Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2007-4559 Patch #1990

Merged
merged 2 commits into from
May 29, 2024
Merged

CVE-2007-4559 Patch #1990

merged 2 commits into from
May 29, 2024

Conversation

TrellixVulnTeam
Copy link
Contributor

Patching CVE-2007-4559

Hi, we are security researchers from the Advanced Research Center at Trellix. We have began a campaign to patch a widespread bug named CVE-2007-4559. CVE-2007-4559 is a 15 year old bug in the Python tarfile package. By using extract() or extractall() on a tarfile object without sanitizing input, a maliciously crafted .tar file could perform a directory path traversal attack. We found at least one unsantized extractall() in your codebase and are providing a patch for you via pull request. The patch essentially checks to see if all tarfile members will be extracted safely and throws an exception otherwise. We encourage you to use this patch or your own solution to secure against CVE-2007-4559. Further technical information about the vulnerability can be found in this blog.

If you have further questions you may contact us through this projects lead researcher Kasimir Schulz.

@jamesls jamesls force-pushed the master branch 2 times, most recently from 2b16a88 to a25a835 Compare May 28, 2024 18:35
@jamesls
Copy link
Member

jamesls commented May 28, 2024

The failures are coming from pip being out of date. Should be fixed in #2092. Will rebase this once that #2092 has been merged.

TrellixVulnTeam and others added 2 commits May 28, 2024 15:34
This takes the original PR and adds checks for symlink and absolute
paths.  This brings it more in line with the `data` arg for Python
3.12's `filter` arg does.
@jamesls jamesls merged commit 912eb7e into aws:master May 29, 2024
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants