logo

Database

Lack of data validation In python3.14

Description

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 16

10

Aliases

1. CVE-2025-134622. NVD-2025-134623. OSV-2025-134624. OSV-DEBIAN-2025-134625. GCVE-2025-134626. SECURITY-TRACKER-CVE-2025-134627. https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13462.json8. mail.python.org

References

1. https://github.com/python/cpython/issues/1417072. https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab3. https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b41144. https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b0175. https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc664794066. https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c77. https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c0848. https://github.com/python/cpython/pull/143934

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.