Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4 · Advisory · python-poetry/poetry · GitHub

Vulnerability Overview Vulnerability Name: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4 CVE ID: CVE-2024-1140 CWE ID: CWE-22 Description: The function in does not protect against path traversal when extracting tar files. This vulnerability exists in Python versions where is unavailable. Affected Python versions are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. Impact Scope Affected Versions: Poetry <= 2.3.3 Fixed Version: Poetry 2.3.4 Specific Impacts: - An attacker can exploit this vulnerability to execute arbitrary code during post-build. - In Python 3.11.2 (default version in Debian Bookworm), by crafting malicious member paths, files can be written outside the target directory. - Affected environments include: - Python 3.10.0 to 3.10.12 (inclusive): missing or broken - Python 3.11.0 to 3.11.4 (inclusive): missing or broken - Debian Bookworm: Python 3.11.2 (default) - Ubuntu 22.04 LTS: Python 3.10.6 (default) Remediation Patch: Poetry version 2.3.4 and later ensures paths remain within the target directory. Root Cause: At lines 410–426 of , when is unavailable, the call to lacks filters or path validation. Attack Vectors: 1. Direct Path Traversal: Tar members containing path components will write files outside the target directory. 2. Symbolic Link Traversal: Symbolic link members pointing outside the target directory allow writing via the link, bypassing boundaries. 3. Hard Link Attack: Hard link members can read arbitrary files (same inode) or overwrite files outside the target directory. Call Sites Locations: 1. ( ): Builds packages from sdist during or . Triggered only when the executor is enabled. 2. ( ): During dependency resolution ( or ). Triggered when the of an lacks metadata, forcing Poetry to extract the archive and subsequently build the package. Recommended Fix Code Example:

Goal Reached Thanks to every supporter — we hit 100%!

Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4 · Advisory · python-poetry/poetry · GitHub

More from this source