Home

CVE-2019-20907

Description

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
0.332

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2019-20907,CVE-2021-23336,CVE-2023-27043 are affected in Python 2.7.18Windows
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python2.7_2.7.17-1~18.04ubuntu1.1_i386.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python2.7_2.7.17-1~18.04ubuntu1.1_amd64.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python2.7_2.7.12-1ubuntu0~16.04.12_i386.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python2.7_2.7.12-1ubuntu0~16.04.12_amd64.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python3.5_3.5.2-2ubuntu0~16.04.11_i386.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python3.5_3.5.2-2ubuntu0~16.04.11_amd64.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python3.6_3.6.9-1~18.04ubuntu1.1_i386.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python3.6_3.6.9-1~18.04ubuntu1.1_amd64.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python3.8_3.8.2-1ubuntu1.2_i386.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python3.8_3.8.2-1ubuntu1.2_amd64.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python2.7-minimal_2.7.17-1~18.04ubuntu1.1_i386.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python2.7-minimal_2.7.17-1~18.04ubuntu1.1_amd64.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python2.7-minimal_2.7.12-1ubuntu0~16.04.12_i386.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python2.7-minimal_2.7.12-1ubuntu0~16.04.12_amd64.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python3.5-minimal_3.5.2-2ubuntu0~16.04.11_i386.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python3.5-minimal_3.5.2-2ubuntu0~16.04.11_amd64.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python3.6-minimal_3.6.9-1~18.04ubuntu1.1_i386.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python3.6-minimal_3.6.9-1~18.04ubuntu1.1_amd64.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python3.8-minimal_3.8.2-1ubuntu1.2_i386.debLinux
Interactive high-level object-oriented language (version 3.8) (USN-4428-1) python3.8-minimal_3.8.2-1ubuntu1.2_amd64.debLinux
SUSE-SU-2020:2216-1(SUSE Linux Enterprise Server 12-SP5 ) libpython3_6m1_0-3.6.10-4.17.1.x86_64.rpmLinux
SUSE-SU-2020:2216-1(SUSE Linux Enterprise Server 12-SP5 ) libpython3_6m1_0-debuginfo-3.6.10-4.17.1.x86_64.rpmLinux
SUSE-SU-2020:2216-1(SUSE Linux Enterprise Server 12-SP5 ) python36-3.6.10-4.17.1.x86_64.rpmLinux
SUSE-SU-2020:2216-1(SUSE Linux Enterprise Server 12-SP5 ) python36-base-3.6.10-4.17.1.x86_64.rpmLinux
SUSE-SU-2020:2216-1(SUSE Linux Enterprise Server 12-SP5 ) python36-base-debuginfo-3.6.10-4.17.1.x86_64.rpmLinux
SUSE-SU-2020:2216-1(SUSE Linux Enterprise Server 12-SP5 ) python36-base-debugsource-3.6.10-4.17.1.x86_64.rpmLinux
SUSE-SU-2020:2216-1(SUSE Linux Enterprise Server 12-SP5 ) python36-debuginfo-3.6.10-4.17.1.x86_64.rpmLinux
SUSE-SU-2020:2216-1(SUSE Linux Enterprise Server 12-SP5 ) python36-debugsource-3.6.10-4.17.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) libpython2_7-1_0-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) libpython2_7-1_0-32bit-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) libpython2_7-1_0-debuginfo-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) libpython2_7-1_0-debuginfo-32bit-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-32bit-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-base-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-base-32bit-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-base-debuginfo-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-base-debuginfo-32bit-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-base-debugsource-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-curses-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-curses-debuginfo-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-debuginfo-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-debuginfo-32bit-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-debugsource-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-demo-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-devel-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-doc-2.7.17-28.48.1.noarch.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-doc-pdf-2.7.17-28.48.1.noarch.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-gdbm-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-gdbm-debuginfo-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-idle-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-tk-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-tk-debuginfo-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-xml-2.7.17-28.48.1.x86_64.rpmLinux
