GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-121285: Remove backtracking when parsing tarfile headers by sethmlarson · Pull Request #121286 · python/cpython

Conversation

@sethmlarson

@sethmlarson sethmlarson commented Jul 2, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

This removes all instances of backtracking from parsing tarfile headers, specifically hdrcharset, PAX, and GNU sparse headers.

  • Issue: Remove backtracking from parsing tarfile members and headers #121285

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@sethmlarson
Remove backtracking when parsing tarfile headers
abb1b03
@sethmlarson
sethmlarson requested a review from ethanfurman as a code owner July 2, 2024 18:40
@bedevere-app bedevere-app Bot mentioned this pull request Jul 2, 2024
Remove backtracking from parsing tarfile members and headers #121285
Closed
@bedevere-app bedevere-app Bot added the awaiting review label Jul 2, 2024
Eclips4
Eclips4 reviewed Jul 2, 2024
View reviewed changes
Comment thread Misc/NEWS.d/next/Security/2024-07-02-13-39-20.gh-issue-121285.hrl-yI.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.
@sethmlarson @Eclips4
Update Misc/NEWS.d/next/Security/2024-07-02-13-39-20.gh-issue-121285.…
647f4ef 
…hrl-yI.rst

Co-authored-by: Kirill Podoprigora <[email protected]>
@sethmlarson
sethmlarson requested a review from gpshead July 2, 2024 18:45
@sethmlarson sethmlarson added type-security A security issue 3.11 only security fixes 3.10 (EOL) end of life 3.9 (EOL) end of life 3.8 (EOL) end of life 3.12 only security fixes labels Jul 2, 2024
@hugovk

hugovk commented Jul 2, 2024

Copy link
Copy Markdown
Member

@sethmlarson Did you mean to add the "Needs backport to 3.x" labels rather than the "3.x" ones?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sethmlarson sethmlarson added needs backport to 3.8 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes and removed 3.11 only security fixes 3.10 (EOL) end of life 3.9 (EOL) end of life 3.8 (EOL) end of life 3.12 only security fixes labels Jul 2, 2024
@sethmlarson

sethmlarson commented Jul 2, 2024

Copy link
Copy Markdown
Contributor Author

@hugovk Yes! Selected the wrong range of tags, my bad.
hugovk reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
ethanfurman
ethanfurman requested changes Jul 2, 2024
View reviewed changes

@ethanfurman ethanfurman left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove the type hints.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
lucsorel reacted with confused emoji sethmlarson reacted with heart emoji
All reactions
  • 😕 1 reaction
  • ❤️ 1 reaction
@bedevere-app bedevere-app Bot added awaiting changes and removed awaiting review labels Jul 2, 2024
@bedevere-app

bedevere-app Bot commented Jul 2, 2024

Copy link
Copy Markdown

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sethmlarson
sethmlarson deleted the remove-backtracking-tarfile-members branch September 3, 2024 12:19
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.11] pythongh-121285: Remove backtracking when parsing tarfile head…
b743113 
…ers (pythonGH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
@bedevere-app

bedevere-app Bot commented Sep 3, 2024

Copy link
Copy Markdown

GH-123639 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Sep 3, 2024
@bedevere-app

bedevere-app Bot commented Sep 3, 2024

Copy link
Copy Markdown

GH-123639 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.10] pythongh-121285: Remove backtracking when parsing tarfile head…
3ea4396 
…ers (pythonGH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
@bedevere-app

bedevere-app Bot commented Sep 3, 2024

Copy link
Copy Markdown

GH-123640 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.10 label Sep 3, 2024
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.9] pythongh-121285: Remove backtracking when parsing tarfile heade…
daf223e 
…rs (pythonGH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
@bedevere-app

bedevere-app Bot commented Sep 3, 2024

Copy link
Copy Markdown

GH-123641 is a backport of this pull request to the 3.9 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.9 label Sep 3, 2024
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.8] pythongh-121285: Remove backtracking when parsing tarfile heade…
80b31d4 
…rs (pythonGH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
@bedevere-app

