CVE-2007-4559
- State
- Published
- Severity
- 9.8 Critical
- Published
- Aug 28, 2007
- Updated
- Jan 17, 2025
- Reserved
- Aug 27, 2007
Description
Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 26623third-party-advisory
- ADV-2007-3022vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=263261
- [python-dev] 20070824 tarfile and directory traversal vulnerabilitymailing-list
- [python-dev] 20070825 tarfile and directory traversal vulnerabilitymailing-list
- GLSA-202309-06vendor-advisory
- FEDORA-2024-d1f1084584vendor-advisory
- FEDORA-2024-ebb3c95344vendor-advisory
- FEDORA-2024-46374d2703vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.