SUSE-SU-2020:2275-1(SUSE Linux Enterprise Server 12-SP5 ) python-xml-debuginfo-2.7.17-28.48.1.x86_64.rpmLinux
(RHSA-2020:5009) python security update python-2.7.5-90.el7.x86_64.rpmLinux
(RHSA-2020:5009) python security update python-debug-2.7.5-90.el7.x86_64.rpmLinux
(RHSA-2020:5009) python security update python-devel-2.7.5-90.el7.x86_64.rpmLinux
(RHSA-2020:5009) python security update python-libs-2.7.5-90.el7.i686.rpmLinux
(RHSA-2020:5009) python security update python-libs-2.7.5-90.el7.x86_64.rpmLinux
(RHSA-2020:5009) python security update python-test-2.7.5-90.el7.x86_64.rpmLinux
(RHSA-2020:5009) python security update python-tools-2.7.5-90.el7.x86_64.rpmLinux
(RHSA-2020:5009) python security update tkinter-2.7.5-90.el7.x86_64.rpmLinux
(RHSA-2020:5010) python3 security update python3-3.6.8-18.el7.i686.rpmLinux
(RHSA-2020:5010) python3 security update python3-3.6.8-18.el7.x86_64.rpmLinux
(RHSA-2020:5010) python3 security update python3-debug-3.6.8-18.el7.i686.rpmLinux
(RHSA-2020:5010) python3 security update python3-debug-3.6.8-18.el7.x86_64.rpmLinux
(RHSA-2020:5010) python3 security update python3-devel-3.6.8-18.el7.i686.rpmLinux
(RHSA-2020:5010) python3 security update python3-devel-3.6.8-18.el7.x86_64.rpmLinux
(RHSA-2020:5010) python3 security update python3-idle-3.6.8-18.el7.i686.rpmLinux
(RHSA-2020:5010) python3 security update python3-idle-3.6.8-18.el7.x86_64.rpmLinux
(RHSA-2020:5010) python3 security update python3-libs-3.6.8-18.el7.i686.rpmLinux
(RHSA-2020:5010) python3 security update python3-libs-3.6.8-18.el7.x86_64.rpmLinux
(RHSA-2020:5010) python3 security update python3-test-3.6.8-18.el7.i686.rpmLinux
(RHSA-2020:5010) python3 security update python3-test-3.6.8-18.el7.x86_64.rpmLinux
(RHSA-2020:5010) python3 security update python3-tkinter-3.6.8-18.el7.i686.rpmLinux
(RHSA-2020:5010) python3 security update python3-tkinter-3.6.8-18.el7.x86_64.rpmLinux
Python update (ELSA-2020-5009) python-2.7.5-90.0.1.el7.x86_64.rpmLinux
Python-debug update (ELSA-2020-5009) python-debug-2.7.5-90.0.1.el7.x86_64.rpmLinux
Python-devel update (ELSA-2020-5009) python-devel-2.7.5-90.0.1.el7.x86_64.rpmLinux
Python-libs update (ELSA-2020-5009) python-libs-2.7.5-90.0.1.el7.x86_64.rpmLinux
Python-test update (ELSA-2020-5009) python-test-2.7.5-90.0.1.el7.x86_64.rpmLinux
Python-tools update (ELSA-2020-5009) python-tools-2.7.5-90.0.1.el7.x86_64.rpmLinux
Tkinter update (ELSA-2020-5009) tkinter-2.7.5-90.0.1.el7.x86_64.rpmLinux
Python-libs update (ELSA-2020-5009) python-libs-2.7.5-90.0.1.el7.i686.rpmLinux
Python3 update (ELSA-2020-5010) python3-3.6.8-18.0.1.el7.x86_64.rpmLinux
Python3-debug update (ELSA-2020-5010) python3-debug-3.6.8-18.0.1.el7.x86_64.rpmLinux
Python3-devel update (ELSA-2020-5010) python3-devel-3.6.8-18.0.1.el7.x86_64.rpmLinux
Python3-idle update (ELSA-2020-5010) python3-idle-3.6.8-18.0.1.el7.x86_64.rpmLinux
Python3-libs update (ELSA-2020-5010) python3-libs-3.6.8-18.0.1.el7.x86_64.rpmLinux
Python3-test update (ELSA-2020-5010) python3-test-3.6.8-18.0.1.el7.x86_64.rpmLinux
Python3-tkinter update (ELSA-2020-5010) python3-tkinter-3.6.8-18.0.1.el7.x86_64.rpmLinux
Python3 update (ELSA-2020-5010) python3-3.6.8-18.0.1.el7.i686.rpmLinux
Python3-debug update (ELSA-2020-5010) python3-debug-3.6.8-18.0.1.el7.i686.rpmLinux
Python3-devel update (ELSA-2020-5010) python3-devel-3.6.8-18.0.1.el7.i686.rpmLinux
Python3-idle update (ELSA-2020-5010) python3-idle-3.6.8-18.0.1.el7.i686.rpmLinux
Python3-libs update (ELSA-2020-5010) python3-libs-3.6.8-18.0.1.el7.i686.rpmLinux
Python3-test update (ELSA-2020-5010) python3-test-3.6.8-18.0.1.el7.i686.rpmLinux
Python3-tkinter update (ELSA-2020-5010) python3-tkinter-3.6.8-18.0.1.el7.i686.rpmLinux
An interactive high-level object-oriented language (USN-4754-3) python2.7_2.7.18-1~20.04.1_i386.debLinux
An interactive high-level object-oriented language (USN-4754-3) python2.7_2.7.18-1~20.04.1_amd64.debLinux
An interactive high-level object-oriented language (USN-4754-3) python3.7_3.7.5-2~18.04.4_i386.debLinux
An interactive high-level object-oriented language (USN-4754-3) python3.7_3.7.5-2~18.04.4_amd64.debLinux
An interactive high-level object-oriented language (USN-4754-3) python3.8_3.8.0-3~18.04.1_i386.debLinux
An interactive high-level object-oriented language (USN-4754-3) python3.8_3.8.0-3~18.04.1_amd64.debLinux
