Catalogo CVE
CVE-2026-114583
jython: CVE-2026-114583
- Gravità
- Medium · CVSS 6.9
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | pypy3 | sid | 8.0.1+dfsg-1 | vulnerable |
| Debian | pypy3 | forky | 8.0.1+dfsg-1 | vulnerable |
| Debian | pypy3 | trixie | 7.3.19+dfsg-2 | vulnerable |
| Debian | pypy3 | bookworm | 7.3.11+dfsg-2+deb12u3 | vulnerable |
| Debian | jython | sid | 2.7.3+repack1-1 | vulnerable |
| Debian | jython | forky | 2.7.3+repack1-1 | vulnerable |
| Debian | jython | trixie | 2.7.3+repack1-1 | vulnerable |
| Debian | jython | bookworm | 2.7.3+repack1-1 | vulnerable |
| Debian | python3.11 | bookworm | 3.11.2-6+deb12u8 | vulnerable |
| Debian | python3.11 | bookworm-security | 3.11.2-6+deb12u9 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | pypy3 | source | sid | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | pypy3 | source | forky | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | pypy3 | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | pypy3 | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | jython | source | sid | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | jython | source | forky | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | jython | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | jython | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | python3.11 | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
Notes
[trixie] pypy3: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [idle-python3.11]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
3.11.2-6+deb12u8· all · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u8· all · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· all · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· all · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
- [jython]Interessata
Dettagli (2)
2.7.3+repack1-1· all · bookwormInteressata
dsa · jython · debian · bookworm; dsa · jython · debian · 12
2.7.3+repack1-1· all · bookwormInteressata
dsa · jython · debian · bookworm; dsa · jython · debian · 12
- [jython-doc]Interessata
Pacchetto sorgente: [jython]
Dettagli (2)
2.7.3+repack1-1· all · bookwormInteressata
dsa · jython · debian · bookworm; dsa · jython · debian · 12
2.7.3+repack1-1· all · bookwormInteressata
dsa · jython · debian · bookworm; dsa · jython · debian · 12
- [libpython3.11]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
3.11.2-6+deb12u8· amd64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u8· arm64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· amd64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· arm64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
- [libpython3.11-dbg]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
3.11.2-6+deb12u8· amd64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u8· arm64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· amd64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· arm64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
- [libpython3.11-dev]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
3.11.2-6+deb12u8· amd64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u8· arm64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· amd64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· arm64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
- [libpython3.11-minimal]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
3.11.2-6+deb12u8· amd64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u8· arm64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· amd64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· arm64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
- [libpython3.11-stdlib]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
3.11.2-6+deb12u8· amd64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u8· arm64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· amd64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· arm64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
- [libpython3.11-testsuite]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
3.11.2-6+deb12u8· all · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u8· all · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· all · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· all · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
- [pypy3]Interessata
Dettagli (2)
7.3.11+dfsg-2+deb12u3· amd64 · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
7.3.11+dfsg-2+deb12u3· arm64 · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
- [pypy3-dev]Interessata
Pacchetto sorgente: [pypy3]
Dettagli (2)
7.3.11+dfsg-2+deb12u3· all · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
7.3.11+dfsg-2+deb12u3· all · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
- [pypy3-doc]Interessata
Pacchetto sorgente: [pypy3]
Dettagli (2)
7.3.11+dfsg-2+deb12u3· all · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
7.3.11+dfsg-2+deb12u3· all · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
- [pypy3-lib]Interessata
Pacchetto sorgente: [pypy3]
Dettagli (2)
7.3.11+dfsg-2+deb12u3· amd64 · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
7.3.11+dfsg-2+deb12u3· arm64 · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
- [pypy3-lib-testsuite]Interessata
Pacchetto sorgente: [pypy3]
Dettagli (2)
7.3.11+dfsg-2+deb12u3· all · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
7.3.11+dfsg-2+deb12u3· all · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
- [pypy3-tk]Interessata
Pacchetto sorgente: [pypy3]
Dettagli (2)
7.3.11+dfsg-2+deb12u3· amd64 · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
7.3.11+dfsg-2+deb12u3· arm64 · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
- [pypy3-venv]Interessata
Pacchetto sorgente: [pypy3]
Dettagli (2)
7.3.11+dfsg-2+deb12u3· all · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
7.3.11+dfsg-2+deb12u3· all · bookwormInteressata
dsa · pypy3 · debian · bookworm; dsa · pypy3 · debian · 12
- [python3.11]Interessata
Dettagli (4)
3.11.2-6+deb12u8· amd64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u8· arm64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· amd64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· arm64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
- [python3.11-dbg]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
3.11.2-6+deb12u8· amd64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u8· arm64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· amd64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· arm64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
- [python3.11-dev]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
3.11.2-6+deb12u8· amd64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u8· arm64 · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· amd64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· arm64 · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
- [python3.11-doc]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
3.11.2-6+deb12u8· all · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u8· all · bookwormInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· all · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
3.11.2-6+deb12u3· all · bookworm-securityInteressata
dsa · python3.11 · debian · bookworm; dsa · python3.11 · debian · 12
Osservato:
Riferimenti
- [https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b]
- [https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477]
- [https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5]
- [https://github.com/python/cpython/issues/160097]
- [https://github.com/python/cpython/pull/160098]
- [https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-114583]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-114583]
- [https://security-tracker.debian.org/tracker/CVE-2026-114583]
[Debian Security Tracker] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]