Skip to content

gh-155999: In tarfile, handle a member that leaves the destination and comes back - #156000

Merged
StanFromIreland merged 4 commits into
python:mainfrom
StanFromIreland:tarfile-around-the-world-escape
Aug 19, 2026
Merged

gh-155999: In tarfile, handle a member that leaves the destination and comes back#156000
StanFromIreland merged 4 commits into
python:mainfrom
StanFromIreland:tarfile-around-the-world-escape

Conversation

@StanFromIreland

@StanFromIreland StanFromIreland commented Aug 18, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

@bedevere-app bedevere-app Bot mentioned this pull request Aug 18, 2026
Open
@read-the-docs-community

read-the-docs-community Bot commented Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #34125170 | 📁 Comparing 40c0c7c against main (60dff5a)

  🔍 Preview build  

3 files changed
± library/asyncio-task.html
± library/tarfile.html
± whatsnew/changelog.html

ethanfurman
ethanfurman reviewed Aug 18, 2026
View reviewed changes
Comment thread Lib/test/test_tarfile.py
ethanfurman
ethanfurman approved these changes Aug 18, 2026
View reviewed changes
Comment thread Lib/test/test_tarfile.py
@StanFromIreland StanFromIreland added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels Aug 18, 2026
@StanFromIreland
StanFromIreland merged commit 9768834 into python:main Aug 19, 2026
66 checks passed
@StanFromIreland
StanFromIreland deleted the tarfile-around-the-world-escape branch August 19, 2026 08:52
@miss-islington-app

miss-islington-app Bot commented Aug 19, 2026

Copy link
Copy Markdown

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

@bedevere-app

bedevere-app Bot commented Aug 19, 2026

Copy link
Copy Markdown

GH-156040 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label Aug 19, 2026
@bedevere-app

bedevere-app Bot commented Aug 19, 2026

Copy link
Copy Markdown

GH-156041 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Aug 19, 2026
@bedevere-app

bedevere-app Bot commented Aug 19, 2026

Copy link
Copy Markdown

GH-156042 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Aug 19, 2026
@bedevere-app

bedevere-app Bot commented Aug 19, 2026

Copy link
Copy Markdown

GH-156043 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Aug 19, 2026
@miss-islington-app

miss-islington-app Bot commented Aug 19, 2026

Copy link
Copy Markdown

Sorry, @StanFromIreland, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 97688346ada2df3e5b9c279348862c3d64ab0823 3.10

@bedevere-app

bedevere-app Bot commented Aug 19, 2026

Copy link
Copy Markdown

GH-156044 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Aug 19, 2026
@bedevere-app

bedevere-app Bot commented Aug 19, 2026

Copy link
Copy Markdown

GH-156046 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.10 only security fixes label Aug 19, 2026
StanFromIreland added a commit that referenced this pull request Aug 19, 2026
@miss-islington @StanFromIreland
[3.14] gh-155999: tarfile: handle a member that leaves the destinat…
16dea1e 
…ion but comes back (GH-156000) (#156041)

(cherry picked from commit 9768834)

Co-authored-by: Stan Ulbrych <stan@python.org>
StanFromIreland added a commit that referenced this pull request Aug 19, 2026
@miss-islington @StanFromIreland
[3.13] gh-155999: tarfile: handle a member that leaves the destinat…
c7979f3 
…ion but comes back (GH-156000) (#156042)

(cherry picked from commit 9768834)

Co-authored-by: Stan Ulbrych <stan@python.org>
Yhg1s pushed a commit that referenced this pull request Aug 20, 2026
@miss-islington @StanFromIreland
[3.12] gh-155999: tarfile: handle a member that leaves the destinat…
a5bfd96 
…ion but comes back (GH-156000) (#156043)

gh-155999: `tarfile`: handle a member that leaves the destination but comes back (GH-156000)
(cherry picked from commit 9768834)

