{
  "threat_severity" : "Moderate",
  "public_date" : "2025-07-28T18:42:44Z",
  "bugzilla" : {
    "description" : "cpython: Cpython infinite loop when parsing a tarfile",
    "id" : "2384043",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2384043"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-835",
  "details" : [ "There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. \nThis vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1", "A flaw was found in the Python tarfile module. Processing a specially crafted tar archive, specifically an archive with negative offsets, can cause an infinite loop and deadlock. This issue results in a denial of service in the Python application using the tarfile module." ],
  "statement" : "To exploit this issue, an attacker needs to be able to process a specially crafted tar archive with a Python application using the tarfile module. Furthermore, this vulnerability will cause a denial of service with no other security impact.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:14984",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.0",
    "package" : "python3.12-0:3.12.9-2.el10_0.3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2025-09-17T00:00:00Z",
    "advisory" : "RHSA-2025:16117",
    "cpe" : "cpe:/o:redhat:rhel_els:7",
    "package" : "python3-0:3.6.8-21.el7_9.2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-08-26T00:00:00Z",
    "advisory" : "RHSA-2025:14546",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "python3.12-0:3.12.11-2.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-08-26T00:00:00Z",
    "advisory" : "RHSA-2025:14560",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "python3-0:3.6.8-71.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-08-28T00:00:00Z",
    "advisory" : "RHSA-2025:14841",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "python3.11-0:3.11.13-2.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-08-28T00:00:00Z",
    "advisory" : "RHSA-2025:14900",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "python39:3.9-8100020250823160619.d47b87a4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-08-28T00:00:00Z",
    "advisory" : "RHSA-2025:14900",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "python39-devel:3.9-8100020250823160619.d47b87a4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-08-26T00:00:00Z",
    "advisory" : "RHSA-2025:14560",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "python3-0:3.6.8-71.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.2 Advanced Update Support",
    "release_date" : "2025-09-22T00:00:00Z",
    "advisory" : "RHSA-2025:16262",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.2",
    "package" : "python3-0:3.6.8-24.el8_2.4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2025-09-17T00:00:00Z",
    "advisory" : "RHSA-2025:16078",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "python39:3.9-8040020250909092632.63cd9eba"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2025-09-18T00:00:00Z",
    "advisory" : "RHSA-2025:16151",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "python3-0:3.6.8-39.el8_4.7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2025-09-17T00:00:00Z",
    "advisory" : "RHSA-2025:16078",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.4",
    "package" : "python39:3.9-8040020250909092632.63cd9eba"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2025-09-18T00:00:00Z",
    "advisory" : "RHSA-2025:16151",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.4",
    "package" : "python3-0:3.6.8-39.el8_4.7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2025-09-16T00:00:00Z",
    "advisory" : "RHSA-2025:15968",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "python3-0:3.6.8-47.el8_6.9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2025-09-17T00:00:00Z",
    "advisory" : "RHSA-2025:16118",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "python39:3.9-8060020250915132015.6a631399"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2025-09-16T00:00:00Z",
    "advisory" : "RHSA-2025:15968",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.6",
    "package" : "python3-0:3.6.8-47.el8_6.9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2025-09-17T00:00:00Z",
    "advisory" : "RHSA-2025:16118",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.6",
    "package" : "python39:3.9-8060020250915132015.6a631399"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2025-09-16T00:00:00Z",
    "advisory" : "RHSA-2025:15968",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.6",
    "package" : "python3-0:3.6.8-47.el8_6.9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2025-09-17T00:00:00Z",
    "advisory" : "RHSA-2025:16118",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.6",
    "package" : "python39:3.9-8060020250915132015.6a631399"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2025-09-17T00:00:00Z",
    "advisory" : "RHSA-2025:16031",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "python3.11-0:3.11.2-2.el8_8.5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2025-09-17T00:00:00Z",
    "advisory" : "RHSA-2025:16062",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "python39:3.9-8080020250908115040.93c2fc2f"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2025-09-18T00:00:00Z",
    "advisory" : "RHSA-2025:16153",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "python3-0:3.6.8-51.el8_8.11"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2025-09-17T00:00:00Z",
    "advisory" : "RHSA-2025:16031",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "python3.11-0:3.11.2-2.el8_8.5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2025-09-17T00:00:00Z",
    "advisory" : "RHSA-2025:16062",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "python39:3.9-8080020250908115040.93c2fc2f"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2025-09-18T00:00:00Z",
    "advisory" : "RHSA-2025:16153",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "python3-0:3.6.8-51.el8_8.11"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15007",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "python3.12-0:3.12.9-1.el9_6.2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15010",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "python3.11-0:3.11.11-2.el9_6.2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15019",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "python3.9-0:3.9.21-2.el9_6.2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15019",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "python3.9-0:3.9.21-2.el9_6.2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2025-09-15T00:00:00Z",
