Expected behavior violation in Python - CVE-2025-4435

Vulnerability identifier: #VU111970

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N]

CVE-ID: CVE-2025-4435

CWE-ID: CWE-440

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to change expected behavior. 

The vulnerability exists due to an error when using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior. A remote attacker can force the application to extract files that were meant to be skipped. 

Python
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Anolis OS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Development Tools Module
Basesystem Module
Python 3 Module
openSUSE Leap
openEuler
Ubuntu
Fedora
IBM Observability with Instana
Netcool Operations Insight
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Ansible Automation Platform
Red Hat Advanced Cluster Security for Kubernetes
IBM TXSeries for Multiplatforms
DataStage on Cloud Pak for Data
Maximo Application Suite - Visual Inspection Component
IBM Qradar SIEM
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
python39-wcwidth
python39-PyMySQL
python39-toml
python39-pluggy
python39-Cython
python39-wheel-wheel
python39-wheel
python39-iniconfig
python39-scipy
python39-pysocks
python39-py
python39-cffi
python39-six
python39-numpy-doc
python39-numpy-f2py
python39-numpy
python39-urllib3
python39-pyparsing
python39-pybind11
python39-pybind11-devel
python39-psycopg2
python39-psycopg2-doc
python39-psycopg2-tests
python39-idna
python39-pycparser
python39-requests
python39-chardet
python39-cryptography
python3-curses-debuginfo
python3-tk-debuginfo
python3-tk
python3-debugsource
python3-debuginfo
libpython3_4m1_0-debuginfo-32bit
python3-curses
python3
python3-base-debuginfo-32bit
libpython3_4m1_0-32bit
python3-base
libpython3_4m1_0-debuginfo
libpython3_4m1_0
python3-base-debuginfo
python3-devel-debuginfo
python3-devel
python3-base-debugsource
python3 (Red Hat package)
platform-python-devel
platform-python
platform-python-debug
python3-tkinter
python3-test
python3-libs
python3-idle
python3.6
libpython3_6m1_0-debuginfo
libpython3_6m1_0-64bit
libpython3_6m1_0-64bit-debuginfo
libpython3_6m1_0-32bit-debuginfo
python3-doc-devhelp
libpython3_6m1_0-32bit
python3-testsuite
python3-core-debugsource
python3-tools
python3-doc
libpython3_6m1_0
python3-testsuite-debuginfo
python3-dbm
python3-dbm-debuginfo
python3-help
python3-debug
python3-unversioned-command
python3.9 (Red Hat package)
python3.9
python39-libs
python39-rpm-macros
python39-tkinter
python39-test
python39-idle
python39-devel
python39-debug
python39
python3.10
python3.11 (Red Hat package)
python39-ply
python3.11
python3.11-test
python3.11-debug
python3.11-devel
python3.11-idle
python3.11-libs
python3.11-tkinter
python3.11-rpm-macros
python311-testsuite-debuginfo
libpython3_11-1_0-64bit
libpython3_11-1_0-64bit-debuginfo
python311-base-64bit-debuginfo
python311-base-64bit
python311-base-32bit-debuginfo
libpython3_11-1_0-32bit
libpython3_11-1_0-32bit-debuginfo
python311-base-32bit
libpython3_11-1_0
python311-base
python311-testsuite
python311-base-debuginfo
python311-doc
libpython3_11-1_0-debuginfo
python311-doc-devhelp
python311-tools
python311-devel
python311-core-debugsource
python311-dbm
python311-64bit-debuginfo
python311-curses
python311-64bit
python311-curses-debuginfo
python311-32bit
python311-32bit-debuginfo
python311-dbm-debuginfo
python311-tk-debuginfo
python311
python311-tk
python311-debuginfo
python311-debugsource
python311-idle
python3.12 (Red Hat package)
python3.12 (Ubuntu package)
python3.12
libpython3_13-1_0-debuginfo
python313-tk
python313-tools
python313-idle
python313-dbm
python313-tk-debuginfo
python313
python313-curses-debuginfo
libpython3_13-1_0
python313-base-debuginfo
python313-debuginfo
python313-devel
python313-curses
python313-core-debugsource
python313-dbm-debuginfo
python313-base
python313-debugsource
python39-lxml
python39-mod_wsgi
python39-pyyaml
python39-psutil
python39-pytest
python39-more-itertools
python39-pip
python39-pip-wheel
python39-attrs
python39-packaging
python39-setuptools-wheel
python39-setuptools
IBM API Connect
Red Hat OpenShift Serverless
Multicluster Engine for Kubernetes
Red Hat OpenShift Container Platform
Red Hat Ceph Storage
IBM CICS TX Advanced
IBM CICS TX Standard

