Tarfile security vulnerability rediscovered

[jonafato]

URL

https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/tarfile-exploiting-the-world.html

When was this post released

20220921

Summary

A fifteen year old security vulnerability in the tarfile module has been rediscovered after a security researcher demonstrated possible a code execution exploit potentially affecting "hundreds of thousands of repositories" on GitHub. This bug can be exploited by crafting a malicious tarfile that contains a path outside of the intended extraction directory. The original report of this issue fifteen years ago was closed with a documentation fix, but a conversation around additional safeguards in Python's standard library is happening now on CPython's GitHub issue tracker.

Code of Conduct

• I agree to follow this project's Code of Conduct