High · published July 13, 2020
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
| Product | Versions | Fixed in |
|---|---|---|
| python/python | ≥ 3.5.0, < 3.5.10 | 3.5.10 |
| python/python | ≥ 3.6.0, < 3.6.12 | 3.6.12 |
| python/python | ≥ 3.7.0, < 3.7.9 | 3.7.9 |
| python/python | ≥ 3.8.0, < 3.8.5 | 3.8.5 |
| opensuse/leap | all versions | — |
| opensuse/leap | all versions | — |
| debian/debian_linux | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| netapp/active_iq_unified_manager | ≥ 9.5 | — |
| netapp/cloud_volumes_ontap_mediator | all versions | — |
| oracle/zfs_storage_appliance_kit | all versions | — |