python: infinite loop in the tarfile module via crafted TAR archive
Published Jul 13, 2020
7.5
HIGHCVSS 3.1
EPSS 6.25%
Description
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
Affected products
No data.
Configuration 1
Configuration 3
- 9.0
Configuration 4
- 31
- 32
Configuration 5
- 12.04
- 14.04
- 16.04
- 18.04
- 20.04
Configuration 6
- ≥ 9.5
- n/a
Configuration 7
- 8.8
No data.
Red Hat Enterprise Linux 7
python-0:2.7.5-90.el7
Fixed · RHSA-2020:5009
Red Hat Enterprise Linux 7
python3-0:3.6.8-18.el7
Fixed · RHSA-2020:5010
Red Hat Enterprise Linux 7.4 Advanced Update Support
python-0:2.7.5-64.el7_4
Fixed · RHSA-2021:0761
Red Hat Enterprise Linux 7.4 Telco Extended Update Support
python-0:2.7.5-64.el7_4
Fixed · RHSA-2021:0761
Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
python-0:2.7.5-64.el7_4
Fixed · RHSA-2021:0761
Red Hat Enterprise Linux 7.6 Extended Update Support
python-0:2.7.5-84.el7_6
Fixed · RHSA-2021:0881
Red Hat Enterprise Linux 7.7 Extended Update Support
python-0:2.7.5-88.el7_7
Fixed · RHSA-2021:0528
Red Hat Enterprise Linux 8
python27:2.7-8030020200819165638.851f4228
Fixed · RHSA-2020:4654
Red Hat Enterprise Linux 8
python3-0:3.6.8-31.el8
Fixed · RHSA-2020:4433
Red Hat Enterprise Linux 8
python3-0:3.6.8-31.el8
Fixed · RHSA-2020:4433
Red Hat Enterprise Linux 8
python38:3.8-8030020200818121840.4190259b
Fixed · RHSA-2020:4641
Red Hat OpenShift Do
openshiftdo/odo-init-image-rhel7:1.1.3-2
Fixed · RHSA-2021:0949
Red Hat Software Collections for Red Hat Enterprise Linux 6
rh-python36-python-0:3.6.12-1.el6
Fixed · RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux 6
rh-python36-python-pip-0:9.0.1-5.el6
Fixed · RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux 6
rh-python36-python-virtualenv-0:15.1.0-3.el6
Fixed · RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux 7
python27-python-0:2.7.18-2.el7
Fixed · RHSA-2020:4273
Red Hat Software Collections for Red Hat Enterprise Linux 7
python27-python-pip-0:8.1.2-6.el7
Fixed · RHSA-2020:4273
Red Hat Software Collections for Red Hat Enterprise Linux 7
python27-python-virtualenv-0:13.1.0-4.el7
Fixed · RHSA-2020:4273
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-python36-python-0:3.6.12-1.el7
Fixed · RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-python36-python-pip-0:9.0.1-5.el7
Fixed · RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-python36-python-virtualenv-0:15.1.0-3.el7
Fixed · RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-python38-python-0:3.8.6-1.el7
Fixed · RHSA-2020:4299
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-python38-python-psutil-0:5.6.4-5.el7
Fixed · RHSA-2020:4299
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-python38-python-urllib3-0:1.25.7-6.el7
Fixed · RHSA-2020:4299
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
python27-python-0:2.7.18-2.el7
Fixed · RHSA-2020:4273
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
python27-python-pip-0:8.1.2-6.el7
Fixed · RHSA-2020:4273
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
python27-python-virtualenv-0:13.1.0-4.el7
Fixed · RHSA-2020:4273
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
rh-python36-python-0:3.6.12-1.el7
Fixed · RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
rh-python36-python-pip-0:9.0.1-5.el7
Fixed · RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
rh-python36-python-virtualenv-0:15.1.0-3.el7
Fixed · RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
rh-python38-python-0:3.8.6-1.el7
Fixed · RHSA-2020:4299
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
rh-python38-python-psutil-0:5.6.4-5.el7
Fixed · RHSA-2020:4299
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
rh-python38-python-urllib3-0:1.25.7-6.el7
Fixed · RHSA-2020:4299
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
python27-python-0:2.7.18-2.el7
Fixed · RHSA-2020:4273
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
python27-python-pip-0:8.1.2-6.el7
Fixed · RHSA-2020:4273
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
python27-python-virtualenv-0:13.1.0-4.el7
Fixed · RHSA-2020:4273
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
rh-python36-python-0:3.6.12-1.el7
Fixed · RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
rh-python36-python-pip-0:9.0.1-5.el7
Fixed · RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
rh-python36-python-virtualenv-0:15.1.0-3.el7
Fixed · RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
