.jpg)
.jpg)
.jpg)
As many as 350,000 open source projects are believed to be potentially vulnerable to exploitation as a result of a security flaw in a Python module that has remained unpatched for 15 years.
The open source repositories span a number of industry verticals, such as software development, artificial intelligence/machine learning, web development, media, security, IT management.
The shortcoming, tracked as CVE-2007-4559 (CVSS score: 6.8), is rooted in the tarfile module, successful exploitation of which could lead to code execution from an arbitrary file write.
“The vulnerability is a path traversal attack in the extract and extractall functions in the tarfile module that allow an attacker to overwrite arbitrary files by adding the ‘..’ sequence to filenames in a TAR archive,” Trellix security researcher Kasimir Schulz said in a writeup.
Originally disclosed in August 2007, the bug has to do with how a specially crafted tar archive can be leveraged to overwrite arbitrary files on a target machine simply upon opening the file.
Put simply, a threat actor can exploit the weakness by uploading a malicious tarfile in a manner that makes it possible to escape the directory that a file is intended to be extracted to and achieve code execution, allowing the adversary to potentially seize control of a target device.
“Never extract archives from untrusted sources without prior inspection,” the Python documentation for tarfile reads. “It is possible that files are created outside of path, e.g. members that have absolute filenames starting with ‘/’ or filenames with two dots ‘..’.”
The vulnerability is also reminiscent of a recently disclosed vulnerability in RARlab’s UnRAR utility (CVE-2022-30333) that could lead to remote code execution.
Trellix has further released a custom utility called Creosote to scan for projects vulnerable to CVE-2007-4559, using it to uncover the vulnerability in the Spyder Python IDE as well as Polemarch.
“Left unchecked, this vulnerability has been unintentionally added to hundreds of thousands of open- and closed-source projects worldwide, creating a substantial software supply chain attack surface,” Douglas McKee noted.
Unique Visitors
[url=http://baclofen.sbs/]baclofen prescription cost[/url]
[url=http://hydroxychloroquine.stream/]plaquenil 200[/url]
[url=https://augmentin.fun/]augmentin 675 price[/url]
[url=https://prazosin.shop/]prazosin bph[/url]
[url=https://cheapviagratabsrx.quest/]order viagra from uk[/url]
[url=https://cheapcialis5cost.quest/]canada drug pharmacy cialis[/url] [url=https://tizanidine.company/]generic zanaflex[/url] [url=https://lasixfurosemide.online/]lasix over the counter canada[/url] [url=https://onlineviagratabletswithoutprescription.quest/]buy sildenafil online safely[/url] [url=https://onlineviagra50mgwithoutrx.monster/]viagra 100 mg tablet buy online[/url]
[url=https://lisinopril.trade/]lisinopril cost us[/url]
[url=http://cialispillforsale.monster/]purchase cialis online australia[/url]
[url=https://cheapviagra200mgprice.quest/]viagra generic australia[/url] [url=https://genericcialis5mgwithoutrx.monster/]can i buy cialis over the counter in canada[/url] [url=https://viagrawpill.com/]viagra 150mg[/url] [url=https://orderivermectin.online/]where to buy ivermectin[/url] [url=https://tadalafil.sbs/]cheap cialis from canada[/url]
[url=http://lexapro.run/]price of lexapro[/url]
[url=http://cheapviagra50mgtablet.quest/]viagra for sale[/url]
[url=http://viagracheappillonlinedrugstore.monster/]how to get real viagra[/url]
[url=http://vardenafil.autos/]levitra cialis[/url] [url=http://cheapcialis20withnoprescription.quest/]tadalafil 5mg prices[/url] [url=http://ordertrazodone.online/]trazodone 50 mg capsules[/url] [url=http://bestcialispillswithoutprescription.monster/]how much is daily cialis[/url]
[url=https://lasixfurosemide.online/]lasix vs furosemide[/url]
[url=https://buyingcheapviagrapillsonline.quest/]how to buy viagra online in india[/url] [url=https://cialisbestpillsforsale.quest/]cialis online prescription order[/url]
[url=https://bestcialistabletswithnoprescription.monster/]cialis tablets australia[/url]
