Vulnerability Description
Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Python | Python | < 3.6.16 |
Related Weaknesses (CWE)
References
- http://mail.python.org/pipermail/python-dev/2007-August/074290.htmlMailing ListVendor Advisory
- http://mail.python.org/pipermail/python-dev/2007-August/074292.htmlExploitMailing List
- http://secunia.com/advisories/26623Broken Link
- http://www.vupen.com/english/advisories/2007/3022Broken Link
- https://bugzilla.redhat.com/show_bug.cgi?id=263261Issue Tracking
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202309-06
- http://mail.python.org/pipermail/python-dev/2007-August/074290.htmlMailing ListVendor Advisory
- http://mail.python.org/pipermail/python-dev/2007-August/074292.htmlExploitMailing List
- http://secunia.com/advisories/26623Broken Link
- http://www.vupen.com/english/advisories/2007/3022Broken Link
- https://bugzilla.redhat.com/show_bug.cgi?id=263261Issue Tracking
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2007-4559?
CVE-2007-4559 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) ...
How severe is CVE-2007-4559?
CVE-2007-4559 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2007-4559?
Check the references section above for vendor advisories and patch information. Affected products include: Python Python.