Most recent entries from all

ALSA-2025:14546 — Moderate: python3.12 security update

Affected: AlmaLinux:8: python3.12, AlmaLinux:8: python3.12-debug, AlmaLinux:8: python3.12-devel, AlmaLinux:8: python3.12-idle, AlmaLinux:8: python3.12-libs, AlmaLinux:8: python3.12-rpm-macros, AlmaLinux:8: python3.12-test, AlmaLinux:8: python3.12-tkinter

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-09687

BELL-CVE-2025-8194

Affected: Alpaquita:23: python3, Alpaquita:25: python3, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:25: python3, BellSoft Hardened Containers:stream: python3

BIT-libpython-2025-8194 — Tarfile infinite loop during parsing with negative member offset

Affected: Bitnami: libpython

This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1

certfr-2025-avi-0634 — Une vulnérabilité a été découverte dans Python. Elle permet à un attaquant de provoquer un déni de service à distance.

certfr-2025-avi-0634

EUVD-2026-343264

fkie_cve-2025-8194

This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1

GHSA-v594-44hm-2j7p

This vulnerability can be mitigated by including the following patch after importing the “tarfile” module:

import tarfile

def _block_patched(self, count): if count < 0: # pragma: no cover raise tarfile.InvalidHeaderError("invalid offset") return _block_patched._orig_block(self, count)

_block_patched._orig_block = tarfile.TarInfo._block tarfile.TarInfo._block = _block_patched

msrc_CVE-2025-8194 — Tarfile infinite loop during parsing with negative member offset

msrc_CVE-2025-8194

NCSC-2026-0021 — Kwetsbaarheden verholpen in Oracle Database Server producten

NCSC-2026-0021

OESA-2025-2100 — python3 security update

Affected: openEuler:22.03-LTS-SP3: python3

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):

There is a defect in the CPython 'tarfile' module affecting the 'TarFile' extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives.(CVE-2025-8194)

openSUSE-SU-2025:15402-1 — python310-3.10.18-4.1 on GA media

python310-3.10.18-4.1 on GA media

RHSA-2025:14984 — Red Hat Security Advisory: python3.12 security update

cpython: Cpython infinite loop when parsing a tarfile

SUSE-SU-2025:02700-1 — Security update for python39

Security update for python39

UBUNTU-CVE-2025-8194

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 6 more

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1

WID-SEC-W-2025-1664 — Python: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Python ausnutzen, um einen Denial of Service Angriff durchzuführen.