    "advisory" : "RHSA-2025:15724",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "python3.9-0:3.9.10-4.el9_0.7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2025-09-16T00:00:00Z",
    "advisory" : "RHSA-2025:16012",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "python3.11-0:3.11.2-2.el9_2.7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2025-09-18T00:00:00Z",
    "advisory" : "RHSA-2025:16152",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "python3.9-0:3.9.16-1.el9_2.10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-09-04T00:00:00Z",
    "advisory" : "RHSA-2025:15348",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "python3.12-0:3.12.1-4.el9_4.7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-09-15T00:00:00Z",
    "advisory" : "RHSA-2025:15800",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "python3.9-0:3.9.18-3.el9_4.9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-09-16T00:00:00Z",
    "advisory" : "RHSA-2025:16016",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "python3.11-0:3.11.7-1.el9_4.9"
  }, {
    "product_name" : "Red Hat Discovery 2",
    "release_date" : "2025-09-23T00:00:00Z",
    "advisory" : "RHSA-2025:16524",
    "cpe" : "cpe:/a:redhat:discovery:2::el9",
    "package" : "discovery/discovery-server-rhel9:sha256:1c67d8d526ab4f2854947f7dccd8752a2efd414c0f1cbab17706fa91147e7cda"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI 1.5",
    "release_date" : "2025-11-03T00:00:00Z",
    "advisory" : "RHSA-2025:19421",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1.5::el9",
    "package" : "rhelai1/instructlab-intel-rhel9:sha256:cf0ec4ad1520ff2ce83420846830286e036f310f880cf8a533f0966c35ebd32f"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI 1.5",
    "release_date" : "2025-11-03T00:00:00Z",
    "advisory" : "RHSA-2025:19422",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1.5::el9",
    "package" : "rhelai1/bootc-intel-rhel9:sha256:601064840ac29ea7d4a977efb506df226a2931d5079ec9f432bdf60095bf7c2e"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI 1.5",
    "release_date" : "2025-11-03T00:00:00Z",
    "advisory" : "RHSA-2025:19423",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1.5::el9",
    "package" : "rhelai1/instructlab-nvidia-rhel9:sha256:a17f53b6c19150fce3e6d456fde71a74bdab5da5eeb44bec7791084c3471a98e"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI 1.5",
    "release_date" : "2025-11-03T00:00:00Z",
    "advisory" : "RHSA-2025:19424",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1.5::el9",
    "package" : "rhelai1/bootc-azure-amd-rhel9:sha256:f77167ea53b46b91631679ed84aab2373ff56dc62cba946296be212443bc2a99"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI 1.5",
    "release_date" : "2025-11-03T00:00:00Z",
    "advisory" : "RHSA-2025:19425",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1.5::el9",
    "package" : "rhelai1/instructlab-amd-rhel9:sha256:03f22e965af16fe84aed7d30e7b8db00dead11d9fd4b11e3c9abb2e68dd910f1"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI 1.5",
    "release_date" : "2025-11-03T00:00:00Z",
    "advisory" : "RHSA-2025:19426",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1.5::el9",
    "package" : "rhelai1/bootc-gcp-nvidia-rhel9:sha256:a83229f005c78e271c774f3eda26421fedbc4b8cf1ac3fe94234899c6d677124"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI 1.5",
    "release_date" : "2025-11-03T00:00:00Z",
    "advisory" : "RHSA-2025:19427",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1.5::el9",
    "package" : "rhelai1/bootc-amd-rhel9:sha256:c029b66a3354ee6fd186a1f05aff31b5834e611b9d5b326b65b16829d6b98d1f"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI 1.5",
    "release_date" : "2025-11-03T00:00:00Z",
    "advisory" : "RHSA-2025:19428",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1.5::el9",
    "package" : "rhelai1/bootc-nvidia-rhel9:sha256:0efbdee5f2ec93477b5aac5dd4c1dd9b31fe96e5e7c7dd701738ceaa86b2f2eb"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI 1.5",
    "release_date" : "2025-11-03T00:00:00Z",
    "advisory" : "RHSA-2025:19429",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1.5::el9",
    "package" : "rhelai1/bootc-aws-nvidia-rhel9:sha256:385028a96717418982de197f8f0a9052edf12f80a50bd8ab53ca72203a4ba5d8"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI 1.5",
    "release_date" : "2025-11-03T00:00:00Z",
    "advisory" : "RHSA-2025:19430",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1.5::el9",
    "package" : "rhelai1/bootc-azure-nvidia-rhel9:sha256:427596ae2591a30a0218b7cfdd858ccad96178ddc2618cdf0a6e4e9af36685bf"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "python",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "python",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "python36:3.6/python36",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI (RHEL AI)",
    "fix_state" : "Will not fix",
    "package_name" : "rhelai1/granite-3.1-8b-lab-v2.1",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI (RHEL AI)",
    "fix_state" : "Will not fix",
    "package_name" : "rhelai1/granite-3.1-8b-starter-v2.1",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI (RHEL AI)",
    "fix_state" : "Will not fix",
    "package_name" : "rhelai1/modelcar-granite-3-1-8b-lab-v2-1",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI (RHEL AI)",
    "fix_state" : "Will not fix",
    "package_name" : "rhelai1/modelcar-granite-3-1-8b-starter-v2-1",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-8194\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-8194\nhttps://github.com/python/cpython/issues/130577\nhttps://github.com/python/cpython/pull/137027\nhttps://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/" ],
  "name" : "CVE-2025-8194",
  "mitigation" : {
    "value" : "This flaw can be mitigated by adding the following code after importing the tarfile module (\"import tarfile\"):\n~~~\nimport tarfile\ndef _block_patched(self, count):\nif count < 0:  # pragma: no cover\nraise tarfile.InvalidHeaderError(\"invalid offset\")\nreturn _block_patched._orig_block(self, count)\n_block_patched._orig_block = tarfile.TarInfo._block\ntarfile.TarInfo._block = _block_patched\n~~~",
    "lang" : "en:us"
  },
  "csaw" : false
}