CVE-2025-13462

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-13462
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab Patch
https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114 Patch
https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017 Patch
https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406 Patch
https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7 Patch
https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084 Patch
https://github.com/python/cpython/issues/141707 Issue Tracking
https://github.com/python/cpython/pull/143934 Issue Tracking Patch
https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/ Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*
History

11 Jun 2026, 14:29

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 3.3

05 Jun 2026, 19:42

Type Values Removed Values Added
CPE cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References () https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab - () https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab - Patch
References () https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114 - () https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114 - Patch
References () https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017 - () https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017 - Patch
References () https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406 - () https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406 - Patch
References () https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7 - () https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7 - Patch
References () https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084 - () https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084 - Patch
References () https://github.com/python/cpython/issues/141707 - () https://github.com/python/cpython/issues/141707 - Issue Tracking
References () https://github.com/python/cpython/pull/143934 - () https://github.com/python/cpython/pull/143934 - Issue Tracking, Patch
References () https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/ - () https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/ - Mailing List, Vendor Advisory
First Time Python
Python python

04 Jun 2026, 15:16

Type Values Removed Values Added
References
  • () https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084 -

01 May 2026, 16:16

Type Values Removed Values Added
References
  • () https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114 -
  • () https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406 -

19 Mar 2026, 18:16

Type Values Removed Values Added
References
  • () https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017 -
  • () https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7 -

13 Mar 2026, 19:53

Type Values Removed Values Added
References
  • () https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab -
Summary
  • (es) El módulo 'tarfile' seguiría aplicando la normalización de bloques AREGTYPE (\x00) a DIRTYPE, incluso al procesar un miembro de múltiples bloques como GNUTYPE_LONGNAME o GNUTYPE_LONGLINK. Esto podría resultar en un archivo tar manipulado siendo malinterpretado por el módulo tarfile en comparación con otras implementaciones.

12 Mar 2026, 19:16

Type Values Removed Values Added
CWE CWE-434
CWE-20
CWE-74

12 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-12 18:16

Updated : 2026-06-11 14:29

NVD link : CVE-2025-13462

Mitre link : CVE-2025-13462

CVE.ORG link : CVE-2025-13462

JSON object : View

Products Affected

python

  • python
CWE
CWE-20

Improper Input Validation

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-434

Unrestricted Upload of File with Dangerous Type