CVE-2019-20907

Q: What is the severity of CVE-2019-20907?

CVE-2019-20907 has a CVSS score of 7.5 (HIGH). This vulnerability allows an attacker to craft a malicious TAR archive that causes an infinite loop when processed by Python's tarfile module. This leads to denial of service (DoS) by consuming CPU resources indefinitely. All Python applications using tarfile.open() to process untrusted TAR archives are affected.

7.5 HIGH

Denial of Service

📋 TL;DR

This vulnerability allows an attacker to craft a malicious TAR archive that causes an infinite loop when processed by Python's tarfile module. This leads to denial of service (DoS) by consuming CPU resources indefinitely. All Python applications using tarfile.open() to process untrusted TAR archives are affected.

💻 Affected Systems

Products:

Python
Any application using Python's tarfile module

Versions: Python versions through 3.8.3

Operating Systems: All operating systems running affected Python versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects applications using tarfile.open() on untrusted TAR archives. The vulnerability is in the _proc_pax function which lacks proper header validation.

📦 What is this software?

Python by Python

Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.

Learn more about Python →

Python by Python

Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.

Learn more about Python →

Python by Python

Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.

Learn more about Python →

Python by Python

Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.

Learn more about Python →

Ubuntu Linux by Canonical

View all CVEs affecting Ubuntu Linux →

Ubuntu Linux by Canonical

View all CVEs affecting Ubuntu Linux →

Ubuntu Linux by Canonical

View all CVEs affecting Ubuntu Linux →

Ubuntu Linux by Canonical

View all CVEs affecting Ubuntu Linux →

Ubuntu Linux by Canonical

View all CVEs affecting Ubuntu Linux →

Zfs Storage Appliance Kit by Oracle

View all CVEs affecting Zfs Storage Appliance Kit →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service unavailability due to infinite CPU consumption, potentially affecting multiple processes if the malicious archive is processed in a shared environment.

🟠

Likely Case

Denial of service affecting the specific application processing the malicious TAR archive, causing service disruption.

🟢

If Mitigated

Minimal impact if proper input validation and resource limits are in place, with the process being terminated after hitting resource limits.

🌐 Internet-Facing: MEDIUM - Applications accepting TAR uploads from untrusted sources are vulnerable to DoS attacks.

🏢 Internal Only: LOW - Internal systems processing trusted TAR archives have minimal exposure.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires the attacker to provide a malicious TAR archive to a vulnerable application. The vulnerability is well-documented with proof-of-concept available.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Python 3.8.4 and later

Vendor Advisory: https://bugs.python.org/issue39017

Restart Required: Yes

Instructions:

1. Upgrade Python to version 3.8.4 or later. 2. Restart all Python applications and services. 3. Test that tarfile processing works correctly with legitimate archives.

🔧 Temporary Workarounds

Input validation wrapper

all

Implement custom validation before passing TAR archives to tarfile.open()

# Python code snippet to validate TAR headers
import tarfile
import io

def safe_tar_open(filename):
    # Add custom validation logic here
    # Consider checking file size, header structure
    # before calling tarfile.open()
    pass

Resource limiting

linux

Use resource limits or timeouts when processing TAR archives

# Use signal.alarm or threading.Timer for timeout
import signal
import tarfile

def timeout_handler(signum, frame):
    raise TimeoutError("TAR processing timeout")

signal.signal(signal.SIGALRM, timeout_handler)
signal.alarm(30)  # 30 second timeout
# Process TAR file here
signal.alarm(0)

🧯 If You Can't Patch

Implement strict input validation for TAR archives before processing
Deploy resource monitoring and automatic process termination for stuck tarfile operations

🔍 How to Verify

Check if Vulnerable:

Check Python version: python --version. If version is 3.8.3 or earlier, the system is vulnerable if using tarfile module.

Check Version:

python --version

Verify Fix Applied:

After patching, verify Python version is 3.8.4 or later and test tarfile processing with sample archives.

📡 Detection & Monitoring

Log Indicators:

High CPU usage by Python processes
Processes stuck in tarfile operations
Application timeouts when processing archives

Network Indicators:

Unusually large number of TAR file uploads
TAR files with abnormal header structures

SIEM Query:

Processes with high CPU usage AND command containing 'python' AND (command containing 'tarfile' OR 'tar')

📊 Metadata

CVE ID: CVE-2019-20907

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-835

Published: July 13, 2020

Last Updated: November 21, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Active Iq Unified Manager by Netapp

Cloud Volumes Ontap Mediator by Netapp

Debian Linux by Debian

Fedora by Fedoraproject

Fedora by Fedoraproject

Leap by Opensuse

Leap by Opensuse

Python by Python

Python by Python

Python by Python

Python by Python

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

Zfs Storage Appliance Kit by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Input validation wrapper

Resource limiting

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities