Steve Dower

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** On Windows, Python uses the `VPATH` variable to locate landmarks, such as 'Modules/setup.local', to determine if it is running in a source tree and adjust the default `sys.path`. In certain configurations, specifically with the legacy EXE installer, the `VPATH` value '....' results in a landmark path outside the installation directory. Because Windows may allow low-privilege users to create folders in the root directory of the OS drive, an attacker could create the landmark and an alternative `Lib` folder. This allows the restricted installation to discover and load unauthorized files, potentially leading to a privilege escalation. **Recommendations** Migrate from the legacy installer to the Python install manager to perform a per-user installation. Preemptively create and restrict access to a `Modules` directory.

Name of the Vulnerable Software and Affected Versions pymanager (affected versions not specified) Description pymanager included the current working directory in its `sys.path`, allowing modules in the current working directory to shadow intended packages. If a user runs a pymanager-generated command (like `pip` or `pytest`) from a directory controlled by an attacker, a malicious module in that directory could be imported and executed instead of the legitimate package. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CPython versions (affected versions not specified) **Description** A defect exists in the CPython “tarfile” module, impacting the “TarFile” extraction and entry enumeration APIs. The tar implementation processes tar archives with negative offsets without error, leading to an infinite loop and deadlock when parsing maliciously crafted tar archives. **Recommendations** Include the following patch after importing the “tarfile” module: ```python import tarfile def block patched(self, count): if count < 0: # pragma: no cover raise tarfile.InvalidHeaderError("invalid offset") return block patched. orig block(self, count) block patched. orig block = tarfile.TarInfo. block tarfile.TarInfo. block = block patched ```