Bug 2372426 (CVE-2025-4138) - CVE-2025-4138 cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
Summary: CVE-2025-4138 cpython: python: Bypassing extraction filter to create symlinks...
Keywords:
Status: NEW
Alias: CVE-2025-4138
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2372448 2373723 2373724
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-06-12 09:04 UTC by OSIDB Bzimport
Modified: 2025-10-30 04:54 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2025:10198 0 None None None 2025-07-02 08:38:51 UTC
Red Hat Product Errata RHBA-2025:10245 0 None None None 2025-07-02 14:31:39 UTC
Red Hat Product Errata RHBA-2025:10247 0 None None None 2025-07-02 14:53:43 UTC
Red Hat Product Errata RHBA-2025:10249 0 None None None 2025-07-02 15:03:59 UTC
Red Hat Product Errata RHBA-2025:10261 0 None None None 2025-07-02 17:04:56 UTC
Red Hat Product Errata RHBA-2025:10262 0 None None None 2025-07-02 17:15:22 UTC
Red Hat Product Errata RHBA-2025:10263 0 None None None 2025-07-02 17:33:28 UTC
Red Hat Product Errata RHBA-2025:10338 0 None None None 2025-07-07 01:00:33 UTC
Red Hat Product Errata RHBA-2025:10339 0 None None None 2025-07-07 01:38:44 UTC
Red Hat Product Errata RHBA-2025:10340 0 None None None 2025-07-07 02:27:59 UTC
Red Hat Product Errata RHBA-2025:10365 0 None None None 2025-07-07 01:29:46 UTC
Red Hat Product Errata RHBA-2025:10366 0 None None None 2025-07-07 02:18:17 UTC
Red Hat Product Errata RHBA-2025:10367 0 None None None 2025-07-07 02:40:13 UTC
Red Hat Product Errata RHBA-2025:10417 0 None None None 2025-07-07 13:02:21 UTC
Red Hat Product Errata RHBA-2025:10420 0 None None None 2025-07-07 13:04:12 UTC
Red Hat Product Errata RHBA-2025:10421 0 None None None 2025-07-07 13:09:28 UTC
Red Hat Product Errata RHBA-2025:10422 0 None None None 2025-07-07 13:11:23 UTC
Red Hat Product Errata RHBA-2025:10423 0 None None None 2025-07-07 13:05:07 UTC
Red Hat Product Errata RHBA-2025:10424 0 None None None 2025-07-07 13:07:29 UTC
Red Hat Product Errata RHBA-2025:10425 0 None None None 2025-07-07 13:12:28 UTC
Red Hat Product Errata RHBA-2025:10426 0 None None None 2025-07-07 13:11:03 UTC
Red Hat Product Errata RHBA-2025:10427 0 None None None 2025-07-07 13:14:36 UTC
Red Hat Product Errata RHBA-2025:10598 0 None None None 2025-07-08 10:53:27 UTC
Red Hat Product Errata RHBA-2025:10841 0 None None None 2025-07-14 07:01:02 UTC
Red Hat Product Errata RHBA-2025:10843 0 None None None 2025-07-14 07:00:59 UTC
Red Hat Product Errata RHBA-2025:11346 0 None None None 2025-07-16 18:33:09 UTC
Red Hat Product Errata RHBA-2025:11347 0 None None None 2025-07-16 18:38:12 UTC
Red Hat Product Errata RHBA-2025:11895 0 None None None 2025-07-28 11:10:46 UTC
Red Hat Product Errata RHBA-2025:12137 0 None None None 2025-07-29 16:26:57 UTC
Red Hat Product Errata RHSA-2025:10026 0 None None None 2025-07-01 08:39:09 UTC
Red Hat Product Errata RHSA-2025:10028 0 None None None 2025-07-01 08:46:43 UTC
Red Hat Product Errata RHSA-2025:10031 0 None None None 2025-07-01 09:09:59 UTC
Red Hat Product Errata RHSA-2025:10128 0 None None None 2025-07-01 19:57:30 UTC
Red Hat Product Errata RHSA-2025:10136 0 None None None 2025-07-01 20:48:37 UTC
Red Hat Product Errata RHSA-2025:10140 0 None None None 2025-07-01 21:43:37 UTC
Red Hat Product Errata RHSA-2025:10148 0 None None None 2025-07-01 21:56:00 UTC
Red Hat Product Errata RHSA-2025:10189 0 None None None 2025-07-02 06:18:17 UTC
Red Hat Product Errata RHSA-2025:10399 0 None None None 2025-07-07 11:15:37 UTC
Red Hat Product Errata RHSA-2025:10484 0 None None None 2025-07-07 16:11:38 UTC
Red Hat Product Errata RHSA-2025:10602 0 None None None 2025-07-08 11:10:57 UTC
Red Hat Product Errata RHSA-2025:11386 0 None None None 2025-07-17 15:27:06 UTC
Red Hat Product Errata RHSA-2025:9918 0 None None None 2025-06-30 13:38:17 UTC

Description OSIDB Bzimport 2025-06-12 09:04:21 UTC
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.


You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature.

Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.

Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.

Comment 6 errata-xmlrpc 2025-06-30 13:38:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:9918 https://access.redhat.com/errata/RHSA-2025:9918

Comment 7 errata-xmlrpc 2025-07-01 08:39:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:10026 https://access.redhat.com/errata/RHSA-2025:10026

Comment 8 errata-xmlrpc 2025-07-01 08:46:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:10028 https://access.redhat.com/errata/RHSA-2025:10028

Comment 9 errata-xmlrpc 2025-07-01 09:09:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:10031 https://access.redhat.com/errata/RHSA-2025:10031

Comment 10 errata-xmlrpc 2025-07-01 19:57:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:10128 https://access.redhat.com/errata/RHSA-2025:10128

Comment 11 errata-xmlrpc 2025-07-01 20:48:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:10136 https://access.redhat.com/errata/RHSA-2025:10136

Comment 12 errata-xmlrpc 2025-07-01 21:43:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:10140 https://access.redhat.com/errata/RHSA-2025:10140

Comment 13 errata-xmlrpc 2025-07-01 21:55:59 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:10148 https://access.redhat.com/errata/RHSA-2025:10148

Comment 15 errata-xmlrpc 2025-07-02 06:18:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:10189 https://access.redhat.com/errata/RHSA-2025:10189

Comment 17 errata-xmlrpc 2025-07-07 11:15:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:10399 https://access.redhat.com/errata/RHSA-2025:10399

Comment 18 errata-xmlrpc 2025-07-07 16:11:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  Red Hat Enterprise Linux 8.6 Extended Update Support EXTENSION

Via RHSA-2025:10484 https://access.redhat.com/errata/RHSA-2025:10484

Comment 19 errata-xmlrpc 2025-07-08 11:10:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  Red Hat Enterprise Linux 8.8 Extended Update Support EXTENSION

Via RHSA-2025:10602 https://access.redhat.com/errata/RHSA-2025:10602

Comment 25 errata-xmlrpc 2025-07-17 15:27:04 UTC
This issue has been addressed in the following products:

  RHEL-8 based Middleware Containers

Via RHSA-2025:11386 https://access.redhat.com/errata/RHSA-2025:11386


Note You need to log in before you can comment on or make changes to this bug.