Install updates from vendor's website.

Python - addressed in versions 3.9.23, 3.10.18, 3.11.13, 3.12.11, 3.13.4, 3.14.0
IBM Observability with Instana - update to 1.0.299
Netcool Operations Insight - update to 1.6.15
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3
DataStage on Cloud Pak for Data - update to 5.2.1
IBM Qradar SIEM - update to 7.5.0 Update Pack 13
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.0.17, 9.1.6
IBM API Connect - update to 10.0.8.5
python39-wcwidth - update to 0.2.5-3
python39-PyMySQL - update to 0.10.1-2
python39-toml - update to 0.10.1-5
python39-pluggy - update to 0.13.1-3
python39-Cython - update to 0.29.21-5
python39-wheel-wheel - update to 0.35.1-4
python39-wheel - update to 0.35.1-4
Red Hat OpenShift Serverless - update to 1
python39-iniconfig - update to 1.1.1-2
python39-scipy - update to 1.5.4-5.0.1
python39-pysocks - update to 1.7.1-4
python39-py - update to 1.10.0-1
python39-cffi - update to 1.14.3-2
python39-six - update to 1.15.0-3
python39-numpy-doc - update to 1.19.4-3.0.1
python39-numpy-f2py - update to 1.19.4-3.0.1
python39-numpy - update to 1.19.4-3.0.1
python39-urllib3 - update to 1.25.10-5
python39-pyparsing - update to 2.4.7-5
Ansible Automation Platform - update to 2.5
Multicluster Engine for Kubernetes - update to 2.6.8
python39-pybind11 - update to 2.7.1-1
python39-pybind11-devel - update to 2.7.1-1
python39-psycopg2 - update to 2.8.6-3.0.1
python39-psycopg2-doc - update to 2.8.6-3.0.1
python39-psycopg2-tests - update to 2.8.6-3.0.1
python39-idna - update to 2.10-4
python39-pycparser - update to 2.20-3
python39-requests - update to 2.25.0-3
python39-chardet - update to 3.0.4-19
python39-cryptography - update to 3.3.1-3
python3-curses-debuginfo - addressed in versions 3.4.10-25.169.1, 3.6.15-150300.10.97.2
python3-tk-debuginfo - addressed in versions 3.4.10-25.169.1, 3.6.15-150300.10.97.2
python3-tk - addressed in versions 3.4.10-25.169.1, 3.6.15-150300.10.97.2
python3-debugsource - addressed in versions 3.4.10-25.169.1, 3.6.15-150300.10.97.2
python3-debuginfo - addressed in versions 3.4.10-25.169.1, 3.6.15-150300.10.97.2
libpython3_4m1_0-debuginfo-32bit - update to 3.4.10-25.169.1
python3-curses - addressed in versions 3.4.10-25.169.1, 3.6.15-150300.10.97.2
python3 - addressed in versions 3.4.10-25.169.1, 3.6.15-150300.10.97.2
python3-base-debuginfo-32bit - update to 3.4.10-25.169.1
libpython3_4m1_0-32bit - update to 3.4.10-25.169.1
python3-base - addressed in versions 3.4.10-25.169.1, 3.6.15-150300.10.97.1
libpython3_4m1_0-debuginfo - update to 3.4.10-25.169.1
libpython3_4m1_0 - update to 3.4.10-25.169.1
python3-base-debuginfo - addressed in versions 3.4.10-25.169.1, 3.6.15-150300.10.97.1
python3-devel-debuginfo - addressed in versions 3.4.10-25.169.1, 3.6.15-150300.10.97.1
python3-devel - addressed in versions 3.4.10-25.169.1, 3.6.15-150300.10.97.1
python3-base-debugsource - update to 3.4.10-25.169.1
python3 (Red Hat package) - addressed in versions 3.6.8-47.el8_6.8, 3.6.8-51.el8_8.10, 3.6.8-70.el8_10
python3-devel - update to 3.6.8-70.0.1
platform-python-devel - update to 3.6.8-70.0.1
platform-python - update to 3.6.8-70.0.1
platform-python-debug - update to 3.6.8-70.0.1
python3-tkinter - update to 3.6.8-70.0.1
python3-test - update to 3.6.8-70.0.1
python3-libs - update to 3.6.8-70.0.1
