CVE-2019-20907

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-20907
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-20907.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-20907
Aliases
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CLEANSTART (5)
DEBIAN (1)
MGASA (1)
openSUSE (16)
RHSA (11)
RLSA (2)
SUSE (12)
UBUNTU (1)
Related
ALSA (2)
openSUSE (16)
SUSE (12)
Published
2020-07-13T13:15:10Z
Modified
2026-08-07T11:31:16Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vsphere:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "9.5"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "netapp:active_iq_unified_manager"
        },
        {
            "cpes":  [
                "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "12.04"
                },
                {
                    "last_affected":  "12.04"
                },
                {
                    "introduced":  "14.04"
                },
                {
                    "last_affected":  "14.04"
                },
                {
                    "introduced":  "16.04"
                },
                {
                    "last_affected":  "16.04"
                },
                {
                    "introduced":  "18.04"
                },
                {
                    "last_affected":  "18.04"
                },
                {
                    "introduced":  "20.04"
                },
                {
                    "last_affected":  "20.04"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "canonical:ubuntu_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "9.0"
                },
                {
                    "last_affected":  "9.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "debian:debian_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "31"
                },
                {
                    "last_affected":  "31"
                },
                {
                    "introduced":  "32"
                },
                {
                    "last_affected":  "32"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "fedoraproject:fedora"
        },
        {
            "cpes":  [
                "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "15.1"
                },
                {
                    "last_affected":  "15.1"
                },
                {
                    "introduced":  "15.2"
                },
                {
                    "last_affected":  "15.2"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "opensuse:leap"
        },
        {
            "cpes":  [
                "cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.8"
                },
                {
                    "last_affected":  "8.8"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "oracle:zfs_storage_appliance_kit"
        }
    ]
}
References

Affected packages

Git / github.com/python/cpython

Affected ranges

Type
GIT
Repo
https://github.com/python/cpython
Events
Introduced
2e789a1f1d84b343a996e8654590703b5fbdd441
Fixed
426b022776672fdf3d71ddd98d89af341c88080f
Introduced
5c4568a05a0a62b5947c55f68f9f2ecfb90a4f12
Fixed
c0a9afe2ac1820409e6173bd1893ebee2cf50270
Introduced
1bf9cc509326bc42cd8cb1650eb9bf64550d817e
Fixed
13c94747c74437e594b7fc242ff7da668e81887c
Introduced
fa919fdf2583bdfead1df00e842f24f30b2a34bf
Fixed
580fbb018fd0844806119614d752b41fc69660f9
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "3.5.0"
        },
        {
            "fixed":  "3.5.10"
        },
        {
            "introduced":  "3.6.0"
        },
        {
            "fixed":  "3.6.12"
        },
        {
            "introduced":  "3.7.0"
        },
        {
            "fixed":  "3.7.9"
        },
        {
            "introduced":  "3.8.0"
        },
        {
            "fixed":  "3.8.5"
        }
    ],
    "source":  "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-20907.json"