{"id":"UBUNTU-CVE-2025-4435","details":"When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.","modified":"2026-04-22T19:51:21.466626Z","published":"2025-06-03T13:15:00Z","related":["USN-7583-1"],"upstream":["CVE-2025-4435"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2025-4435"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2025-4435"},{"type":"REPORT","url":"https://github.com/python/cpython/issues/135034"},{"type":"REPORT","url":"https://github.com/python/cpython/pull/135037"},{"type":"REPORT","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/"},{"type":"REPORT","url":"https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da"},{"type":"REPORT","url":"https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9"},{"type":"REPORT","url":"https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a"},{"type":"REPORT","url":"https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e"},{"type":"REPORT","url":"https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a"},{"type":"REPORT","url":"https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01"},{"type":"REPORT","url":"https://github.com/python/cpython/commit/98016f7c92aa4c1232c68bac1ed6646db31782ec"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-7583-1"}],"affected":[{"package":{"name":"python3.12","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/python3.12@3.12.3-1ubuntu0.7?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.3-1ubuntu0.7"}]}],"versions":["3.12.0-1","3.12.0-5","3.12.0-6","3.12.0-7","3.12.1-2","3.12.2-1","3.12.2-4build3","3.12.2-4build4","3.12.2-5ubuntu3","3.12.3-1","3.12.3-1ubuntu0.1","3.12.3-1ubuntu0.2","3.12.3-1ubuntu0.3","3.12.3-1ubuntu0.4","3.12.3-1ubuntu0.5","3.12.3-1ubuntu0.6"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"idle-python3.12","binary_version":"3.12.3-1ubuntu0.7"},{"binary_name":"libpython3.12-minimal","binary_version":"3.12.3-1ubuntu0.7"},{"binary_name":"libpython3.12-stdlib","binary_version":"3.12.3-1ubuntu0.7"},{"binary_name":"libpython3.12-testsuite","binary_version":"3.12.3-1ubuntu0.7"},{"binary_name":"libpython3.12t64","binary_version":"3.12.3-1ubuntu0.7"},{"binary_name":"python3.12","binary_version":"3.12.3-1ubuntu0.7"},{"binary_version":"3.12.3-1ubuntu0.7","binary_name":"python3.12-examples"},{"binary_name":"python3.12-full","binary_version":"3.12.3-1ubuntu0.7"},{"binary_name":"python3.12-minimal","binary_version":"3.12.3-1ubuntu0.7"},{"binary_name":"python3.12-nopie","binary_version":"3.12.3-1ubuntu0.7"},{"binary_name":"python3.12-venv","binary_version":"3.12.3-1ubuntu0.7"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-4435.json"}},{"package":{"name":"python3.14","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/python3.14@3.14.0-1?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0-1"}]}],"versions":["3.14.0~a7-0ubuntu1","3.14.0~b1-1","3.14.0~b3-1","3.14.0~rc1-1","3.14.0~rc2-1","3.14.0~rc3-1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"3.14.0-1","binary_name":"idle-python3.14"},{"binary_name":"libpython3.14","binary_version":"3.14.0-1"},{"binary_version":"3.14.0-1","binary_name":"libpython3.14-minimal"},{"binary_name":"libpython3.14-stdlib","binary_version":"3.14.0-1"},{"binary_name":"libpython3.14-testsuite","binary_version":"3.14.0-1"},{"binary_name":"python3.14","binary_version":"3.14.0-1"},{"binary_name":"python3.14-examples","binary_version":"3.14.0-1"},{"binary_name":"python3.14-full","binary_version":"3.14.0-1"},{"binary_name":"python3.14-gdbm","binary_version":"3.14.0-1"},{"binary_name":"python3.14-minimal","binary_version":"3.14.0-1"},{"binary_name":"python3.14-nopie","binary_version":"3.14.0-1"},{"binary_name":"python3.14-tk","binary_version":"3.14.0-1"},{"binary_version":"3.14.0-1","binary_name":"python3.14-venv"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-4435.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"Ubuntu","score":"medium"}]}