pyLoadのtar展開に脆弱性、修正版あり
Summary
ダウンロード管理ツールのpyLoadに、細工したtarアーカイブの展開でデバイスファイルを作らせられる脆弱性があります。root実行のDocker構成を含め、0.5.0b3.dev102以降へ更新し、権限と展開先を点検してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
ダウンロード管理ツールのpyLoadに、細工したtarアーカイブの展開でデバイスファイルを作らせられる脆弱性があります。root実行のDocker構成を含め、0.5.0b3.dev102以降へ更新し、権限と展開先を点検してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| pyloadpyload | — | Not listed |
| pippyload-ng |
All versions→ Not listed |
Not listed |
| PyPIpyload-ng |
≤ 0.5.0b3.dev101→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling tarfile.extractall. On supported Python 3.9 through 3.13 runtimes, tarfile defaults to the fully_trusted extraction filter, so a user with ADD and STATUS permissions can cause extraction of a crafted archive containing character devices, block devices, or FIFOs. Python 3.14 defaults to a safe extraction filter. When pyLoad runs with operating-system privileges that permit device creation, including the official root-based Docker deployment, the archive can expose raw devices and compromise the host. Non-root deployments can still create FIFOs that cause hangs or IPC confusion. This issue is fixed in version 0.5.0b3.dev102.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- web github.com