Description
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
References (6)
Scores
CVSS v4
2.0
EPSS
0.0001
EPSS Percentile
2.7%
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-74
CWE-434
CWE-20
Status
published
Products (4)
Python Software Foundation/CPython
< 3.13.13
Python Software Foundation/CPython
< 3.15.0
Python Software Foundation/CPython
3.14.0 - 3.14.4
Python Software Foundation/CPython
3.15.0a1 - 3.15.0a8
Published
Mar 12, 2026
Tracked Since
Mar 13, 2026