bedevere-app Bot commented Sep 3, 2024

Copy link
Copy Markdown

GH-123642 is a backport of this pull request to the 3.8 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.8 label Sep 3, 2024
@sethmlarson

sethmlarson commented Sep 3, 2024

Copy link
Copy Markdown
Contributor Author

Backports have been created.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
pablogsal pushed a commit that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.11] gh-121285: Remove backtracking when parsing tarfile headers (G…
d449caf 
…H-121286) (#123639)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Kirill Podoprigora <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
pablogsal pushed a commit that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.10] gh-121285: Remove backtracking when parsing tarfile headers (G…
743acbe 
…H-121286) (#123640)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Kirill Podoprigora <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
ambv pushed a commit that referenced this pull request Sep 4, 2024
@sethmlarson @Eclips4 @gpshead
[3.8] gh-121285: Remove backtracking when parsing tarfile headers (GH…
7d1f50c 
…-121286) (#123642)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
ambv pushed a commit that referenced this pull request Sep 4, 2024
@sethmlarson @Eclips4 @gpshead
[3.9] gh-121285: Remove backtracking when parsing tarfile headers (GH…
b4225ca 
…-121286) (#123641)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull request Sep 5, 2024
@sethmlarson @Eclips4
@gpshead @frenzymadness
00437: [3.8] pythongh-121285: Remove backtracking when parsing tarfil…
182d6ca 
…e headers (pythonGH-121286) (python#123642)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
@frenzymadness frenzymadness mentioned this pull request Sep 5, 2024
00437: [3.8] gh-121285: Remove backtracking when parsing tarfile head… fedora-python/cpython#87
Merged
frenzymadness added a commit to frenzymadness/cpython that referenced this pull request Sep 5, 2024
@sethmlarson @Eclips4
@gpshead @frenzymadness
00437: [3.8] pythongh-121285: Remove backtracking when parsing tarfil…
3209abb 
…e headers (pythonGH-121286) (python#123642)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Lumír Balhar <[email protected]>
rickprice added a commit to ActiveState/cpython that referenced this pull request May 6, 2025
@rickprice
CVE-2024-5262 Remove backtracking when parsing tarfile headers (pytho…
1b14072 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
rickprice added a commit to ActiveState/cpython that referenced this pull request May 9, 2025
@rickprice
CVE-2024-5262 Remove backtracking when parsing tarfile headers (pytho…
792ad47 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
rickprice added a commit to ActiveState/cpython that referenced this pull request May 10, 2025
@rickprice
CVE-2024-5262 Remove backtracking when parsing tarfile headers (pytho…
6eab8d7 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
rickprice added a commit to ActiveState/cpython that referenced this pull request May 10, 2025
@rickprice
CVE-2024-5262 Remove backtracking when parsing tarfile headers (pytho…
11ad615 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
rickprice added a commit to ActiveState/cpython that referenced this pull request May 10, 2025
@rickprice
CVE-2024-5262 Remove backtracking when parsing tarfile headers (pytho…
2ba202c 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request May 14, 2025
@rickprice @icanhasmath
CVE-2024-5262 Remove backtracking when parsing tarfile headers (pytho…
2fca073 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
rickprice added a commit to ActiveState/cpython that referenced this pull request May 15, 2025
@rickprice
CVE-2024-6232 Remove backtracking when parsing tarfile headers (pytho…
8ead5b7 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
@sajjaphani sajjaphani mentioned this pull request May 19, 2025
[Security] Vulnerability found in Security vulnerability CVE-2024-6232 in package python habitat-sh/foundational-packages#65
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Eclips4 Eclips4 Eclips4 left review comments
@gpshead gpshead gpshead approved these changes
@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner
@serhiy-storchaka serhiy-storchaka Awaiting requested review from serhiy-storchaka
+1 more reviewer
@personnumber3377 personnumber3377 personnumber3377 left review comments
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

7 participants

@sethmlarson @hugovk @ethanfurman @gpshead @serhiy-storchaka @personnumber3377 @Eclips4
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.