Use of Incorrectly-Resolved Name or Reference SNYK-RHEL9-PYTHON3LIBS-10415418

[github-actions]

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3-libs package and not the python3-libs package as distributed by RHEL.
See How to fix? for RHEL:9 relevant fixed versions and status.

When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.

Remediation

Upgrade RHEL:9 python3-libs to version 0:3.9.21-2.el9_6.1 or higher.
This issue was patched in RHSA-2025:10136.

References

• https://access.redhat.com/security/cve/CVE-2025-4435
• python/cpython@3612d8f
• python/cpython@9e0ac76
• Multiple tarfile extraction filter bypasses (filter="tar"/filter="data") python/cpython#135034
• gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') python/cpython#135037
• https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/
• python/cpython@19de092
• python/cpython@aa9eb5f
• python/cpython@28463db
• python/cpython@4633f3f
• python/cpython@9c1110e
• python/cpython@dd8f187