The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
CVSS Details
- CVSS 4.0 Base Score: 2 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 3.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python3-testUpgrade tkinterUpgrade python-testUpgrade python-libsUpgrade pythonUpgrade python3Upgrade python3-debuginfoUpgrade python3-tkinterUpgrade python-debuginfoUpgrade python3-libsUpgrade python3-toolsUpgrade python3-debugUpgrade python3-develUpgrade python-debugUpgrade python-develUpgrade python-tools | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3.13-debugsourceUpgrade python3.12-testUpgrade python3.12Upgrade python3.13-freethreading-debugUpgrade python3.13-tkinterUpgrade python3.11-libsUpgrade python3.12-debuginfoUpgrade python3.11-idleUpgrade python3.11-debuginfoUpgrade python3.11-debugsourceUpgrade python3.13-develUpgrade python3.12-debugUpgrade python3.12-idleUpgrade python3.12-develUpgrade python3.13-debuginfoUpgrade python3.11-testUpgrade python3.11-debugUpgrade python3.13-testUpgrade python3.12-tkinterUpgrade python3.11-develUpgrade python3.13-libsUpgrade python3.13Upgrade python3.13-idleUpgrade python3.12-libsUpgrade python3.11-tkinterUpgrade python3.13-freethreadingUpgrade python3.12-debugsourceUpgrade python3.11Upgrade python3.13-debug | Jul 8, 2026 | Mar 12, 2026 |
| Debian | — | Upgrade python3.9Upgrade python3.11Upgrade python3.13 | May 17, 2026 | May 17, 2026 |
| Ibm Aix | — | Apply the fix or workaround for python_advisory21 | Sep 15, 2026 | Sep 15, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Mar 12, 2026 |
| Ubuntu | — | Upgrade libpython3.14Upgrade python3.10Upgrade python3.12Upgrade libpython3.12t64Upgrade libpython3.10Upgrade python3.14 | Jul 6, 2026 | Mar 12, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Mar 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub