UpHeron
All vulnerabilities

Servers and applications

CVE-2019-20907

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Severity
High 7.5
Published
13 Jul 2020
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.5.10, 3.6.12, 3.7.9, 3.8.5
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • From 3.5.0 before 3.5.10
  • From 3.6.0 before 3.6.12
  • From 3.7.0 before 3.7.9
  • From 3.8.0 before 3.8.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-20907
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-20907