python3-idle - update to 3.6.8-70.0.1
python3.6 - addressed in versions 3.6.15-47.fc41, 3.6.15-47.fc42
libpython3_6m1_0-debuginfo - update to 3.6.15-150300.10.97.1
libpython3_6m1_0-64bit - update to 3.6.15-150300.10.97.1
libpython3_6m1_0-64bit-debuginfo - update to 3.6.15-150300.10.97.1
libpython3_6m1_0-32bit-debuginfo - update to 3.6.15-150300.10.97.1
python3-doc-devhelp - update to 3.6.15-150300.10.97.1
libpython3_6m1_0-32bit - update to 3.6.15-150300.10.97.1
python3-testsuite - update to 3.6.15-150300.10.97.1
python3-core-debugsource - update to 3.6.15-150300.10.97.1
python3-tools - update to 3.6.15-150300.10.97.1
python3-doc - update to 3.6.15-150300.10.97.1
libpython3_6m1_0 - update to 3.6.15-150300.10.97.1
python3-testsuite-debuginfo - update to 3.6.15-150300.10.97.1
python3-dbm - update to 3.6.15-150300.10.97.2
python3-idle - update to 3.6.15-150300.10.97.2
python3-dbm-debuginfo - update to 3.6.15-150300.10.97.2
python3-help - addressed in versions 3.7.9-46, 3.9.9-41, 3.9.9-45, 3.11.6-11, 3.11.6-13
python3-devel - addressed in versions 3.7.9-46, 3.9.9-41, 3.9.9-45, 3.11.6-11, 3.11.6-13
python3-debugsource - addressed in versions 3.7.9-46, 3.9.9-41, 3.9.9-45, 3.11.6-11, 3.11.6-13
python3-debuginfo - addressed in versions 3.7.9-46, 3.9.9-41, 3.9.9-45, 3.11.6-11, 3.11.6-13
python3-debug - addressed in versions 3.7.9-46, 3.9.9-41, 3.9.9-45, 3.11.6-11, 3.11.6-13
python3 - addressed in versions 3.7.9-46, 3.9.9-41, 3.9.9-45, 3.11.6-11, 3.11.6-13
python3-unversioned-command - addressed in versions 3.9.9-41, 3.9.9-45, 3.11.6-11, 3.11.6-13
python3.9 (Red Hat package) - addressed in versions 3.9.18-3.el9_4.8, 3.9.21-2.el9_6.1
python3.9 - addressed in versions 3.9.23-1.fc41, 3.9.23-1.fc42
python39-libs - update to 3.9.25-2.0.1
python39-rpm-macros - update to 3.9.25-2.0.1
python39-tkinter - update to 3.9.25-2.0.1
python39-test - update to 3.9.25-2.0.1
python39-idle - update to 3.9.25-2.0.1
python39-devel - update to 3.9.25-2.0.1
python39-debug - update to 3.9.25-2.0.1
python39 - update to 3.9.25-2.0.1
python3.10 - addressed in versions 3.10.18-1.fc41, 3.10.18-1.fc42
python3-tkinter - addressed in versions 3.11.6-11, 3.11.6-13
python3.11 (Red Hat package) - addressed in versions 3.11.7-1.el9_4.8, 3.11.11-2.el9_6.1, 3.11.13-1.el8_10
python39-ply - update to 3.11-10
python3.11 - addressed in versions 3.11.13-1.fc41, 3.11.13-1.fc42
python3.11-test - update to 3.11.13-1.0.1
python3.11 - update to 3.11.13-1.0.1
python3.11-debug - update to 3.11.13-1.0.1
python3.11-devel - update to 3.11.13-1.0.1
python3.11-idle - update to 3.11.13-1.0.1
python3.11-libs - update to 3.11.13-1.0.1
python3.11-tkinter - update to 3.11.13-1.0.1
python3.11-rpm-macros - update to 3.11.13-1.0.1
python311-testsuite-debuginfo - update to 3.11.13-150600.3.35.1
libpython3_11-1_0-64bit - update to 3.11.13-150600.3.35.1
libpython3_11-1_0-64bit-debuginfo - update to 3.11.13-150600.3.35.1
python311-base-64bit-debuginfo - update to 3.11.13-150600.3.35.1
python311-base-64bit - update to 3.11.13-150600.3.35.1
python311-base-32bit-debuginfo - update to 3.11.13-150600.3.35.1
libpython3_11-1_0-32bit - update to 3.11.13-150600.3.35.1
libpython3_11-1_0-32bit-debuginfo - update to 3.11.13-150600.3.35.1
python311-base-32bit - update to 3.11.13-150600.3.35.1
libpython3_11-1_0 - update to 3.11.13-150600.3.35.1
python311-base - update to 3.11.13-150600.3.35.1
python311-testsuite - update to 3.11.13-150600.3.35.1
python311-base-debuginfo - update to 3.11.13-150600.3.35.1
python311-doc - update to 3.11.13-150600.3.35.1
libpython3_11-1_0-debuginfo - update to 3.11.13-150600.3.35.1
python311-doc-devhelp - update to 3.11.13-150600.3.35.1
python311-tools - update to 3.11.13-150600.3.35.1
python311-devel - update to 3.11.13-150600.3.35.1
python311-core-debugsource - update to 3.11.13-150600.3.35.1
python311-dbm - update to 3.11.13-150600.3.35.2
python311-64bit-debuginfo - update to 3.11.13-150600.3.35.2
python311-curses - update to 3.11.13-150600.3.35.2
python311-64bit - update to 3.11.13-150600.3.35.2
python311-curses-debuginfo - update to 3.11.13-150600.3.35.2
python311-32bit - update to 3.11.13-150600.3.35.2
python311-32bit-debuginfo - update to 3.11.13-150600.3.35.2
python311-dbm-debuginfo - update to 3.11.13-150600.3.35.2
python311-tk-debuginfo - update to 3.11.13-150600.3.35.2
python311 - update to 3.11.13-150600.3.35.2
python311-tk - update to 3.11.13-150600.3.35.2
python311-debuginfo - update to 3.11.13-150600.3.35.2
python311-debugsource - update to 3.11.13-150600.3.35.2
python311-idle - update to 3.11.13-150600.3.35.2
python3.12 (Red Hat package) - addressed in versions 3.12.1-4.el9_4.6, 3.12.9-1.el9_6.1, 3.12.9-2.el10_0.2, 3.12.11-1.el8_10
python3.12 (Ubuntu package) - addressed in versions 3.12.3-1ubuntu0.7, 3.12.7-1ubuntu2.2, 3.13.0-1ubuntu0.3, 3.13.3-1ubuntu0.2
python3.12 - addressed in versions 3.12.11-1.fc41, 3.12.11-1.fc42
libpython3_13-1_0-debuginfo - update to 3.13.5-150700.4.20.1
python313-tk - update to 3.13.5-150700.4.20.1
python313-tools - update to 3.13.5-150700.4.20.1
python313-idle - update to 3.13.5-150700.4.20.1
python313-dbm - update to 3.13.5-150700.4.20.1
python313-tk-debuginfo - update to 3.13.5-150700.4.20.1
python313 - update to 3.13.5-150700.4.20.1
python313-curses-debuginfo - update to 3.13.5-150700.4.20.1
libpython3_13-1_0 - update to 3.13.5-150700.4.20.1
python313-base-debuginfo - update to 3.13.5-150700.4.20.1
python313-debuginfo - update to 3.13.5-150700.4.20.1
python313-devel - update to 3.13.5-150700.4.20.1
python313-curses - update to 3.13.5-150700.4.20.1
python313-core-debugsource - update to 3.13.5-150700.4.20.1
python313-dbm-debuginfo - update to 3.13.5-150700.4.20.1
python313-base - update to 3.13.5-150700.4.20.1
python313-debugsource - update to 3.13.5-150700.4.20.1
python39-lxml - update to 4.6.5-1
python39-mod_wsgi - update to 4.7.1-7
Red Hat Advanced Cluster Security for Kubernetes - update to 4.7.5
Red Hat OpenShift Container Platform - addressed in versions 4.12.79, 4.14.54, 4.16.44, 4.16.45, 4.17.36, 4.18.20, 4.19.4
python39-pyyaml - update to 5.4.1-1
python39-psutil - update to 5.8.0-4.0.1
python39-pytest - update to 6.0.2-2.0.1
Red Hat Ceph Storage - update to 7.1
python39-more-itertools - update to 8.5.0-2
IBM TXSeries for Multiplatforms - update to 11.1.0.0 ifix9
IBM CICS TX Advanced - update to 11.1.0.0 ifix33
IBM CICS TX Standard - update to 11.1.0.0 ifix34
python39-pip - update to 20.2.4-9
python39-pip-wheel - update to 20.2.4-9
python39-attrs - update to 20.3.0-2
python39-packaging - update to 20.4-4
python39-setuptools-wheel - update to 50.3.2-7
python39-setuptools - update to 50.3.2-7