rh-python38-python-0:3.8.6-1.el7
Fixed · RHSA-2020:4299
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
rh-python38-python-psutil-0:5.6.4-5.el7
Fixed · RHSA-2020:4299
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
rh-python38-python-urllib3-0:1.25.7-6.el7
Fixed · RHSA-2020:4299
Red Hat Enterprise Linux 5
python
Out of support scope
Red Hat Enterprise Linux 6
python
Out of support scope
Red Hat Enterprise Linux 8
python36:3.6/python36
Not affected
Red Hat Quay 3
python27
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | python-0:2.7.5-90.el7 | Fixed | RHSA-2020:5009 |
| Red Hat Enterprise Linux 7 | python3-0:3.6.8-18.el7 | Fixed | RHSA-2020:5010 |
| Red Hat Enterprise Linux 7.4 Advanced Update Support | python-0:2.7.5-64.el7_4 | Fixed | RHSA-2021:0761 |
| Red Hat Enterprise Linux 7.4 Telco Extended Update Support | python-0:2.7.5-64.el7_4 | Fixed | RHSA-2021:0761 |
| Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions | python-0:2.7.5-64.el7_4 | Fixed | RHSA-2021:0761 |
| Red Hat Enterprise Linux 7.6 Extended Update Support | python-0:2.7.5-84.el7_6 | Fixed | RHSA-2021:0881 |
| Red Hat Enterprise Linux 7.7 Extended Update Support | python-0:2.7.5-88.el7_7 | Fixed | RHSA-2021:0528 |
| Red Hat Enterprise Linux 8 | python27:2.7-8030020200819165638.851f4228 | Fixed | RHSA-2020:4654 |
| Red Hat Enterprise Linux 8 | python3-0:3.6.8-31.el8 | Fixed | RHSA-2020:4433 |
| Red Hat Enterprise Linux 8 | python3-0:3.6.8-31.el8 | Fixed | RHSA-2020:4433 |
| Red Hat Enterprise Linux 8 | python38:3.8-8030020200818121840.4190259b | Fixed | RHSA-2020:4641 |
| Red Hat OpenShift Do | openshiftdo/odo-init-image-rhel7:1.1.3-2 | Fixed | RHSA-2021:0949 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-python36-python-0:3.6.12-1.el6 | Fixed | RHSA-2020:4285 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-python36-python-pip-0:9.0.1-5.el6 | Fixed | RHSA-2020:4285 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-python36-python-virtualenv-0:15.1.0-3.el6 | Fixed | RHSA-2020:4285 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | python27-python-0:2.7.18-2.el7 | Fixed | RHSA-2020:4273 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | python27-python-pip-0:8.1.2-6.el7 | Fixed | RHSA-2020:4273 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | python27-python-virtualenv-0:13.1.0-4.el7 | Fixed | RHSA-2020:4273 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-python36-python-0:3.6.12-1.el7 | Fixed | RHSA-2020:4285 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-python36-python-pip-0:9.0.1-5.el7 | Fixed | RHSA-2020:4285 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-python36-python-virtualenv-0:15.1.0-3.el7 | Fixed | RHSA-2020:4285 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-python38-python-0:3.8.6-1.el7 | Fixed | RHSA-2020:4299 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-python38-python-psutil-0:5.6.4-5.el7 | Fixed | RHSA-2020:4299 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-python38-python-urllib3-0:1.25.7-6.el7 | Fixed | RHSA-2020:4299 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | python27-python-0:2.7.18-2.el7 | Fixed | RHSA-2020:4273 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | python27-python-pip-0:8.1.2-6.el7 | Fixed | RHSA-2020:4273 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | python27-python-virtualenv-0:13.1.0-4.el7 | Fixed | RHSA-2020:4273 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | rh-python36-python-0:3.6.12-1.el7 | Fixed | RHSA-2020:4285 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | rh-python36-python-pip-0:9.0.1-5.el7 | Fixed | RHSA-2020:4285 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | rh-python36-python-virtualenv-0:15.1.0-3.el7 | Fixed | RHSA-2020:4285 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | rh-python38-python-0:3.8.6-1.el7 | Fixed | RHSA-2020:4299 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | rh-python38-python-psutil-0:5.6.4-5.el7 | Fixed | RHSA-2020:4299 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | rh-python38-python-urllib3-0:1.25.7-6.el7 | Fixed | RHSA-2020:4299 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | python27-python-0:2.7.18-2.el7 | Fixed | RHSA-2020:4273 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | python27-python-pip-0:8.1.2-6.el7 | Fixed | RHSA-2020:4273 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | python27-python-virtualenv-0:13.1.0-4.el7 | Fixed | RHSA-2020:4273 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-python36-python-0:3.6.12-1.el7 | Fixed | RHSA-2020:4285 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-python36-python-pip-0:9.0.1-5.el7 | Fixed | RHSA-2020:4285 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-python36-python-virtualenv-0:15.1.0-3.el7 | Fixed | RHSA-2020:4285 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-python38-python-0:3.8.6-1.el7 | Fixed | RHSA-2020:4299 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-python38-python-psutil-0:5.6.4-5.el7 | Fixed | RHSA-2020:4299 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-python38-python-urllib3-0:1.25.7-6.el7 | Fixed | RHSA-2020:4299 |
| Red Hat Enterprise Linux 5 | python | Out of support scope | n/a |
| Red Hat Enterprise Linux 6 | python | Out of support scope | n/a |
| Red Hat Enterprise Linux 8 | python36:3.6/python36 | Not affected | n/a |
| Red Hat Quay 3 | python27 | Affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
A service is vulnerable if it uses python's tarfile module to open untrusted tar files. If an attacker is able to submit a crafted tar file to a service which uses the tarfile module to open it, an infinite loop will be executed, potentially causing a denial of service. The tarfile module is included with python. Versions of `python36:3.6/python36` as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main `python3` component, which provides the actual interpreter of the Python programming language.
Red Hat mitigation
This flaw can be mitigated by not opening untrusted files with tarfile.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
AV:N/AC:L/Au:N/C:N/I:N/A:P
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Percentile over time
- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Table of values (19 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 6.25% (0.06253) | 93.36th | v5 (v2026.06.15) |
| Jun 15, 2026 | 6.30% (0.06304) | 92.69th | v5 (v2026.06.15) |
| Nov 21, 2025 | 0.30% (0.00299) | 52.78th | v4 (v2025.03.14) |
| Nov 18, 2025 | 4.10% (0.04099) | 87.46th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.32% (0.00321) | 52.91th | v4 (v2025.03.14) |
| Dec 12, 2024 | 1.18% (0.01176) | 85.66th | v3 (v2023.03.01) |
| Jun 19, 2024 | 1.18% (0.01184) | 85.14th | v3 (v2023.03.01) |
| Jun 3, 2024 | 1.04% (0.01038) | 83.94th | v3 (v2023.03.01) |
| May 17, 2024 | 1.21% (0.01206) | 85.15th | v3 (v2023.03.01) |
| Nov 8, 2023 | 1.11% (0.01108) | 82.82th | v3 (v2023.03.01) |
| Sep 3, 2023 | 0.59% (0.00593) | 75.62th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.52% (0.00520) | 73.20th | v3 (v2023.03.01) |
| Mar 6, 2023 | 2.69% (0.02686) | 82.85th | v2 (v2022.01.01) |
| Apr 1, 2022 | 2.69% (0.02686) | 81.17th | v2 (v2022.01.01) |
| Feb 4, 2022 | 23.44% (0.23437) | 94.77th | v2 (v2022.01.01) |
| Feb 3, 2022 | 20.50% (0.20495) | 94.18th | v1 |
| Jan 6, 2022 | 20.50% (0.20495) | 94.11th | v1 |
| Jan 5, 2022 | 5.43% (0.05433) | 88.95th | v5 (v2026.06.15) |
| Apr 14, 2021 | 5.43% (0.05433) | 0.00th | v1 |
References (31)
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html vendor-advisoryMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html vendor-advisoryMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html vendor-advisoryMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html vendor-advisoryMailing ListThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2019-20907 Vendor Advisory
- https://bugs.python.org/issue39017 Issue TrackingVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1856481 Issue Tracking
- https://github.com/python/cpython/pull/21454 PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html mailing-listMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html mailing-listMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html mailing-list
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/ vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-20907
- https://security.gentoo.org/glsa/202008-01 vendor-advisoryThird Party Advisory
- https://security.netapp.com/advisory/ntap-20200731-0002/ Third Party Advisory
- https://usn.ubuntu.com/4428-1/ vendor-advisoryThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-20907
- https://www.oracle.com/security-alerts/cpujan2021.html PatchThird Party Advisory
Change history (0)
No recorded changes yet.