Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.6
Python Update Fixes Security Risks in File Extraction
published 5 months ago
Summary
A security update for Python fixes several issues that could allow attackers to modify or create files outside of a safe extraction area. This could lead to unauthorized changes to your system. You should update your Python installation as soon as possible to protect your system.
What to do
- Update rocky python3 to version 0:3.6.8-70.el8_10.rocky.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:8 | rocky | python3 |
< 0:3.6.8-70.el8_10.rocky.0 Fix: upgrade to 0:3.6.8-70.el8_10.rocky.0
|
Original advisory text
Important: python3 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)
* cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718)
* cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)
* python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)
* cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)
* cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718)
* cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)
* python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)
* cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2025:10128 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2370010 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2370013 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2370014 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2370016 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2372426 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published21 May 2026
Updated21 May 2026
First seen21 May 2026
Sources
RLSA-2025:10128 · OSV
Track software like this
Free during beta