Amazon Linux 2 Security Advisory: ALASPYTHON3.8-2025-018
Advisory Release Date: 2025-03-26 19:21 Pacific
Advisory Updated Date: 2025-04-01 16:06 Pacific
Severity:
Medium
Issue Overview:
Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267. (CVE-2007-4559)
Affected Packages:
python38-pip
Note:
This advisory is applicable to Amazon Linux 2 - Python3.8 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update python38-pip to update your system.
New Packages:
noarch:
python38-pip-21.0.1-4.amzn2.0.5.noarch
src:
python38-pip-21.0.1-4.amzn2.0.5.src