15-Year-Old Unpatched Python Bug Allows Code Execution in Over 350k Projects

A vulnerability discovered in the Python coding language in 2007 could be used to conduct code execution in over 350,000 projects.

Python Flaw Has Been Present for Fifteen Years

An unpatched flaw in the Python programming language now poses a serious threat to hundreds of thousands of projects. The vulnerability, known as CVE-2007-4559, was discovered fifteen years ago but was considered low risk, and therefore was not patched (though a warning was issued to developers about the flaw).

The CVE-2007-4559 flaw exists within the “extract” and “extractall” functions in Python’s tarfile module. It is a path traversal bug, which allows malicious actors to overwrite arbitrary files by uploading a malicious tarfile. This tarfile can then be executed, giving the malicious actor control of a given device.

Over 350,000 open and closed source projects spanning across a range of industries could be exploited via arbitrary path traversal using the CVE-2007-4559 vulnerability.

The Python Vulnerability Was Rediscovered in 2022

This particular Python vulnerability was rediscovered early in 2022 by Trellix vulnerability researcher Kasimir Schulz, though this was done accidentally while investigating another security issue. Schulz brought CVE-2007-4559 back into the spotlight, though it was first thought that it was an entirely new zero-day flaw. But it was soon discovered that this was, in fact, the long-standing Python flaw discovered fifteen years prior.

Trellix quickly made a tweet notifying people of the flaw and its threat to Python-based projects.

After this rediscovery, Trellix created patches for over 11,000 projects, though many more projects are thought to receive a patch in the coming weeks. Trellix has also created a free tool, called Creosote, which can be used to scan for the presence of the CVE-2007-4559 tarfile vulnerability.

CVE-2007-4559 Yet to Be Exploited

Though this Python language flaw poses a significant threat to thousands of projects, it seems to have not yet been exploited. Researchers hope that projects will be patched before malicious actors can exploit the flaw, though this may take some time, and the ease of exploitation of CVE-2007-4559 makes it a potentially huge supply chain issue.

Vulnerabilities Continue to Pose a Threat to Individuals and Organizations Alike

Security vulnerabilities are constantly being discovered by researchers and analysts, with cybercriminals eager to exploit them before they receive a patch. This will continue to be a concern across all industries, and will likely cause further issues in the future. In the case of CVE-2007-4559, Trellix is eager to provide projects with repaired code as soon as possible, so that this flaw cannot be abused by malicious actors.

News Related

OTHER NEWS

Magic Kingdom Dining: The Complete Guide

I’ll be honest – the Magic Kingdom dining situation isn’t my favorite. It’s not that the food isn’t good, it’s just that I love the dining at the other parks ... Read more »

The Three Poisons In Buddhism Explained

A row of Buddhist statues Most of us have heard of the infamous Seven Deadly Sins that, according to Catholicism, forge the pillars of all sinful behavior here on Earth ... Read more »

"I couldn’t do anything!" - Michael Jordan once named the only player he couldn't dominate

Michael Jordan loved the competition and he often dominated his rivals. But shockingly, he wasn’t able to do so against one player. Michael Jordan © RVR Photos-USA TODAY Sports View ... Read more »

Killings of 5 Men in California Are Related, Police Say

Detectives have located an unidentified "person of interest" in the killings Read more »

North Carolina man allegedly robs West Virginia Subway, assaults employees

North Carolina man allegedly robs West Virginia Subway, assaults employees SISSONVILLE, W.Va. (WOWK) — A North Carolina man was arrested on Saturday for allegedly robbing a Subway in Sissonville and ... Read more »

Instant Reaction: Rumors of Raiders Demise Greatly Exaggerated

The doom and gloom thrown out about the demise of the Las Vegas Raiders was proven greatly exaggerated today, after they beat the Denver Broncos. LAS VEGAS, Nev.–The rumors of ... Read more »

Politics of rebuilding intensify as Florida's devastation is laid bare

Political aftershocks of Hurricane Ian’s rampage through Florida are escalating over huge federal aid needed to restore devastated communities and the question of whether those most vulnerable to extreme weather ... Read more »

Cooper Rush does something no one has ever done

Cooper Rush does something no one has ever done Cowboys quarterback Cooper Rush may not create a controversy in Dallas, but he has made some history. According to he NFL, ... Read more »

