Lucene search

GoogleOSV:CVE-2019-20907

HistoryJul 13, 2020 - 1:15 p.m.

CVE-2019-20907

2020-07-1313:15:10

Google

osv.dev

0.012 Low

EPSS

Percentile

85.1%

JSON

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CPENameOperatorVersion
cpythoneq3.8.3
python3eq3.6.1-r3
python3eq3.6.2-r3
python3eq3.6.3-r3
python3eq3.5.2-r3
python3eq3.3.2-r0
python3eq3.8.0-r3
python3eq3.5.1-r1
python3eq3.5.0-r0
python3eq3.4.2-r1

Name	Operator	Version
cpython	eq	3.8.3
python3	eq	3.6.1-r3
python3	eq	3.6.2-r3
python3	eq	3.6.3-r3
python3	eq	3.5.2-r3
python3	eq	3.3.2-r0
python3	eq	3.8.0-r3
python3	eq	3.5.1-r1
python3	eq	3.5.0-r0
python3	eq	3.4.2-r1

Rows per page:

1-10 of 451

References

lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html

lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html

lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html

lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html

bugs.python.org/issue39017

github.com/python/cpython/pull/21454

lists.debian.org/debian-lts-announce/2020/08/msg00034.html

lists.debian.org/debian-lts-announce/2020/11/msg00032.html

lists.debian.org/debian-lts-announce/2023/05/msg00024.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/

security.gentoo.org/glsa/202008-01

security.netapp.com/advisory/ntap-20200731-0002/

usn.ubuntu.com/4428-1/

www.oracle.com/security-alerts/cpujan2021.html

0.012 Low

EPSS

Percentile

85.1%

JSON

Related for OSV:CVE-2019-20907