GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [CVE-2025-4435] tarfile still extracts problematic files when filter is set and errorlevel is 0 · Issue #112887 · python/cpython

[CVE-2025-4435] tarfile still extracts problematic files when filter is set and errorlevel is 0 #112887

New issue
Copy link
New issue
Copy link
Closed
Closed
[CVE-2025-4435] tarfile still extracts problematic files when filter is set and errorlevel is 0#112887
Copy link
Labels
stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-securityA security issueA security issue

Description

@ChuckWoodraska
ChuckWoodraska
opened on Dec 8, 2023
Issue body actions

Bug report

Bug description:

From the docs https://docs.python.org/3.11/library/tarfile.html#tarfile.data_filter it sounds like setting errorlevel to 0 and having a filter should logged that the offending member was skipped and continue extraction. It looks like it actually logs the filter error and extracts the offending member. The below code shows the filtererror and the extraction.

From the docs: When a filter refuses to extract a file, it will raise an appropriate exception, a subclass of FilterError. This will abort the extraction if TarFile.errorlevel is 1 or more. With errorlevel=0 the error will be logged and the member will be skipped, but extraction will continue.

I was expecting it to tell me the file it skipped and not have any extraction with the given code.

import tarfile

with open('test.txt', 'w') as f:
    f.write('Hello')

with tarfile.open('my_archive.tar', 'w:xz') as tar:
    tar.add('test.txt', arcname='../test.txt')

with tarfile.open("my_archive.tar") as tar:
    tar.debug = True
    tar.errorlevel = 0
    print(tar.errorlevel)

    tar.extractall(filter="data")

CPython versions tested on:

3.11

Operating systems tested on:

macOS

Linked PRs

  • gh-112887: Fix tarfile FilterError handling to skip member extraction #112954

Activity

  1. ChuckWoodraska
    added
    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
    on Dec 8, 2023
  2. Eclips4
    added this to Tarfile issues 🗄️on Dec 8, 2023
  3. AlexWaygood
    added
    stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory
    on Dec 8, 2023
  4. encukou
    changed the title [-]tarfile still extracts problematic files when filter is set and errorlevel is 0[/-] [+][CVE-2025-4435] tarfile still extracts problematic files when filter is set and errorlevel is 0[/+] on Jun 4, 2025
  5. encukou commented on Jun 4, 2025

    @encukou
    encukou
    on Jun 4, 2025
    Member
    More actions

    This became CVE-2025-4435.
    Thank you for reporting it!

    Fixed in #135037 and backported to all maintained branches.

  6. encukou
    closed this as completedon Jun 4, 2025
  7. github-project-automation
    moved this to Done in Tarfile issues 🗄️on Jun 4, 2025
  8. AA-Turner
    added
    type-securityA security issueA security issue
    on Jun 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-securityA security issueA security issue

    Projects

    • Tarfile issues 🗄️
      Status
      Done
      Show more project fields

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.