INFSA-2025:10140: python3.12 security update

Information about definition

Identificator: INFSA-2025:10140

Type: security

Release date: 2025-07-25 10:33:11 UTC

Information about package

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Vulnerabilities description

  • CVE-2024-12718

    A flaw was found in CPython's tarfile module. This vulnerability allows modification of file metadata, such as timestamps or permissions, outside the intended extraction directory via maliciously crafted tar archives using the filter="data" or filter="tar" extraction filters.

  • CVE-2025-4138

    A flaw was found in the Python tarfile module. This vulnerability allows attackers to bypass extraction filters, enabling symlink targets to escape the destination directory and allowing unauthorized modification of file metadata via the use of TarFile.extract() or TarFile.extractall() with the filter= parameter set to "data" or "tar".

  • CVE-2025-4330

    A flaw was found in CPython's tarfile module. This vulnerability allows bypassing of extraction filters, enabling symlink traversal outside the intended extraction directory and potential modification of file metadata via malicious tar archives using TarFile.extractall() or TarFile.extract() with the filter="data" or filter="tar" parameters. This issue leads to potentially overwriting or modifying system files and metadata.

  • CVE-2025-4435

    A flaw was found in CPython's tarfile module. This vulnerability allows unauthorized file extraction via crafted tar archives when TarFile.errorlevel=0, bypassing expected filtering mechanisms.

  • CVE-2025-4517

    A flaw was found in the CPython tarfile module. This vulnerability allows arbitrary filesystem writes outside the extraction directory via extracting untrusted tar archives using the TarFile.extractall() or TarFile.extract() methods with the extraction filter parameter set to "data" or "tar".

Severity level

CVE Score CVSS 2.0 Score CVSS 3.x Score CVSS 4.0
no information 7.6 no information
NIST — CVE-2025-4138
 no information 7.5 no information
NIST — CVE-2025-4330
 no information 7.3 no information
NIST — CVE-2025-4435
 no information 7.5 no information
NIST — CVE-2025-4517
 no information 7.6 no information
Critical, important, moderate, low

Updated packages