Amazon Linux 2023 Security Advisory: ALAS2023-2025-1146
Advisory Released Date: 2025-08-18
Advisory Updated Date: 2025-08-18
Severity:
Important
Issue Overview:
There is a defect in the CPython "tarfile" module affecting the "TarFile" extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives.
This vulnerability can be mitigated by including the following patch after importing the "tarfile" module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 (CVE-2025-8194)
Affected Packages:
python3.9
Issue Correction:
Run dnf update python3.9 --releasever 2023.8.20250818 or dnf update --advisory ALAS2023-2025-1146 --releasever 2023.8.20250818 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
python3-3.9.23-1.amzn2023.0.3.aarch64
python3.9-debugsource-3.9.23-1.amzn2023.0.3.aarch64
python3-devel-3.9.23-1.amzn2023.0.3.aarch64
python3-tkinter-3.9.23-1.amzn2023.0.3.aarch64
python3-idle-3.9.23-1.amzn2023.0.3.aarch64
python3-debug-3.9.23-1.amzn2023.0.3.aarch64
python3.9-debuginfo-3.9.23-1.amzn2023.0.3.aarch64
python3-libs-3.9.23-1.amzn2023.0.3.aarch64
python3-test-3.9.23-1.amzn2023.0.3.aarch64
noarch:
python-unversioned-command-3.9.23-1.amzn2023.0.3.noarch
src:
python3.9-3.9.23-1.amzn2023.0.3.src
x86_64:
python3-3.9.23-1.amzn2023.0.3.x86_64
python3-devel-3.9.23-1.amzn2023.0.3.x86_64
python3.9-debugsource-3.9.23-1.amzn2023.0.3.x86_64
python3-idle-3.9.23-1.amzn2023.0.3.x86_64
python3-tkinter-3.9.23-1.amzn2023.0.3.x86_64
python3-debug-3.9.23-1.amzn2023.0.3.x86_64
python3.9-debuginfo-3.9.23-1.amzn2023.0.3.x86_64
python3-libs-3.9.23-1.amzn2023.0.3.x86_64
python3-test-3.9.23-1.amzn2023.0.3.x86_64