When using the tarfile module with a file opened in streaming mode (mode=r|) the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
Weakness
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Hardened Images | RedHat | python3-14-main-3.14.6-1.2.hum1 | * |
| Red Hat Hardened Images | RedHat | python3-11-main-3.11.15-4.4.hum1 | * |
| Red Hat Hardened Images | RedHat | python3-13-main-3.13.14-1.2.hum1 | * |
| Red Hat Hardened Images | RedHat | python3-12-main-3.12.13-3.3.hum1 | * |
| Python3.13 | Ubuntu | questing | * |
| Python3.14 | Ubuntu | questing | * |
Potential Mitigations
References
- https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9
- https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365
- https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21
- https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec
- https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192
- https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896
- https://github.com/python/cpython/issues/151981
- https://github.com/python/cpython/pull/151982
- https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/