IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

15-year-old vulnerability found in Python module

Hundreds of thousands of repositories have been found to be exposed to the vulnerability

Researchers have discovered a 15-year-old vulnerability found in a Python module and found that hundreds of thousands of repositories are exposed to it.

Trellix Advanced Research Center discovered the vulnerability in Python’s tarfile module, the group revealed yesterday. First, the centre thought it had found a new zero-day vulnerability but then realised it was CVE-2007-4559, a vulnerability first discovered in 2007.

The vulnerability is a path traversal attack in the extract and extractall functions in the tarfile module that allow an attacker to overwrite arbitrary files by adding the “...” sequence to filenames in a TAR archive.

Tarfiles are a collection of multiple different files and metadata which are then used to unarchive the tarfile. The metadata in a tar archive can contain information on its name, size, owner, and when it was archived. 

Attackers simply need to add “...” with a separator for the operating system, either “/” or “\”, into the file name to escape the directory the file is meant to be extracted to. The tarfile module also lets users add a filter that can be used to parse and modify a file’s metadata before it’s added to the tar archive. This lets attackers create their exploits with as little as six lines of code.

Throughout its research, Trellix found that hundreds of thousands of repositories were exposed to the vulnerability.

Related Resource

An EDR buyer's guide

How to pick the best endpoint detection and response solution for your business

Whitepaper cover with title and image of grey and green blocks, with the green ones connected to each otherFree Download

“While the vulnerability was originally only marked as a 6.8, we were able to confirm that in most cases an attacker can gain code execution from the file write,” wrote the centre.

Treliix added that the vulnerability is incredibly easy to exploit, requiring little to no knowledge about complicated security topics. It added that it’s patching as many open-source repositories as possible as well as providing a way to scan closed-source repositories.

Another Python vulnerability was discovered in May this year but in one of its popular open-source packages. Two open-source packages, Python’s CTX and PHP’s phpass, were found to be compromised which led to developers trying to understand their exposure to the vulnerability. Around 3 million users were expected to be affected by the compromise, with one business already reporting it had been affected.

Featured Resources

Big data for finance

How to leverage big data analytics and AI in the finance sector

Free Download

Ten critical factors for cloud analytics success

Cloud-native, intelligent, and automated data management strategies to accelerate time to value and ROI

Free Download

Remove barriers and reconnect with your customers

The $260 billion dollar friction problem businesses don't know they have

Free Download

The future of work is already here. Now’s the time to secure it.

Robust security to protect and enable your business

Free Download

Most Popular

How to secure your hybrid workforce
Advertisement Feature

How to secure your hybrid workforce

23 Sep 2022
What your hybrid workforce needs from their laptops
Advertisement Feature

What your hybrid workforce needs from their laptops

21 Sep 2022
Why collaboration is key to digital transformation

Why collaboration is key to digital transformation

13 Sep 2022