CVE-2019-20907High· 7.5▾ TwilightIn Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.6 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
6.3%
Last analysed / modified upstream
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
python >= 3.5.0, < 3.5.10python >= 3.6.0, < 3.6.12python >= 3.7.0, < 3.7.9python >= 3.8.0, < 3.8.5leap = 15.1leap = 15.2debian_linux = 9.0fedora = 31fedora = 32ubuntu_linux = 12.04ubuntu_linux = 14.04ubuntu_linux = 16.04ubuntu_linux = 18.04ubuntu_linux = 20.04active_iq_unified_manager >= 9.5cloud_volumes_ontap_mediatorzfs_storage_appliance_kit = 8.8Upgrade past the affected range:
python 3.8.5Connected by shared product, vendor, weakness, or advisory.
CVE-2021-3737High· 7.5A flaw was found in python
CVE-2019-16056High· 7.5An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4
CVE-2019-9636Critical· 9.8Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization
CVE-2022-45061High· 7.5An issue was discovered in Python before 3.11.1
CVE-2021-4189Medium· 5.3A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode
CVE-2021-3177Critical· 9.8Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300…