This Red Hat security advisory addresses vulnerabilities in the python3.12 RPM packages used in Red Hat Hardened Images. The primary issue, CVE-2025-4330, is a flaw in the CPython tarfile module that allows attackers to bypass extraction filters and perform symlink traversal outside the intended extraction directory. This can lead to overwriting or modifying critical system files and metadata when a malicious tar archive is extracted using TarFile.extractall() or TarFile.extract() with specific filters. Exploitation requires a privileged user or process to extract the malicious archive, which reduces the risk. The advisory also addresses CVE-2026-11940 and CVE-2026-15308. Red Hat provides updated python3.12 RPM packages for aarch64 and x86_64 architectures to remediate these issues. The advisory notes no known exploits in the wild and no available mitigations that meet Red Hat's criteria. The severity is classified as high.

Successful exploitation of CVE-2025-4330 could allow an attacker to overwrite or modify critical system files and metadata by bypassing extraction filters in the tarfile module. This may lead to unauthorized code execution, integrity compromise, and potential confidentiality breaches if sensitive files are read or modified. However, exploitation requires a privileged user or process to extract a malicious tar archive, limiting the attack vector. No known exploits in the wild have been reported. The overall impact is high due to the potential for system file modification and code execution.

A security update is available from Red Hat that includes patched python3.12 RPM packages addressing these vulnerabilities. Users should apply the updated packages (e.g., python3.12-3.12.13-3.5.hum1) from the Red Hat Hardened Images repository. No alternative mitigations meeting Red Hat's criteria are currently available. Since exploitation requires privileged user action to extract malicious archives, cautious handling of tar files and limiting extraction of untrusted archives can reduce risk. Refer to the official Red Hat advisory (RHSA-2026:38017) for update instructions.