[url=http://viagra200tab.monster/]generic viagra 25mg[/url]
[url=https://cheapcialis5cost.quest/]tadalafil prescription us[/url]
[url=https://tretinoin.best/]tretinoin prescription online[/url]
[url=http://buyviagramedstore.monster/]viagra online purchase canada[/url]
[url=https://viagragenerictabspharmacy.quest/]buy viagra online india 100mg[/url]
[url=http://onlinepharmacy.wiki/]canadian online pharmacy no prescription[/url]
[url=https://orderviagra150mgnorx.monster/]viagra uk otc[/url]
[url=http://zanaflex.guru/]zanaflex 2mg capsules[/url]
[url=http://cheapviagra200mgprice.quest/]sildenafil singapore[/url]
[url=http://bestviagrabuyonline.quest/]viagra 1 tablet price[/url] [url=http://anafranil.cfd/]anafranil medicine[/url] [url=http://cheapviagra50mgtablet.quest/]price of sildenafil[/url] [url=http://cytotec.sbs/]buy cytotec online with paypal[/url] [url=http://bestcialistabletswithnoprescription.monster/]cialis usa online[/url] [url=http://prednisolone.sbs/]how to get prednisolone tablets[/url]
[url=https://cheapviagratabsrx.quest/]buy online viagra in usa[/url]
[url=https://onlineviagra200pills.quest/]men viagra[/url]
[url=http://paxil.wtf/]order paxil online[/url]
[url=https://orderhydroxychloroquine.online/]plaquenil[/url] [url=https://genericviagratabwithnoprescription.quest/]viagra pills price in india[/url] [url=https://onlineviagra50mgtablets.quest/]buy viagra online nz[/url] [url=https://azithromycin.tech/]azithromycin tablet price[/url] [url=https://valacyclovir.cfd/]valtrex otc[/url]
[url=http://bestcialistabletswithnoprescription.monster/]canadian cialis pills[/url]
[url=https://advair.works/]advair prescription coupon[/url]
[url=http://trazodone.xyz/]trazadone[/url]
[url=https://viagracheappillonlinedrugstore.monster/]cheap viagra india[/url] [url=https://anafranil.cfd/]anafranil capsules[/url]
[url=http://ordercialis40noprescription.quest/]how can i get cheap cialis[/url]
[url=https://baclofen.sbs/]baclofen brand name in usa[/url]
[url=https://lisinopril.trade/]lisinopril from canada[/url]
[url=http://paxil.wtf/]buy generic paroxetine online[/url]
[url=http://xenical.monster/]generic xenical canada[/url]
[url=http://orderviagra150mgnorx.monster/]how to buy real viagra[/url]
[url=https://cheapcialis10mgtab.quest/]cialis for sale in usa[/url] [url=https://accutane.africa/]best accutane[/url] [url=https://diflucan.click/]purchase diflucan online[/url] [url=https://orderviagrapillsnoprescription.quest/]sildenafil 20 mg[/url] [url=https://clomid.makeup/]clomid in india[/url]
[url=https://onlineviagra200pills.quest/]cheap viagra in united states[/url] [url=https://prednisolone.sbs/]prednisolone 2.5 mg tablets[/url] [url=https://propecia.network/]finasteride online bonus[/url] [url=https://lisinopril.trade/]medication lisinopril 20 mg[/url] [url=https://bestviagra100mglowcost.quest/]sildenafil citrate 50mg[/url] [url=https://viagraonlinetabletonlinepharmacy.quest/]soft tabs viagra[/url] [url=https://vardenafil.autos/]levitra cheapest price[/url]
[url=http://sildenafiltab.online/]sildenafil 20 mg buy online[/url] [url=http://prednisolone.sbs/]buy predislone tablets[/url] [url=http://ordercialis40mgbestprice.monster/]buy cialis in uk[/url] [url=http://clomid.makeup/]cheap clomid tablets uk[/url] [url=http://buybestviagratabletsonline.quest/]viagra online pharmacy usa[/url] [url=http://ivermectin.hair/]ivermectin 6mg dosage[/url] [url=http://paxil.wtf/]paroxetine no prescription[/url]
[url=https://azithromycin.tech/]zithromax cost pharmacy[/url]
[url=https://propecia.network/]propecia 5mg pills[/url]
[url=https://viagracheappillonlinedrugstore.monster/]brand viagra online pharmacy[/url]
[url=https://vardenafil.business/]vardenafil purchase[/url]
[url=http://xenical.monster/]orlistat online purchase india[/url]
[url=https://xenical.monster/]xenical by roche[/url] [url=https://acyclovir.sale/]acyclovir 100 mg[/url] [url=https://lisinoprila.online/]ordering lisinopril without a prescription uk[/url] [url=https://viagrawpill.com/]viagra on line[/url]
[url=https://viagrawpill.com/]viagra pills cost in india[/url]
