While discussing the issue on the Python bug tracker, developers have once again concluded that CVE-2007-4559 is not a bug: "tarfile.py does nothing wrong," the developers said, and there is "no ...

Unpatched since 2007 The vulnerability is in the Python tarfile package, in code that uses un-sanitized tarfile.extract () function or the built-in defaults of tarfile.extractall ().