PSF-2007-2

vendorUSosv

Directory path traversal in extract() and extractall() tarfile functions via '..' (dot dot) sequences

view advisory published 2007-08-28Licence: per source

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2007-4559US	medium6.8	27.1% (98th)	Exploit	2007-08-28
Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files…

references

External citations — patches, advisories, analysis.

http://mail.python.org/pipermail/python-dev/2007-August/074290.htmlADVISORY
https://github.com/python/cpython/issues/102950REPORT
https://github.com/python/cpython/pull/102953FIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan