PT-2026-25023 · Python+2 · Tarfile+2

CVE-2025-13462 · Publicado 2026-01-16 · Atualizado 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions tarfile module (affected versions not specified)

Description The 'tarfile' module incorrectly normalizes AREGTYPE blocks to DIRTYPE when processing multi-block members like GNUTYPE LONGNAME or GNUTYPE LONGLINK. This can cause crafted tar archives to be misinterpreted by the module compared to other implementations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

DoS

Special Elements Injection

Unrestricted File Upload

Enumeração de Fraquezas

CWE-74

CWE-20

CWE-434

Identificadores relacionados

BDU:2026-09516

BIT-LIBPYTHON-2025-13462

BIT-PYTHON-2025-13462

BIT-PYTHON-MIN-2025-13462

CVE-2025-13462

ECHO-2833-B900-AC3D

OESA-2026-1899

OESA-2026-1900

OESA-2026-1901

OESA-2026-1902

OPENSUSE-SU-2026:10469-1

OPENSUSE-SU-2026:10477-1

OPENSUSE-SU-2026:10478-1

OPENSUSE-SU-2026:10479-1

OPENSUSE-SU-2026:10480-1

OPENSUSE-SU-2026:10481-1

OPENSUSE-SU-2026:20517-1

PSF-2026-10

RHSA-2026:10118

RHSA-2026:11324

RHSA-2026:7443

RHSA-2026:7661

SUSE-SU-2026:1206-1

SUSE-SU-2026:1292-1

SUSE-SU-2026:1296-1

SUSE-SU-2026:1345-1

SUSE-SU-2026:1349-1

SUSE-SU-2026:1354-1

SUSE-SU-2026:1376-1

SUSE-SU-2026:1385-1

SUSE-SU-2026:1417-1

SUSE-SU-2026:1530-1

SUSE-SU-2026:1715-1

SUSE-SU-2026:21104-1

SUSE-SU-2026:21178-1

SUSE-SU-2026:21254-1

USN-8509-1

Produtos afetados

Linuxmint

Red Os

Tarfile

Referências · 143

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13462.json · Exploit
• https://github.com/python/cpython · Nota
• https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406 · Correção
• https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114 · Correção
• https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084 · Correção
• https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7 · Correção
• https://github.com/python/cpython/pull/143934 · Correção
• https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017 · Correção
• https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab · Correção
• https://github.com/python/cpython/issues/141707 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2026:1296-1 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-python3-12-cve-2025-13462-7.3 · Nota
• https://suse.com/support/update/announcement/2026/suse-su-20261385-1 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2026:1206-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-3644 · Aviso do Fabricante