A vulnerability in the tarfile module allows modification of file metadata and permissions of files outside the extraction directory when extracting untrusted tar archives. This affects Python versions 3.12 and later, particularly when using the filter parameter with values ‘data’ or ‘tar’. Users should be cautious with source distributions as they can allow arbitrary code execution during the build process.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2024-12718 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious tar archive that, when extracted using the tarfile module with the filter parameter set to ‘data’ or ‘tar’, can modify file metadata or permissions outside the intended extraction directory. This could lead to unauthorized access or manipulation of files on the system.
Affected Products
- Python 3.12 and later: Affected by the vulnerability when using the tarfile module with specific filter parameters.
- Python 3.14 and later: Default filter behavior changes may expose users to this vulnerability if they rely on the new default.
Mitigation
To mitigate this vulnerability, users should avoid using the tarfile module to extract untrusted tar archives with the filter parameter set to ‘data’ or ‘tar’. It is also advisable to validate the sources of tar archives and consider upgrading to the latest Python version where applicable.