Amazon Linux 2 Security Advisory: ALAS-2025-2814
Advisory Release Date: 2025-03-26 19:24 Pacific
Advisory Updated Date: 2025-04-01 16:23 Pacific
Severity:
Medium
Issue Overview:
Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267. (CVE-2007-4559)
Affected Packages:
python-pip
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update python-pip to update your system.
New Packages:
noarch:
python2-pip-20.2.2-1.amzn2.0.10.noarch
python3-pip-20.2.2-1.amzn2.0.10.noarch
python-pip-wheel-20.2.2-1.amzn2.0.10.noarch
src:
python-pip-20.2.2-1.amzn2.0.10.src