VDB
RHSA-2026:54554
RHSA-2026:54554
PUBLISHED
CVSS 2.799999952316284 LOW
A flaw was found in the Python `Tarfile.extract()` function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the `filter` parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leading to unauthorized modifications or privilege issues on the system.
Risk Scores
CVSS 3.1
2.799999952316284
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | python3-13-main@src as a component of Red Hat Hardened Images | * |
| Red Hat | python3-13-main@aarch64 as a component of Red Hat Hardened Images | * |
| Red Hat | python3-13-main@x86_64 as a component of Red Hat Hardened Images | * |
Timeline
- Aug 13, 2026 CVE Published
- Aug 24, 2026 CVE Updated
- Aug 24, 2026 Distribution Patch
- Aug 24, 2026 Distribution Patch
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54554 advisory
- https://access.redhat.com/security/cve/CVE-2026-11940 advisory
- https://access.redhat.com/security/cve/CVE-2026-11972 advisory
- https://access.redhat.com/security/cve/CVE-2026-15308 advisory
- https://access.redhat.com/security/cve/CVE-2026-4360 advisory
- https://access.redhat.com/security/cve/CVE-2026-6879 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://images.redhat.com/ advisory
- https://access.redhat.com/security/cve/CVE-2026-18503 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54554.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2494987 issue
- https://www.cve.org/CVERecord?id=CVE-2026-4360 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-4360 advisory
- https://github.com/python/cpython/issues/151987 advisory
- https://github.com/python/cpython/pull/151988 advisory
- https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/ advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2508122 issue
- https://www.cve.org/CVERecord?id=CVE-2026-6879 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-6879 advisory
- https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0 advisory
…and 31 more