An interactive high-level object-oriented language (USN-4754-3) python2.7-minimal_2.7.18-1~20.04.1_i386.debLinux
An interactive high-level object-oriented language (USN-4754-3) python2.7-minimal_2.7.18-1~20.04.1_amd64.debLinux
An interactive high-level object-oriented language (USN-4754-3) python3.7-minimal_3.7.5-2~18.04.4_i386.debLinux
An interactive high-level object-oriented language (USN-4754-3) python3.7-minimal_3.7.5-2~18.04.4_amd64.debLinux
An interactive high-level object-oriented language (USN-4754-3) python3.8-minimal_3.8.0-3~18.04.1_i386.debLinux
An interactive high-level object-oriented language (USN-4754-3) python3.8-minimal_3.8.0-3~18.04.1_amd64.debLinux
(CESA-2020:5009) python security update python-libs-2.7.5-90.el7.i686.rpmLinux
(CESA-2020:5009) python security update python-2.7.5-90.el7.x86_64.rpmLinux
(CESA-2020:5009) python security update python-debug-2.7.5-90.el7.x86_64.rpmLinux
(CESA-2020:5009) python security update python-devel-2.7.5-90.el7.x86_64.rpmLinux
(CESA-2020:5009) python security update python-libs-2.7.5-90.el7.x86_64.rpmLinux
(CESA-2020:5009) python security update python-test-2.7.5-90.el7.x86_64.rpmLinux
(CESA-2020:5009) python security update python-tools-2.7.5-90.el7.x86_64.rpmLinux
(CESA-2020:5009) python security update tkinter-2.7.5-90.el7.x86_64.rpmLinux
(CESA-2020:5010) python3 security update python3-3.6.8-18.el7.i686.rpmLinux
(CESA-2020:5010) python3 security update python3-3.6.8-18.el7.x86_64.rpmLinux
(CESA-2020:5010) python3 security update python3-debug-3.6.8-18.el7.i686.rpmLinux
(CESA-2020:5010) python3 security update python3-debug-3.6.8-18.el7.x86_64.rpmLinux
(CESA-2020:5010) python3 security update python3-devel-3.6.8-18.el7.i686.rpmLinux
(CESA-2020:5010) python3 security update python3-devel-3.6.8-18.el7.x86_64.rpmLinux
(CESA-2020:5010) python3 security update python3-idle-3.6.8-18.el7.i686.rpmLinux
(CESA-2020:5010) python3 security update python3-idle-3.6.8-18.el7.x86_64.rpmLinux
(CESA-2020:5010) python3 security update python3-libs-3.6.8-18.el7.i686.rpmLinux
(CESA-2020:5010) python3 security update python3-libs-3.6.8-18.el7.x86_64.rpmLinux
(CESA-2020:5010) python3 security update python3-test-3.6.8-18.el7.i686.rpmLinux
(CESA-2020:5010) python3 security update python3-test-3.6.8-18.el7.x86_64.rpmLinux
(CESA-2020:5010) python3 security update python3-tkinter-3.6.8-18.el7.i686.rpmLinux
(CESA-2020:5010) python3 security update python3-tkinter-3.6.8-18.el7.x86_64.rpmLinux
SUSE-SU-2020:3563-1(SUSE Linux Enterprise Server 12-SP5) libpython3_6m1_0-3.6.12-4.22.2.x86_64.rpmLinux
SUSE-SU-2020:3563-1(SUSE Linux Enterprise Server 12-SP5) libpython3_6m1_0-debuginfo-3.6.12-4.22.2.x86_64.rpmLinux
SUSE-SU-2020:3563-1(SUSE Linux Enterprise Server 12-SP5) python36-3.6.12-4.22.2.x86_64.rpmLinux
SUSE-SU-2020:3563-1(SUSE Linux Enterprise Server 12-SP5) python36-base-3.6.12-4.22.2.x86_64.rpmLinux
SUSE-SU-2020:3563-1(SUSE Linux Enterprise Server 12-SP5) python36-base-debuginfo-3.6.12-4.22.2.x86_64.rpmLinux
SUSE-SU-2020:3563-1(SUSE Linux Enterprise Server 12-SP5) python36-debuginfo-3.6.12-4.22.2.x86_64.rpmLinux
SUSE-SU-2020:3563-1(SUSE Linux Enterprise Server 12-SP5) python36-debugsource-3.6.12-4.22.2.x86_64.rpmLinux
An interactive high-level object-oriented language (USN-6891-1) python3.10_3.10.12-1~22.04.4_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.10_3.10.12-1~22.04.4_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.10-minimal_3.10.12-1~22.04.4_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.10-minimal_3.10.12-1~22.04.4_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.11_3.11.6-3ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.11_3.11.6-3ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.11-minimal_3.11.6-3ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.11-minimal_3.11.6-3ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.12_3.12.0-1ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.12_3.12.0-1ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.12-minimal_3.12.0-1ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.12-minimal_3.12.0-1ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.8_3.8.10-0ubuntu1~20.04.10_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.8_3.8.10-0ubuntu1~20.04.10_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.8-minimal_3.8.10-0ubuntu1~20.04.10_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.8-minimal_3.8.10-0ubuntu1~20.04.10_i386.debLinux
Loop with Unreachable Exit Condition (Infinite Loop) Vulnerability (CVE-2019-20907)NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234