Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
fedora-cve-triage 0.27.1 (analysis 1): asahi-installer bundles python 3.13.9, older than the fix in 3.13.14 — the bug is real (bundled-library) This is a real finding rather than a false positive: the bug should stay open until the fix reaches this package.
fedora-cve-triage 0.27.1 (analysis 2; builds asahi-installer-0.9.1-1.fc43, asahi-installer-0.9.1-1.fc44, asahi-installer-0.9.2-2.fc45, asahi-installer-0.9.2-4.fc46): asahi-installer bundles python 3.13.17, at or past the fix in commit 0478bd83d82b (in v3.13.17) — bodhi-check's to close against the update that brought it (bundled-library)
fedora-cve-triage 0.27.1 (analysis 3; builds asahi-installer-0.9.1-1.fc43, asahi-installer-0.9.1-1.fc44, asahi-installer-0.9.2-2.fc45, asahi-installer-0.9.2-4.fc46): asahi-installer is fixed on F46 (bundles python 3.13.17, at or past the fix in commit 0478bd83d82b (in v3.13.17)) but not on F43, F44, F45 (bundles python 3.13.9, older than the fix in 3.13.14) — the bug is real (bundled-library) This is a real finding rather than a false positive: the bug should stay open until the fix reaches this package.
fedora-cve-triage 0.27.1 (analysis 3; builds asahi-installer-0.9.1-1.fc43, asahi-installer-0.9.1-1.fc44, asahi-installer-0.9.2-2.fc45, asahi-installer-0.9.2-4.fc46): fixed on some releases, still unfixed on F43, F44, F45 (bodhi-check) asahi-installer is fixed on F46 (bundles python 3.13.17, at or past the fix in commit 0478bd83d82b (in v3.13.17)) but not on F43, F44, F45 (bundles python 3.13.9, older than the fix in 3.13.14) — the bug is real (bundled-library) This bug covers every release of its family, and the fix has reached some of them but not all. Fixed by: asahi-installer-0.9.2-4.fc46 (FEDORA-2026-811cfc71b8) Still unfixed on: F43, F44, F45 Leaving the bug open. If those releases are meant to be built too, this is the reminder; if they are not affected or are deliberately being left, say so here and the bug can be closed.
FEDORA-2026-9ff6e78b75 (asahi-installer-0.9.2-4.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-9ff6e78b75
FEDORA-2026-9ff6e78b75 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-9ff6e78b75` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-9ff6e78b75 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-9ff6e78b75 (asahi-installer-0.9.2-4.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.