
closed this as completedon Jun 3, 2025
Pranjal095
added a commit that references this issue on Jul 12, 2025

pythongh-135034: Normalize link targets in tarfile, add `os.path.real…

1fec654
taegyunkim
added a commit that references this issue on Aug 4, 2025

pythongh-135034: Normalize link targets in tarfile, add `os.path.real…

4ab42e9
Agent-Hellboy
added a commit that references this issue on Aug 19, 2025

pythongh-135034: Normalize link targets in tarfile, add `os.path.real…

2304e5b
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    triagedThe issue has been accepted as valid by a triager.type-securityA security issue

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions