PT-2025-23607 · Python+10 · Python+11

Jakub Wilk + 5 · Publicado 2025-06-03 · Atualizado 2026-05-18 · CVE-2024-12718

Positive Technologies (AI Summary) · Pt

CVSS v4.0

10

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Nome do Software Vulnerável e Versões Afetadas

Versões do Python 3.12 e posteriores

Descrição

Esta vulnerabilidade permite a modificação de metadados de arquivo (por exemplo, última modificação) ou das permissões de arquivos fora do diretório de extração pretendido ao usar o módulo tarfile para extrair arquivos tar não confiáveis com as opções filter="data" ou filter="tar". Para Python 3.14 e posteriores, o valor padrão do parâmetro filter foi alterado para "data".

Recomendações

Atualize para uma versão mais recente do Python. Especificamente, as seguintes versões de pacotes corrigem a vulnerabilidade:

• idle-python3.12 - 3.12.7-1ubuntu2.2
• libpython3.12-dev - 3.12.7-1ubuntu2.2
• libpython3.12-minimal - 3.12.7-1ubuntu2.2
• libpython3.12-stdlib - 3.12.7-1ubuntu2.2
• libpython3.12-testsuite - 3.12.7-1ubuntu2.2
• libpython3.12t64 - 3.12.7-1ubuntu2.2
• python3.12 - 3.12.7-1ubuntu2.2
• python3.12-dev - 3.12.7-1ubuntu2.2
• python3.12-doc - 3.12.7-1ubuntu2.2
• python3.12-examples - 3.12.7-1ubuntu2.2
• python3.12-full - 3.12.7-1ubuntu2.2
• python3.12-gdbm - 3.12.7-1ubuntu2.2
• python3.12-minimal - 3.12.7-1ubuntu2.2
• python3.12-nopie - 3.12.7-1ubuntu2.2
• python3.12-tk - 3.12.7-1ubuntu2.2
• python3.12-venv - 3.12.7-1ubuntu2.2
• idle-python3.13 - 3.13.0-1ubuntu0.3
• libpython3.13 - 3.13.0-1ubuntu0.3
• libpython3.13-dev - 3.13.0-1ubuntu0.3
• libpython3.13-minimal - 3.13.0-1ubuntu0.3
• libpython3.13-stdlib - 3.13.0-1ubuntu0.3
• libpython3.13-testsuite - 3.13.0-1ubuntu0.3
• python3.13 - 3.13.0-1ubuntu0.3
• python3.13-dev - 3.13.0-1ubuntu0.3
• python3.13-doc - 3.13.0-1ubuntu0.3
• python3.13-examples - 3.13.0-1ubuntu0.3
• python3.13-full - 3.13.0-1ubuntu0.3
• python3.13-gdbm - 3.13.0-1ubuntu0.3
• python3.13-minimal - 3.13.0-1ubuntu0.3
• python3.13-nopie - 3.13.0-1ubuntu0.3
• python3.13-tk - 3.13.0-1ubuntu0.3
• python3.13-venv - 3.13.0-1ubuntu0.3

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

ALSA-2025:10026

ALSA-2025:10031

ALSA-2025:10128

ALSA-2025:10136

ALSA-2025:10140

ALSA-2025:10148

ALSA-2025:10189

AZL-62258

BDU:2025-12377

BIT-LIBPYTHON-2024-12718

BIT-PYTHON-2024-12718

BIT-PYTHON-MIN-2024-12718

CESA-2025_10026

CESA-2025_10031

CESA-2025_10128

CLEANSTART-2026-CI66802

CLEANSTART-2026-KM27583

CLEANSTART-2026-SP91806

CVE-2024-12718

ECHO-83E1-A1F5-89BA

INFSA-2025_10026

INFSA-2025_10031

INFSA-2025_10128

INFSA-2025_10136

INFSA-2025_10148

INFSA-2025_10189

MGASA-2025-0280

OESA-2025-1789

OESA-2025-1790

OESA-2025-1791

OESA-2025-2304

OESA-2025-2305

OESA-2025-2538

OPENSUSE-SU-2025:15285-1

OPENSUSE-SU-2025:15286-1

OPENSUSE-SU-2025:15287-1

OPENSUSE-SU-2025:15288-1

OPENSUSE-SU-2025:15290-1

PSF-2025-5

RHSA-2025:10026

RHSA-2025:10028

RHSA-2025:10031

RHSA-2025:10128

RHSA-2025:10136

RHSA-2025:10140

RHSA-2025:10148

RHSA-2025:10189

RHSA-2025:10399

RHSA-2025:10484

RHSA-2025:10602

RHSA-2025:9918

RHSA-2025_10026

RHSA-2025_10031

RHSA-2025_10128

RHSA-2025_10136

RHSA-2025_10148

RHSA-2025_10189

SUSE-SU-2025:02047-1

SUSE-SU-2025:02048-1

SUSE-SU-2025:02049-1

SUSE-SU-2025:02050-1

SUSE-SU-2025:02057-1

SUSE-SU-2025:02074-1

SUSE-SU-2025:02297-1

SUSE-SU-2025:02427-1

SUSE-SU-2025:02778-1

SUSE-SU-2025:20492-1

SUSE-SU-2025:20539-1

SUSE-SU-2025_02047-1

SUSE-SU-2025_02049-1

SUSE-SU-2025_02050-1

SUSE-SU-2025_02057-1

SUSE-SU-2025_02297-1

SUSE-SU-2025_02778-1

SUSE-SU-2026:0210-1

USN-7583-1

Produtos afetados

Almalinux

Centos

Debian

Ibm Aix

Linuxmint

Python

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Tarfile

Referências · 276

• 🔥 https://github.com/python/cpython/issues/127987 · Exploit
• https://github.com/python/cpython/issues/135034 · Nota
• https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a · Correção
• https://github.com/python/cpython/pull/135037 · Correção
• https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 · Correção
• https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1 · Correção
• https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a · Correção
• https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9 · Correção
• https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e · Correção
• https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da · Correção
• https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a · Correção
• https://github.com/python/cpython/commit/98016f7c92aa4c1232c68bac1ed6646db31782ec · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CI66802.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KM27583.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SP91806.json · Nota