Description

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

Remediation

References

CVE-2007-4559

Related Vulnerabilities

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7921)

WordPress Plugin EZPZ One Click Backup Remote Code Execution (12.03.10)

Oracle JRE CVE-2013-1500 Vulnerability (CVE-2013-1500)

WordPress Plugin BCS BatchLine Book Importer Security Bypass (1.5.7)

WordPress Plugin OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) Supply Chain Attack [Polyfill.io] (1.1.2)

Severity

Medium

Classification

CVE-2007-4559 CWE-22

Tags

Missing Update Known Vulnerabilities