Caleb Brown

**Name of the Vulnerable Software and Affected Versions** WebOb versions prior to 1.8.10 **Description** An open redirect occurs when the software normalizes the HTTP Location header to include the request hostname. The process involves parsing the redirect URL using Python's `urllib.parse` and joining it to the base URL. Because `urlsplit` (called internally by `urljoin`) treats a `//` at the start of a string as a URI without a scheme, it interprets the subsequent part as the hostname, replacing the original request hostname. Although a previous attempt was made to mitigate this by replacing `//` with `/%2f`, Python 3.10 and later versions of `urlsplit` internally strip ASCII tab, carriage return, and newline characters. Consequently, a string such as `/t/attacker.com` is converted to `//attacker.com`, bypassing the previous fix and allowing redirection to an external domain. **Recommendations** Update to version 1.8.10. As a temporary workaround, rewrite any use of the `Response` class that includes a `location` to ensure a full URI including the hostname is passed, or validate that the redirect target starts with a scheme such as `http://` or `https://` before assigning it to `Response.location`.

**Name of the Vulnerable Software and Affected Versions** Python versions prior to 2.3 **Description** The 'zipfile' module does not validate the ZIP64 End of Central Directory (EOCD) Locator record offset value, leading to potential discrepancies in how ZIP archives are handled compared to other ZIP implementations. Specifically, the module incorrectly assumes the ZIP64 EOCD record's location, potentially allowing crafted ZIP archives to be processed in an unexpected manner. **Recommendations** Update to version 2.3 or later.

**Name of the Vulnerable Software and Affected Versions** Python versions 3.12 through 3.13 **Description** An issue in the `tarfile` module allows the extraction filter to be ignored when extracting untrusted tar archives. This can enable an attacker to create symbolic links that point outside the destination directory, modify file metadata, and potentially modify files in arbitrary filesystem locations, leading to data loss or unauthorized access to protected information. The issue occurs when using the `TarFile.extractall()` or `TarFile.extract()` functions with the `filter` parameter set to `data` or `tar`. For Python 3.14 and later, the default value of `filter` is `data`, making usage relying on this default behavior also susceptible. **Recommendations** Update Python 3.12 to version 3.12.7-1ubuntu2.2. Update Python 3.13 to version 3.13.0-1ubuntu0.3. Avoid using the `filter` parameter with values `data` or `tar` when extracting untrusted archives. Avoid installing source distributions containing suspicious links.

**Name of the Vulnerable Software and Affected Versions** Python versions 3.12 and later **Description** The issue allows the extraction filter to be ignored, enabling symlink targets to point outside the destination directory and the modification of some file metadata. This affects users who utilize the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() with the filter parameter set to "data" or "tar". For Python 3.14 and later, the default filter value changed to "data", which also affects usage relying on this new default behavior. The installation of source distributions, which are tar archives, is not significantly affected as they already allow arbitrary code execution during the build process. **Recommendations** For Python versions 3.12 and later, consider updating to a version where this issue is fixed, although the specific fixed version is not provided. As a temporary workaround, avoid using the filter parameter with values of "data" or "tar" when extracting untrusted tar archives with TarFile.extractall() or TarFile.extract() until a patch is available. Restrict access to untrusted tar archives to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Python versions 3.12 through 3.13 **Description** An issue in the `tarfile` module allows arbitrary filesystem writes outside the extraction directory when extracting untrusted tar archives. This occurs when using the `TarFile.extractall()` or `TarFile.extract()` functions with the `filter` parameter set to `data` or `tar`. For Python 3.14 and later, the default value of `filter` changed to `data`, making usage relying on this default behavior also susceptible. An attacker could exploit this to modify files in arbitrary locations, cause data loss, or potentially achieve privilege escalation or container escape if the scripts are executed with root privileges. **Recommendations** Update Python 3.12 to version 3.12.11 or later. Update Python 3.13 to version 3.13.4 or later. As a temporary mitigation, avoid using the `filter` parameter with values `data` or `tar` when extracting untrusted archives.