CVE-2007-4559: Path Traversal
A flaw was found in the Python tarfile module. Extracting a crafted TAR archive with the tarfile.extract or tarfile.extractall functions could lead to a directory traversal vulnerability, resulting in overwrite of arbitrary files.
Other sources
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-4559 to the following vulnerability:
Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.
References:
Issue and additional attack vectors were discussed in following thread on python-dev mailinglist:
http://mail.python.org/pipermail/python-dev/2007-August/074290.html
Upstream bug tracking possible fixes for the issue:
http://bugs.python.org/issue1044
— Red Hat
Python could allow a remote attacker to traverse directories on the system, caused by a vulnerability in the tarfile module. By persuading a victim to open a specially-crafted .TAR file containing "dot dot" sequences (/../) in the filename, a remote attacker could exploit this vulnerability to overwrite arbitrary files on the system with the victim's privileges.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/python3.11-pipto a version that resolves this vulnerability.Fixed in 0:22.3.1-4.el8 - Upgrade
Upgrade
redhat/python3.11to a version that resolves this vulnerability.Fixed in 0:3.11.5-1.el8_9 - Upgrade
Upgrade
redhat/python3to a version that resolves this vulnerability.Fixed in 0:3.6.8-56.el8_9 - Upgrade
Upgrade
redhat/python-pipto a version that resolves this vulnerability.Fixed in 0:9.0.3-23.el8 - Upgrade
Upgrade
redhat/python-pipto a version that resolves this vulnerability.Fixed in 0:9.0.3-22.1.el8_6 - Upgrade
Upgrade
redhat/python3to a version that resolves this vulnerability.Fixed in 0:3.6.8-47.el8_6.4 - Upgrade
Upgrade
redhat/python-pipto a version that resolves this vulnerability.Fixed in 0:9.0.3-22.1.el8_8 - Upgrade
Upgrade
redhat/python3.11-pipto a version that resolves this vulnerability.Fixed in 0:22.3.1-4.el9 - Upgrade
Upgrade
redhat/python3.11to a version that resolves this vulnerability.Fixed in 0:3.11.5-1.el9_3 - Upgrade
Upgrade
redhat/python3.9to a version that resolves this vulnerability.Fixed in 0:3.9.18-1.el9_3 - Upgrade
Upgrade
redhat/python-pipto a version that resolves this vulnerability.Fixed in 0:21.2.3-7.el9 - Upgrade
Upgrade
redhat/rh-python38-pythonto a version that resolves this vulnerability.Fixed in 0:3.8.18-2.el7 - Upgrade
Upgrade
redhat/rh-python38-python-pipto a version that resolves this vulnerability.Fixed in 0:19.3.1-4.el7 - Compensating control
Do not extract archives from untrusted sources with the Python tarfile module.
- Compensating control
Add sanity checks when calling tarfile.extract or tarfile.extractall to validate and sanitize member filenames (e.g., reject names containing '..' or absolute paths) before extraction.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2007-4559?
CVE-2007-4559 is a vulnerability that allows user-assisted remote attackers to overwrite arbitrary files via a directory traversal attack in the Python tarfile module.
What software is affected by CVE-2007-4559?
Python Software Foundation Python and Python Python versions up to 3.11.4 are affected by CVE-2007-4559.
What is the severity of CVE-2007-4559?
CVE-2007-4559 has a severity score of 6.8, which is considered medium.
How do I fix CVE-2007-4559?
To fix CVE-2007-4559, update to a version of Python Software Foundation Python or Python Python that is not affected by the vulnerability.
Where can I find more information about CVE-2007-4559?
You can find more information about CVE-2007-4559 at the following references: [1] [2] [3]