Family chased by gun-wielding driver

Santa Clarita Valley Sheriff’s Station deputies detained a gun-wielding woman at approximately 11 a.m. at the Mobil gas station on the 27700 block of McBean Parkway on Sunday. The victims, ... Read more »

Tom Brady Had 6-Word Message For Patrick Mahomes After Game

Patrick Mahomes got the best of Tom Brady and the Tampa Bay Buccaneers on Sunday night. Kansas City topped Tampa Bay, 41-31, in a rematch of the 2020 season’s Super ... Read more »

On Coast Guard flight over battered SW Florida coast, massive damage is evident

A Coast Guard flight crew member looks out the window as she’s positioned to watch for any danger on a flight to Southwest Florida on Sunday, Oct. 2, 2022. From ... Read more »

Starlux Airlines To Double Capacity By Year End And Add Aircraft

Starlux Airlines To Double Capacity By Year End And Add Aircraft On Friday, shares in Taiwan’s newest international carrier, Starlux Airlines, started trading on the local stock exchange. Starlux Airlines ... Read more »

Brazil's Bolsonaro and the right outperform, defying polls

Brazil's Bolsonaro and the right outperform, defying polls Brazil’s election has provided the world yet another example of polls missing the mark, with incumbent Jair Bolsonaro considerably outperforming expectations to ... Read more »

LA Angels Beat Texas Rangers 8-3 for Seventh Straight Win

Ronald Martinez, Getty Images The Los Angeles Angels wrapped up the home portion of their seventh consecutive losing season by hitting superbly, pitching more than adequately and extending their longest ... Read more »

NBL's Adelaide 36ers Stun Suns 134-124 in Preseason Game

The 36ers shot 55.8% from 3-point range on 43 attempts Read more »

Wisconsin fires football coach Paul Chryst, names defensive coordinator Jim Leonhard interim coach

Wisconsin fires football coach Paul Chryst, names defensive coordinator Jim Leonhard interim coach Wisconsin fired football coach Paul Chryst on Sunday after the team's 2-3 start. Athletic director Chris McIntosh ... Read more »

The Best Food in Portugal To Try

Portugal, which has always seemed to be an underrated vacation spot for Americans, is certainly having a moment. With many more US citizens visiting this Mediterranean country, the food of ... Read more »

QB Aaron Rodgers after Green Bay Packers' OT escape vs. New England Patriots: 'This way of winning, I don't think, is sustainable'

QB Aaron Rodgers after Green Bay Packers' OT escape vs. New England Patriots: 'This way of winning, I don't think, is sustainable' GREEN BAY, Wis. — Aaron Rodgers didn't figure ... Read more »

Atlanta Braves complete sweep of New York Mets, move closer to another National League East title

Atlanta Braves complete sweep of New York Mets, move closer to another National League East title ATLANTA — Dansby Swanson and Matt Olson homered for the third straight game, Travis ... Read more »

UPDATE 1-Trump staffers not returning White House records, National Archives says

(Adds statement from Oversight Committee chairwoman) By Doina Chiacu WASHINGTON, Oct 2 (Reuters) – Former President Donald Trump’s administration has not turned over all presidential records and the National Archives ... Read more »

Amazon Prime Day Sneak Peek: The Best of Amazon Prime Day

The Amazon recently announced on June 25th that the fifth annual Amazon Prime Day will be on July 15 and 16. On the same day, I had the honor of ... Read more »

6 Ways the iPhone Is Still Years Behind Android

6 Ways the iPhone Is Still Years Behind Android Every time Apple releases a new iPhone, the company does its best to market it as the most advanced smartphone ever. ... Read more »

Opening Arguments Monday, Oath Keepers Leader to Stand Trial for Seditious Conspiracy

Susan Walsh/AP (File) Opening arguments begin Monday in the trial of Stewart Rhodes, founder of the Oath Keepers extremist group. Rhodes is expected to take the stand in his own ... Read more »

Suspect dead following home invasion in Illinois

Suspect dead following home invasion in Illinois ONARGA, Ill. (WCIA) — The Iroquois County Sheriff’s office responded to a reported home invasion on Saturday evening. Upon their arrival on scene ... Read more »

Vistara Launches Live TV On Its Boeing 787 Dreamliners

Vistara Launches Live TV On Its Boeing 787 Dreamliners Boeing Stock Code: BA Date Founded: 1916-07-15 CEO: Dave Calhoun Headquarters Location: Chicago, USA Key Product Lines: Boeing 737, Boeing 747, ... Read more »

European Stocks Set to Slump at the Open, Following Gloomy Sentiment in Asia-Pacific

This is CNBC’s live blog covering European markets. European stocks are heading for a lower open on Monday as markets enter the last quarter of the year. The U.K.’s FTSE ... Read more »

Look: Ohio State Football Trolls Rutgers With Postgame Announcement

ANN ARBOR, MICHIGAN – NOVEMBER 27: Head coach Ryan Day of the Ohio State Buckeyes looks on during warm-ups prior to the game against the Michigan Wolverines at Michigan Stadium ... Read more »

Florida man survives Hurricane Ian by floating on a sofa for two-and-a-half hours

Hurricane Ian has been described as one of the largest natural disasters to ever hit Florida, with its winds and coastal surges terrorising millions of people. Read more »

How long could Dolphins’ Tua Tagovailoa remain out in NFL’s concussion protocol?

Miami Dolphins quarterback Tua Tagovailoa hits the ground after a sack by Cincinnati Bengals’ Josh Tupou during the second quarter on Thursday, Sept. 29, 2022, in Cincinnati. Miami Dolphins coach ... Read more »

Men Allegedly Kill 6-Year-Old Boy in 'Human Sacrifice' for 'Prosperity'

In this image, police tape is seen in York, England on April 22, 2015. Two men allegedly killed a 6-year-old boy in South Delhi, India Saturday night as part of ... Read more »

Buccaneers QB Tom Brady suffers arm injury on strip sack

Tampa Bay Buccaneers quarterback Tom Brady (12) reacts after he was sacked and fumbled the ball against the Kansas City Chiefs during the first half at Raymond James Stadium. Tom ... Read more »

Hurricane Orlene roars toward Mexico's Pacific coast

Hurricane Orlene roars toward Mexico's Pacific coast Hurricane Orlene is heading toward Mexico’s Pacific coast between the tourist towns of Mazatlan and San Blas, with authorities there suspending classes and ... Read more »

If Amtrak’s Gulf Coast expansion goes through, taxpayers will be on the hook

If Amtrak’s Gulf Coast expansion goes through, taxpayers will be on the hook When Congress consolidated passenger rail into a single carrier in 1970, it is unclear if it knew ... Read more »

Critical Missing Alert Discontinued for Missing Woman

Dallas Police Department A “Critical Missing” Alert has been discontinued for a woman who was last seen in the 800 block of W. 10th Street on Saturday, according to police. ... Read more »

How is Laenor still alive? 'House of the Dragon' Episode 7 ending explained

How is Laenor still alive? ‘House of the Dragon’ Episode 7 ending explained House of the Dragon has a habit of ending each episode with an important character dead. Episode ... Read more »

New Yorkers on edge after series of violent, unprovoked attacks

They are the buzzwords of New York City crime circa 2022: Random and unprovoked. A chilling spate of recent incidents involving innocent victims runs the gamut from a woman savagely ... Read more »

Bayern Munich Legends team welcomes Stefan Effenberg, extends partnership with Paulaner

What every Bayern Munich team has in common is quality squad members — regardless of whether it is the men’s first team or second team or the women’s first team ... Read more »

Woman secretly led deputies to her alleged kidnapper, sheriff says

Woman secretly led deputies to her alleged kidnapper, sheriff says PORTLAND, Ore. (KOIN) — An Oregon woman called 911 and secretly led law enforcement to her location, as well as ... Read more »

Woman accused of killing infant by co-sleeping, wanted by police

Brooke Hunter was indicted on counts of involuntary manslaughter and endangering children, according to Hamilton Court Records. (Photo is prior arrest) CINCINNATI (WXIX) – A woman facing charges in connection ... Read more »

Tragedy strikes as fan dies at Jets-Steelers game

10/2/22 A fan who watched Sunday’s Week 4 showdown between the New York Jets and Pittsburgh Steelers died from a fall in the Acrisure Stadium. According to the report from ... Read more »
Breaking thailand news, thai news, thailand news Verified News Story Network