CVE-2019-20907
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks…
Published Jul 13, 2020 · updated Oct 14, 2026 · python python
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
Timeline
Detection, updates, and resolution for this record.
Jul 13, 2020 · NIST NVD
Detected
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
Oct 14, 2026 · NIST NVD
Updated
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
Affected
- cpe canonical/ubuntu linux12.04
- cpe debian/debian linux9.0
- cpe fedoraproject/fedora31
- cpe netapp/active iq unified managerversion unspecified
- cpe opensuse/leap15.1
- cpe opensuse/leap15.2
- cpe oracle/zfs storage appliance kit8.8
- cpe python/pythonversion unspecified
Sources
- CVE.orgCVE-2019-20907
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-20907
30-day exploitation probability 3.0%
first.org - NIST NVDCVE-2019-20907
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
nvd.nist.gov