]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.10] gh-135034: Normalize link targets in tarfile, add `os.path.realpath(strict...
authorT. Wouters <thomas@python.org>
Tue, 3 Jun 2025 17:02:29 +0000 (19:02 +0200)
committerGitHub <noreply@github.com>
Tue, 3 Jun 2025 17:02:29 +0000 (19:02 +0200)
commit9c1110ef6652687d7c55f590f909720eddde965a
treea011bf522153086acda5cf61dd8573e0a797895f
parentc71ea4ba069c9e17469d349de0f6a2feda9848db
[3.10] gh-135034: Normalize link targets in tarfile, add `os.path.realpath(strict='allow_missing')` (GH-135037) (#135070)

Addresses CVEs 2024-12718, 2025-4138, 2025-4330, and 2025-4517.
(cherry picked from commit 3612d8f51741b11f36f8fb0494d79086bac9390a)
(cherry picked from commit c358142cab7ce621a2745262a90df967b357f61c)
(cherry picked from commit 371b4eaadcd5846d79af8f7912e4320f9cd9fae4)

Co-authored-by: Łukasz Langa <lukasz@langa.pl>
Signed-off-by: Łukasz Langa <lukasz@langa.pl>
Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Doc/library/os.path.rst
Doc/library/tarfile.rst
Doc/whatsnew/3.10.rst
Lib/genericpath.py
Lib/ntpath.py
Lib/posixpath.py
Lib/tarfile.py
Lib/test/test_ntpath.py
Lib/test/test_posixpath.py
Lib/test/test_tarfile.py
Misc/NEWS.d/next/Security/2025-06-02-11-32-23.gh-issue-135034.RLGjbp.rst [new file with mode: 0644]