Уязвимость CVE-2019-20907: Информация

Описание

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Важность: HIGH (7,5) Вектор: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-20907
Опубликовано: 13 июля 2020 г.
Изменено: 7 ноября 2023 г.
Идентификатор типа ошибки: CWE-835

Исправленные пакеты

Имя пакета
Ветка
Исправлено в версии
Версия в репозитории
Errata ID
№ Задания
Состояние
pythonsisyphus2.7.18-alt22.7.18-alt11ALT-PU-2020-3395-1262143Исправлено
pythonp102.7.18-alt22.7.18-alt10ALT-PU-2020-3395-1262143Исправлено
pythonc10f12.7.18-alt22.7.18-alt10ALT-PU-2020-3395-1262143Исправлено
pythonc9f22.7.18-alt0.M90P.22.7.18-alt0.MC9.1ALT-PU-2021-1234-1262323Исправлено
python3sisyphus3.8.5-alt13.12.2-alt1ALT-PU-2020-2445-1244405Исправлено
python3p103.8.5-alt13.9.18-alt1ALT-PU-2020-2445-1244405Исправлено
python3p93.7.11-alt13.7.17-alt1ALT-PU-2021-2653-1273501Исправлено
python3c10f13.8.5-alt13.9.18-alt0.c10f1.1ALT-PU-2020-2445-1244405Исправлено
python3c9f23.7.17-alt13.7.17-alt1ALT-PU-2024-3474-2342077Исправлено

Ссылки на рекомендации, решения и инструменты

Ссылка
Ресурс
https://bugs.python.org/issue39017
  • Issue Tracking
  • Vendor Advisory
https://github.com/python/cpython/pull/21454
  • Patch
  • Third Party Advisory
USN-4428-1
  • Third Party Advisory
https://security.netapp.com/advisory/ntap-20200731-0002/
  • Third Party Advisory
GLSA-202008-01
  • Third Party Advisory
[debian-lts-announce] 20200822 [SECURITY] [DLA 2337-1] python2.7 security update
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2020:1254
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2020:1257
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2020:1258
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2020:1265
  • Mailing List
  • Third Party Advisory
[debian-lts-announce] 20201119 [SECURITY] [DLA 2456-1] python3.5 security update
  • Mailing List
  • Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
  • Patch
  • Third Party Advisory
[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update
    FEDORA-2020-dfb11916cc
      FEDORA-2020-e9251de272
        FEDORA-2020-c3b07cc5c9
          FEDORA-2020-aab24d3714
            FEDORA-2020-bb919e575e
              FEDORA-2020-97d775e649
                FEDORA-2020-826b24c329
                  FEDORA-2020-1ddd5273d6
                    FEDORA-2020-87c0a0a52d
                      FEDORA-2020-efb908b6a8
                        FEDORA-2020-d808fdd597
                          FEDORA-2020-982b2950db
                            FEDORA-2020-c539babb0a
                              FEDORA-2020-d30881c970

                                  1. Конфигурация 1

                                    cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
                                    Start including
                                    3.8.0
                                    End excliding
                                    3.8.5
                                    cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
                                    Start including
                                    3.7.0
                                    End excliding
                                    3.7.9
                                    cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
                                    Start including
                                    3.6.0
                                    End excliding
                                    3.6.12
                                    cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
                                    Start including
                                    3.5.0
                                    End excliding
                                    3.5.10

                                    Конфигурация 2

                                    cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
                                    cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

                                    Конфигурация 3

                                    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

                                    Конфигурация 4

                                    cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
                                    cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

                                    Конфигурация 5

                                    cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
                                    cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
                                    cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
                                    cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
                                    cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

                                    Конфигурация 6

                                    cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vsphere:*:*
                                    Start including
                                    9.5
                                    cpe:2.3:a:netapp:cloud_volumes_ontap_mediator:-:*:*:*:*:*:*:*

                                    Конфигурация 7

                                    cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
                                VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
                                Версия: v24.4.2
                                Наверх