Co-authored-by: Stan Ulbrych <stan@python.org>
@LearningCircuit LearningCircuit mentioned this pull request Aug 27, 2026
Merged
hugovk pushed a commit that referenced this pull request Aug 31, 2026
@miss-islington @StanFromIreland
[3.15] gh-155999: tarfile: handle a member that leaves the destinat…
038a091 
…ion but comes back (GH-156000) (#156040)

gh-155999: `tarfile`: handle a member that leaves the destination but comes back (GH-156000)
(cherry picked from commit 9768834)

Co-authored-by: Stan Ulbrych <stan@python.org>
@ai-collaboration-app ai-collaboration-app Bot mentioned this pull request Sep 8, 2026
Open
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this pull request Sep 18, 2026
mcepl @bmwiedemann
Update python313 to version 3.13.15 / rev 45 via SR 1378363
c7214ed 
https://build.opensuse.org/request/show/1378363
by user mcepl + anag_factory
- Restore back macros.python3, we need it.

- CVE-2026-19672: in tarfile, handle a member that leaves the
  destination and comes back  (bsc#1276227, gh#python/cpython#156000)
  CVE-2026-19672-tarfile-outside-dirs.patch

CVE-2026-17084: Don't consider Unicode codepoint attributes
   outside RFC 3454 (bsc#1276226)
   CVE-2026-17084-unicode-rfc3454.patch

- Add sphinx9-runtime-node.patch fixing documentation build with
  Sphinx 9 by importing the extension's Node type at runtime.

- Restore the self-contained structure of the python313 package in
  openSUSE Factory:
  * the package has started to rely on the separate virtual `python3`
    package for the generic interpreter entry points and for the
    `python3*` Provides (bsc#1258364). That structure is meant for the
    SUSE Linux family of
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this pull request Sep 23, 2026
mcepl @bmwiedemann
Update python314 to version 3.14.7 / rev 40 via SR 1379535
c29104e 
https://build.opensuse.org/request/show/1379535
by user mcepl + anag_factory
- CVE-2026-15310: bound zipfile decompression for
  bzip2/LZMA/Zstandard (bsc#1277111, gh#python/cpython#156002)
  CVE-2026-15310-bound-zipfile-decompression.patch
  CVE-2026-15310-keep-through-3rd-party-decomp.patch

- CVE-2026-19672: in tarfile, handle a member that leaves the
  destination and comes back  (bsc#1276227, gh#python/cpython#156000)
  CVE-2026-19672-tarfile-outside-dirs.patch

- CVE-2026-17084: Don't consider Unicode codepoint attributes
   outside RFC 3454 (bsc#1276226)
   CVE-2026-17084-stringprep-rfc3454.patch
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this pull request Sep 24, 2026
mcepl @bmwiedemann
Update python311 to version 3.11.16 / rev 74 via SR 1379773
bae7c00 
https://build.opensuse.org/request/show/1379773
by user mcepl + dimstar_suse
- CVE-2026-15310: bound zipfile decompression for
  bzip2/LZMA (bsc#1277111, gh#python/cpython#156002)
  CVE-2026-15310-bound-zipfile-decompression.patch

- CVE-2026-19672: in tarfile, handle a member that leaves the
  destination and comes back  (bsc#1276227, gh#python/cpython#156000)
  CVE-2026-19672-tarfile-outside-dirs.patch

CVE-2026-17084: Don't consider Unicode codepoint attributes
   outside RFC 3454 (bsc#1276226)
   CVE-2026-17084-stringprep-rfc3454.patch

- CVE-2026-15806: Scope HTTPPasswordMgr credentials by URL scheme
  (bsc#1276223)
  * Add CVE-2026-15806-HTTPPasswordMgr-scheme.patch
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@encukou encukou encukou approved these changes
@ethanfurman ethanfurman ethanfurman approved these changes

Assignees

@StanFromIreland StanFromIreland

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@StanFromIreland @encukou @ethanfurman