Skip to content

tarfile extractall() allows local attacker to overwrite files while extracting #46288

@mebrown

Description

@mebrown
mannequin
BPO 2004
Nosy @loewis, @birkenfeld, @gustaebel
Files
  • zipfile-dirperm.diff
  • tarfile-diffs.tar.gz
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/gustaebel'
    closed_at = <Date 2008-02-05.12:07:42.806>
    created_at = <Date 2008-02-03.03:59:12.562>
    labels = ['type-security', 'library']
    title = 'tarfile extractall() allows local attacker to overwrite files while extracting'
    updated_at = <Date 2008-02-05.12:07:42.761>
    user = 'https://bugs.python.org/mebrown'

    bugs.python.org fields:

    activity = <Date 2008-02-05.12:07:42.761>
    actor = 'georg.brandl'
    assignee = 'lars.gustaebel'
    closed = True
    closed_date = <Date 2008-02-05.12:07:42.806>
    closer = 'georg.brandl'
    components = ['Library (Lib)']
    creation = <Date 2008-02-03.03:59:12.562>
    creator = 'mebrown'
    dependencies = []
    files = ['9351', '9353']
    hgrepos = []
    issue_num = 2004
    keywords = []
    message_count = 9.0
    messages = ['62016', '62017', '62018', '62021', '62039', '62050', '62064', '62069', '62070']
    nosy_count = 5.0
    nosy_names = ['loewis', 'georg.brandl', 'alanmcintyre', 'lars.gustaebel', 'mebrown']
    pr_nums = []
    priority = 'high'
    resolution = 'fixed'
    stage = None
    status = 'closed'
    superseder = None
    type = 'security'
    url = 'https://bugs.python.org/issue2004'
    versions = ['Python 2.6', 'Python 2.5', 'Python 3.0']

    Metadata

    Metadata

    Assignees

    Labels

    stdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions