VDB

RHSA-2026:54268

RHSA-2026:54268 PUBLISHED CVSS 7.300000190734863 HIGH

A flaw was found in the `tarfile.extractall()` function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.

Risk Scores

CVSS 3.1
7.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected Products

VendorProductVersions
Red Hatpython3.9-debuginfo-0:3.9.25-7.el9_8.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3-tkinter-0:3.9.25-7.el9_8.3.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3.9-debugsource-0:3.9.25-7.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3-test-0:3.9.25-7.el9_8.3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3.9-debugsource-0:3.9.25-7.el9_8.3.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3-0:3.9.25-7.el9_8.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3.9-debugsource-0:3.9.25-7.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3-test-0:3.9.25-7.el9_8.3.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3.9-debugsource-0:3.9.25-7.el9_8.3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3.9-debugsource-0:3.9.25-7.el9_8.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3.9-debugsource-0:3.9.25-7.el9_8.3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3-idle-0:3.9.25-7.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3.9-debuginfo-0:3.9.25-7.el9_8.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3.9-debugsource-0:3.9.25-7.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3-debug-0:3.9.25-7.el9_8.3.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3.9-debuginfo-0:3.9.25-7.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3-libs-0:3.9.25-7.el9_8.3.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3-debug-0:3.9.25-7.el9_8.3.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3.9-debugsource-0:3.9.25-7.el9_8.3.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)0:3.9.25-7.el9_8.3
Red Hatpython3-0:3.9.25-7.el9_8.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)0:3.9.25-7.el9_8.3

…and 47 more

Timeline

  • Aug 12, 2026 CVE Published
  • Aug 24, 2026 CVE Updated
  • Aug 24, 2026 Distribution Patch
  • Aug 24, 2026 Distribution Patch
  • Aug 24, 2026 Security Advisory
  • Aug 24, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›