Connexion Inscription
JA · EN · FR
SecPulse
Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-11940 →
Catégories
UBUNTU-CVE-2026-11940

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Ubuntu:Pro:14.04:LTS python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:14.04:LTS python3.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:14.04:LTS python3.5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:16.04:LTS python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:16.04:LTS python3.5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS python3.6
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS python3.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS python3.8
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS python3.8
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS pypy3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS python3.9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS pypy3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS python3.10
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:22.04:LTS python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:22.04:LTS python3.11
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS pypy3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS python3.12
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:25.10 pypy3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:25.10 python3.13
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:25.10 python3.14
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10 pypy3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10 python3.14
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS pypy3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS python3.14
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Références

Nous utilisons des cookies pour l'analyse d'audience et la mesure publicitaire. Ce réglage s'applique à tous les sites de Game co., Ltd. En savoir plus