There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1

ubuntu_linux USN-7710-1: Ubuntu 14.04 LTS / Ubuntu 16.04 LTS / Ubuntu 18.04 LTS / Ubuntu 20.04 LTS / Ubuntu 22.04 LTS / Ubuntu 24.04 LTS / Ubuntu 25.04 : Python vulnerabilities (USN-7710-1)

suse_linux SUSE-SU-2025:02778-1: SUSE SLED15 / SLES15 / openSUSE 15 : Security update for python3 (Important) (SUSE-SU-2025:02778-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02948-1 advisory.

    - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-8f560fcc9b advisory.

    Security fix for CVE-2025-8194

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-1903cfae97 advisory.

    Security fix for CVE-2025-8194

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2962 advisory.

    There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration     APIs. The tar implementation would process tar archives with negative offsets without error, resulting in     an infinite loop and deadlock during the parsing of maliciously crafted tar archives.

    This vulnerability can be mitigated by including the following patch after importing the tarfile module:
    https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 (CVE-2025-8194)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2961 advisory.

    There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration     APIs. The tar implementation would process tar archives with negative offsets without error, resulting in     an infinite loop and deadlock during the parsing of maliciously crafted tar archives.

    This vulnerability can be mitigated by including the following patch after importing the tarfile module:
    https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 (CVE-2025-8194)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1135 advisory.

    There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration     APIs. The tar implementation would process tar archives with negative offsets without error, resulting in     an infinite loop and deadlock during the parsing of maliciously crafted tar archives.

    This vulnerability can be mitigated by including the following patch after importing the tarfile module:
    https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 (CVE-2025-8194)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1147 advisory.

    There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration     APIs. The tar implementation would process tar archives with negative offsets without error, resulting in     an infinite loop and deadlock during the parsing of maliciously crafted tar archives.

    This vulnerability can be mitigated by including the following patch after importing the tarfile module:
    https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 (CVE-2025-8194)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1136 advisory.

    There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration     APIs. The tar implementation would process tar archives with negative offsets without error, resulting in     an infinite loop and deadlock during the parsing of maliciously crafted tar archives.

    This vulnerability can be mitigated by including the following patch after importing the tarfile module:
    https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 (CVE-2025-8194)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1146 advisory.

    There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration     APIs. The tar implementation would process tar archives with negative offsets without error, resulting in     an infinite loop and deadlock during the parsing of maliciously crafted tar archives.

    This vulnerability can be mitigated by including the following patch after importing the tarfile module:
    https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 (CVE-2025-8194)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration     APIs. The tar implementation would process tar archives with negative offsets without error, resulting in     an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability     can be mitigated by including the following patch after importing the tarfile module:
    https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 (CVE-2025-8194)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02802-1 advisory.

    - CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705)
    - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249)

    Other fixes:
    - Limit buffer size for IPv6 address parsing (bsc#1244401).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-1a9ad70c05 advisory.

    3.13.6 is the sixth maintenance release of 3.13, containing around 200 bugfixes, build improvements and     documentation changes since 3.13.5.

    ----

    This update contains fix for https://www.cve.org/CVERecord?id=CVE-2025-8194

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02767-1 advisory.

    - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).
    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).
    - CVE-2025-4435: Fixed Tarfile extracting filtered members when errorlevel=0 (bsc#1244061).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2e992ddfa0 advisory.

    Backport fix for CVE-2025-8194.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-64abf2ff21 advisory.

    Backport fix for CVE-2025-8194.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02717-1 advisory.

    - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).
    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).
    - CVE-2025-4435: Fixed Tarfile extracting filtered members when errorlevel=0 (bsc#1244061).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02700-1 advisory.

    - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02701-1 advisory.

    - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
253636	openSUSE 15 Security Update : python310 (SUSE-SU-2025:02948-1)	Nessus	SuSE Local Security Checks	high
253434	Fedora 41 : python3.6 (2025-8f560fcc9b)	Nessus	Fedora Local Security Checks	high
253067	Fedora 42 : python3.6 (2025-1903cfae97)	Nessus	Fedora Local Security Checks	high
252308	Amazon Linux 2 : python3 (ALAS-2025-2962)	Nessus	Amazon Linux Local Security Checks	high
252307	Amazon Linux 2 : python (ALAS-2025-2961)	Nessus	Amazon Linux Local Security Checks	high
251382	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-1135)	Nessus	Amazon Linux Local Security Checks	high
251379	Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2025-1147)	Nessus	Amazon Linux Local Security Checks	high
251373	Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2025-1136)	Nessus	Amazon Linux Local Security Checks	high
251371	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2025-1146)	Nessus	Amazon Linux Local Security Checks	high
251334	Linux Distros Unpatched Vulnerability : CVE-2025-8194	Nessus	Misc.	high
250268	SUSE SLES12 Security Update : python3 (SUSE-SU-2025:02802-1)	Nessus	SuSE Local Security Checks	medium
249265	Fedora 42 : python3-docs / python3.13 (2025-1a9ad70c05)	Nessus	Fedora Local Security Checks	high
249226	SUSE SLED15 / SLES15 Security Update : python313 (SUSE-SU-2025:02767-1)	Nessus	SuSE Local Security Checks	high
248482	Fedora 42 : mingw-python3 (2025-2e992ddfa0)	Nessus	Fedora Local Security Checks	high
248481	Fedora 41 : mingw-python3 (2025-64abf2ff21)	Nessus	Fedora Local Security Checks	high
244839	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python311 (SUSE-SU-2025:02717-1)	Nessus	SuSE Local Security Checks	high
243944	openSUSE 15 Security Update : python39 (SUSE-SU-2025:02700-1)	Nessus	SuSE Local Security Checks	high
243943	SUSE SLES15 / openSUSE 15 Security Update : python (SUSE-SU-2025:02701-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2025-8194

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

high

high

high