The vulnerability in Python's tarfile module involves incorrect normalization of AREGTYPE blocks to DIRTYPE during processing of multi-block members like GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This can cause the tarfile module to misinterpret crafted tar archives compared to other implementations, potentially resulting in unexpected file system changes or minor data integrity issues. The flaw requires local attacker privileges and high attack complexity, with no confidentiality or availability impact. Red Hat has issued security advisories and updated python3.12 RPM packages to address this issue. The recommended mitigation is to avoid using the tarfile module on untrusted archives or to use system tar utilities. Python 3.12+ users can apply strict extraction filters via tarfile.data_filter.

The vulnerability allows a local attacker to craft malicious tar archives that the tarfile module may misinterpret, leading to minor data integrity issues or unexpected file system changes under specific conditions. The CVSS score is low (2.5), reflecting low impact with no confidentiality or availability loss. There are no known exploits in the wild. The attack complexity is high and requires local privileges.

Red Hat has released updated python3.12 packages (e.g., python3.12-3.12.13-3.1.hum1) that fix this vulnerability. Users should apply these updates to remediate the issue. If processing untrusted tar archives is necessary, avoid using Python's tarfile module directly; instead, delegate extraction to the system-level tar utility via subprocess. For Python 3.12 or newer, enforce strict extraction filters using tarfile.data_filter to secure extraction behavior. No other specific mitigations are indicated by the vendor advisory.