Red Hat issued a security update for the python39:3.9 module in Red Hat Enterprise Linux 8 to fix two vulnerabilities: CVE-2025-47273, a path traversal vulnerability in the setuptools PackageIndex, and CVE-2025-8194, an infinite loop vulnerability in CPython when parsing tarfiles. These vulnerabilities could potentially be exploited to cause unintended file access or denial of service via infinite loops. The advisory includes updated packages that address these issues. The vulnerabilities are categorized under CWE-22 (Path Traversal) and CWE-835 (Loop with Unreachable Exit Condition).

The path traversal vulnerability (CVE-2025-47273) in setuptools could allow an attacker to access or overwrite files outside the intended directory structure. The infinite loop vulnerability (CVE-2025-8194) in CPython could cause a denial of service by causing the Python interpreter to hang when parsing a specially crafted tarfile. Both issues have a moderate security impact as rated by Red Hat. There are no reports of exploitation in the wild.

Red Hat has released updated python39 packages for Red Hat Enterprise Linux 8 that fix these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2025:14900 and the referenced article https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires applying the vendor-provided patches. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.