| Name | CVE-2025-4435 |
| Description | When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| jython (PTS) | bullseye | 2.7.2+repack1-3 | fixed |
| bookworm, sid, trixie | 2.7.3+repack1-1 | fixed |
| python2.7 (PTS) | bullseye | 2.7.18-8+deb11u1 | fixed |
| python3.11 (PTS) | bookworm | 3.11.2-6+deb12u6 | fixed |
| bookworm (security) | 3.11.2-6+deb12u3 | fixed |
| python3.12 (PTS) | sid | 3.12.10-1 | vulnerable |
| python3.13 (PTS) | trixie | 3.13.3-2 | vulnerable |
| sid | 3.13.5-2 | fixed |
| python3.9 (PTS) | bullseye | 3.9.2-1 | fixed |
| bullseye (security) | 3.9.2-1+deb11u3 | fixed |
The information below is based on the following data on fixed versions.
Notes
[bookworm] - python3.11 <not-affected> (Vulnerable code didn't get backported to the version in Bookworm)
- python3.9 <not-affected> (Vulnerable code got backported to 3.9.17, but dropped from sid with 3.9.13)
- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
- jython <not-affected> (Vulnerable code introduced in 3.12)
https://github.com/python/cpython/issues/135034
https://github.com/python/cpython/pull/135037
https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/
Fixed by: https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a (main)
Fixed by: https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a (3.14)
Fixed by: https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 (v3.13.4)
Fixed by: https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da (v3.12.11)
Got backported to 3.9 in https://github.com/python/cpython/commit/98016f7c92aa4c1232c68bac1ed6646db31782ec (v3.9.17)
Got backported to 3.11 in https://github.com/python/cpython/commit/241f2e54a6a2801a1d2022f0fa56309e124866c3 (v3.11.4)