CVE-2007-4559

Published: 28 August 2007

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

Notes

Upstream python eventually decided to fix this by adding an
additional option to the affected functions to specify adding a
filter. See PEP 706.
While this does not change the default behaviour, applications
modified to use the filter can now safely extract untrusted tar
files.
Due to the default not changing, we will not be fixing this
issue in older Python releases, marking as ignored.

Status

References

• https://discuss.python.org/t/policies-for-tarfile-extractall-a-k-a-fixing-cve-2007-4559/23149/28
• https://peps.python.org/pep-0706/
• https://www.cve.org/CVERecord?id=CVE-2007-4559
• NVD
• Launchpad
• Debian

Bugs

• https://github.com/python/cpython/issues/102950