CVE-2019-20907: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days.

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 20.04 only
• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 31 only; version 32 only
• Netapp Active Iq Unified Manager: from 9.5
• Netapp Cloud Volumes Ontap Mediator: affected versions not specified
• Opensuse Leap: version 15.1 only; version 15.2 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only
• Python Python: from 3.5.0, before 3.5.10 (fixed in 3.5.10); from 3.6.0, before 3.6.12 (fixed in 3.6.12); from 3.7.0, before 3.7.9 (fixed in 3.7.9); from 3.8.0, before 3.8.5 (fixed in 3.8.5)

Published 2020-07-13. Last modified 2026-10-07.