• https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da
• https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9
• https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a
• https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e
• https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a
• https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a
• https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01
• https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1
• https://github.com/python/cpython/issues/135034
• https://github.com/python/cpython/pull/135037
• https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/

• Multiple vulnerabilities in Python
• Fedora 41 update for python3.10
• Fedora 42 update for python3.10
• Fedora 42 update for python3.9
• Fedora 41 update for python3.9
• Fedora 42 update for python3.11
• Fedora 41 update for python3.11
• Fedora 42 update for python3.12
• Fedora 41 update for python3.12
• Ubuntu update for python3.12
• Red Hat Enterprise Linux 9 update for python3.11
• Red Hat Enterprise Linux 8 update for python3.11
• Red Hat Enterprise Linux 9 update for python3.12
• Red Hat Enterprise Linux 8 update for python3.12
• Red Hat Enterprise Linux 8 update for python3
• Red Hat Enterprise Linux 9 update for python3.9
• Red Hat Enterprise Linux 9 update for python3.12
• Red Hat Enterprise Linux 10 update for python3.12
• Red Hat Enterprise Linux 9 update for python3.11
• Anolis OS update for python3
• Fedora 41 update for python3.6
• Fedora 42 update for python3.6
• Red Hat Enterprise Linux 9 update for python3.9
• Red Hat Enterprise Linux 8 update for python3
• Red Hat Enterprise Linux 8 update for python3
• openEuler 24.03 LTS SP1 update for python3
• openEuler 24.03 LTS update for python3
• openEuler 24.03 LTS SP2 update for python3
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.7
• Anolis OS update for python3.11
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in IBM Observability with Instana (Agent)
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• SUSE update for python311
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in IBM QRadar SIEM
• SUSE update for python313
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in IBM CICS TX Standard
• Multiple vulnerabilities in IBM TXSeries for Multiplatforms
• SUSE update for python3
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• openEuler 22.03 LTS SP4 update for python3
• openEuler 22.03 LTS SP3 update for python3
• Multiple vulnerabilities in Red Hat Ceph Storage 7
• openEuler 20.03 LTS SP4 update for python3
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM API Connect
• Red Hat Enterprise Linux 8 update for the python39:3.9 module
• IBM Watson Speech Services Cartridge update for python
• Anolis OS update for python39:3.9 module
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• SUSE update for python3
• Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component
• Multiple vulnerabilities in Ansible Automation Platform 2.5 packages