Description

sethmlarson

opened on Jun 2, 2025

Issue body actions

Bug description:

Public issue for fixing CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, and CVE-2024-12718. See full advisory on security-announce.

[edit @encukou]: Also addresses CVE-2025-4435. Sorry for leaving that out of the commit messages.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

• gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') #135037
• [3.13] gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') (GH-135037) #135064
• [3.14] gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') (gh-135037) #135065
• [3.12] gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') (GH-135037) #135066
• [3.11] gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') (GH-135037) #135068
• [3.10] gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') (GH-135037) #135070
• [3.9] gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') (GH-135037) #135084
• [3.12] gh-135034: Remove test_realpath_permission #135093

Reacted by Bénédikt Tran and Emma Smith

Activity

1. sethmlarson

   added

   type-securityA security issueA security issue

   on Jun 2, 2025
2. picnixz

   added

   triagedThe issue has been accepted as valid by a triager.The issue has been accepted as valid by a triager.

   on Jun 2, 2025
3. ambv

   added a commit that references this issue on Jun 2, 2025

   pythongh-135034: Normalize link targets in tarfile, add `os.path.real…

   0c16f5f
4. Yhg1s

   added 2 commits that reference this issue on Jun 3, 2025

   gh-135034: Normalize link targets in tarfile, add `os.path.realpath(s…

   3612d8f

   [3.13] pythongh-135034: Normalize link targets in tarfile, add `os.pa…

   2637f45
5. ambv

   added a commit that references this issue on Jun 3, 2025

   pythongh-135034: Normalize link targets in tarfile, add `os.path.real…

   553d40f
6. Yhg1s

   added 3 commits that reference this issue on Jun 3, 2025

   [3.12] pythongh-135034: Normalize link targets in tarfile, add `os.pa…

   c358142

   [3.11] pythongh-135034: Normalize link targets in tarfile, add `os.pa…

   371b4ea

   [3.10] pythongh-135034: Normalize link targets in tarfile, add `os.pa…

   4d959a0
7. ambv

   added a commit that references this issue on Jun 3, 2025

   [3.14] gh-135034: Normalize link targets in tarfile, add `os.path.rea…

   9e0ac76
8. Yhg1s

   added 2 commits that reference this issue on Jun 3, 2025

   [3.9] pythongh-135034: Normalize link targets in tarfile, add `os.pat…

   a12f367

   [3.9] pythongh-135034: Normalize link targets in tarfile, add `os.pat…

   ab834f4
9. ambv

   added 2 commits that reference this issue on Jun 3, 2025

   [3.13] gh-135034: Normalize link targets in tarfile, add `os.path.rea…

   aa9eb5f

   [3.12] gh-135034: Normalize link targets in tarfile, add `os.path.rea…

   19de092
10. encukou

    added a commit that references this issue on Jun 3, 2025

    [3.12] pythongh-135034: Remove test_realpath_permission

    ac560d1
11. ambv

    added 4 commits that reference this issue on Jun 3, 2025

    [3.12] gh-135034: Remove test_realpath_permission (GH-135093)

    28463db

    [3.11] gh-135034: Normalize link targets in tarfile, add `os.path.rea…

    4633f3f

    [3.10] gh-135034: Normalize link targets in tarfile, add `os.path.rea…

    9c1110e

    [3.9] gh-135034: Normalize link targets in tarfile, add `os.path.real…

    dd8f187
12. sethmlarson

    changed the title [-](TODO) Empty tracking issue[/-] [+]Multiple tarfile extraction filter bypasses (`filter="tar"`/`filter="data"`)[/+] on Jun 3, 2025
13. pablogsal

    closed this as completedon Jun 3, 2025
14. Pranjal095

    added a commit that references this issue on Jul 12, 2025

    pythongh-135034: Normalize link targets in tarfile, add `os.path.real…

    1fec654
15. taegyunkim

    added a commit that references this issue on Aug 4, 2025

    pythongh-135034: Normalize link targets in tarfile, add `os.path.real…

    4ab42e9
16. Agent-Hellboy

    added a commit that references this issue on Aug 19, 2025

    pythongh-135034: Normalize link targets in tarfile, add `os.path.real…

    2304e5b
17. qkaiser

    added a commit that references this issue on Nov 3, 2026

    fix(tar): recheck directory paths before restoring their metadata

    5af5ddf

Issue actions