Description

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Remediation

References

CVE-2019-20907

Related Vulnerabilities

Joomla Improper Input Validation Vulnerability (CVE-2020-10240)

WordPress Plugin Flickr Gallery PHP Object Injection (1.5.2)

WordPress Plugin Facebook Like Box Unspecified Vulnerability (1.0.17)

WordPress Plugin OneLogin SAML SSO Security Bypass (2.2.0)

PHP version older than 5.2.6

Severity

High

Classification

CVE-2019-20907 CWE-835 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities