CVE-2025-8869

{"id": "CVE-2025-8869", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8869", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-16T19:47:29.080800Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@python.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@python.org", "affectedData": [{"repo": "https://github.com/pypa/pip", "vendor": "Python Packaging Authority", "product": "pip", "versions": [{"status": "affected", "version": "0", "lessThan": "25.3", "versionType": "python"}], "packageName": "pip", "collectionURL": "https://pypi.org/project/pip", "defaultStatus": "unaffected"}]}], "published": "2025-09-24T15:15:41.293", "references": [{"url": "https://github.com/pypa/pip/pull/13550", "source": "cna@python.org"}, {"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IF5A3GCJY3VH7BVHJKOWOJFKTW7VFQEN/", "source": "cna@python.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.\nNote that upgrading pip to a \"fixed\" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.\n\nNote that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706\nand therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706\nthen pip doesn't use the \"vulnerable\" fallback code.\n\nMitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12),\napplying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice."}, {"lang": "es", "value": "Al extraer un archivo tar, pip podr\u00eda no verificar que los enlaces simb\u00f3licos apunten al directorio de extracci\u00f3n si el m\u00f3dulo tarfile no implementa PEP 706.\nTenga en cuenta que actualizar pip a una versi\u00f3n \u201ccorregida\u201d para esta vulnerabilidad no corrige todas las vulnerabilidades conocidas que se remedian usando una versi\u00f3n de Python que implementa PEP 706.\n\nTenga en cuenta que esta es una vulnerabilidad en la implementaci\u00f3n de reserva de pip para la extracci\u00f3n de tar para versiones de Python que no implementan PEP 706 y, por lo tanto, no son seguras frente a todas las vulnerabilidades en el m\u00f3dulo 'tarfile' de Python. Si est\u00e1 utilizando una versi\u00f3n de Python que implementa PEP 706, entonces pip no utiliza el c\u00f3digo de reserva \u201cvulnerable\u201d.\n\nLas mitigaciones incluyen actualizar a una versi\u00f3n de pip que incluya la correcci\u00f3n, actualizar a una versi\u00f3n de Python que implemente PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, o >=3.12), aplicar el parche vinculado, o inspeccionar las distribuciones de origen (sdists) antes de la instalaci\u00f3n, como ya es una buena pr\u00e1ctica."}], "lastModified": "2026-09-26T00:10:00.127", "sourceIdentifier": "cna@python.org"}