[url=https://tadalafil.sbs/]5mg cialis best price[/url] [url=https://buycialis5tablet.quest/]cialis gel online[/url] [url=https://cafergot.site/]cafergot online[/url] [url=https://pharmacyonline.sbs/]india pharmacy mail order[/url] [url=https://acyclovir.sale/]acyclovir 123[/url]
[url=https://buyviagramedstore.monster/]viagra rx coupon[/url] [url=https://lisinopril.trade/]zestoretic 20[/url] [url=https://bestcialistabletswithnoprescription.monster/]cheapest tadalafil us[/url] [url=https://retina.monster/]tretinoin from india[/url] [url=https://finasterida.online/]propecia 2019[/url] [url=https://sildenafiltab.online/]sildenafil online australia[/url]
[url=http://levitragenuine.com/]order levitra online in usa[/url]
[url=http://buyviagramedstore.monster/]cost viagra canada[/url]
[url=http://propecia.tech/]where can i buy propecia uk[/url]
[url=https://colchicine.company/]colchicine prescription uk[/url]
[url=https://azithromycin.wiki/]zithromax without a script[/url] [url=https://tetracycline.run/]sumycin[/url] [url=https://azithromycin.tech/]azithromycin 600 mg tab[/url] [url=https://retina.monster/]retin a canada pharmacy[/url] [url=https://lisinopril.trade/]lisinopril 420[/url] [url=https://bestcialistabletswithnoprescription.monster/]can i buy tadalafil in canada[/url] [url=https://cheapviagra50mgtablet.quest/]female viagra 50 mg[/url]
[url=https://cialistabsshop.quest/]purchase tadalafil[/url]
[url=https://sildallis.com/]sildalis cheap[/url]
[url=http://propecia.tech/]finasteride 1mg over the counter[/url]
[url=https://cafergot.site/]buy cafergot[/url] [url=https://orderfinasteride.online/]buy generic propecia online canada[/url] [url=https://orderaugmentin.online/]amoxicillin online no prescription[/url] [url=https://pharmacyonline.sbs/]canadian pharmacy 1 internet online drugstore[/url]
[url=https://onlineviagra50mgwithoutrx.monster/]viagra in women[/url]
[url=https://ordercialis40mgbestprice.monster/]tadalafil daily[/url]
[url=http://onlineviagra50mgtablets.quest/]best rx prices for sildenafil[/url]
[url=http://onlinepharmacy.wiki/]pharmacy wholesalers canada[/url]
[url=http://orderhydroxychloroquine.online/]hydroxychloroquine 900 mg[/url]
[url=https://azithromycin.boutique/]azithromycin 500 mg tablet[/url]
[url=http://cytotec.sbs/]how much is misoprostol[/url]
[url=http://onlinepharmacy.wiki/]online pharmacy without prescription[/url]
[url=https://neurontin.digital/]gabapentin brand name australia[/url] [url=https://zithromaxa.com/]zithromax online prescription[/url] [url=https://vermoxtabs.com/]vermox price in india[/url] [url=https://motilium.cfd/]motilium tablets uk[/url] [url=https://acyclovir.company/]acyclovir over the counter singapore[/url] [url=https://hydroxyzine.store/]atarax over the counter canada[/url]
[url=http://viagraonlinetabletonlinepharmacy.quest/]cheap sildenafil 20mg[/url] [url=http://azithromycin.wiki/]brand name azithromycin[/url] [url=http://viagracheappillonlinedrugstore.monster/]can i buy viagra over the counter canada[/url] [url=http://paxil.wtf/]order paroxetine online[/url] [url=http://propecia.tech/]finpecia 1 mg[/url] [url=http://ampicillin.agency/]ampicillin 15[/url]
[url=http://stromectol.sbs/]stromectol medication[/url] [url=http://furosemide.agency/]lasix 80 mg[/url] [url=http://cheapcialis20withnoprescription.quest/]tadalafil tablets 20 mg[/url] [url=http://ordertrazodone.online/]trazodone cost uk[/url] [url=http://prednisolone.sbs/]prednisolone 6131463705[/url] [url=http://viagraonlinemedicationdrugstore.monster/]viagra online usa[/url]
[url=https://acyclovir.sale/]zovirax cold sore[/url] [url=https://azithromycin.pics/]zithromax 25mg[/url] [url=https://orderivermectin.online/]where can i buy oral ivermectin[/url] [url=https://viagragenerictabspharmacy.quest/]real viagra without a prescription[/url]
[url=https://orderfinasteride.online/]finasteride buy[/url]
[url=http://viagraonlinetabletonlinepharmacy.quest/]prices for viagra prescription[/url]
[url=https://cialis5withoutrx.quest/]cialis 20mg india[/url]
[url=http://onlineviagra50mgtablets.quest/]order viagra india[/url]
[url=https://viagraonlinetabletonlinepharmacy.quest/]viagra soft generic[/url]