Hpe Nonstop Python 3 X
Monthly
Arbitrary file overwrite in HPE NonStop Python 3.x lets an attacker who supplies a crafted TAR archive escape the intended extraction directory via .. (dot-dot) sequences in member filenames and clobber files on the NonStop host, with the overwritten data potentially leading to code execution or system compromise depending on the privileges of the extracting process. The vendor rates this 8.0 (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment scores it lower at CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, treating it as local rather than adjacent-vector and integrity/availability-only; unauthenticated access is implied by PR:N in both vectors, but successful exploitation is not automatic - it requires the victim to extract an attacker-controlled archive (UI:R), and the write primitive is bounded by the privileges of the extracting account. No public exploit code was identified at time of analysis, there is no CISA KEV entry, and no EPSS score was supplied, so real-world risk is moderated by the mandatory user interaction rather than by the headline score.
Arbitrary file overwrite in HPE NonStop Python 3.x lets an attacker who supplies a crafted TAR archive escape the intended extraction directory via .. (dot-dot) sequences in member filenames and clobber files on the NonStop host, with the overwritten data potentially leading to code execution or system compromise depending on the privileges of the extracting process. The vendor rates this 8.0 (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment scores it lower at CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, treating it as local rather than adjacent-vector and integrity/availability-only; unauthenticated access is implied by PR:N in both vectors, but successful exploitation is not automatic - it requires the victim to extract an attacker-controlled archive (UI:R), and the write primitive is bounded by the privileges of the extracting account. No public exploit code was identified at time of analysis, there is no CISA KEV entry, and no EPSS score was supplied, so real-world risk is moderated by the mandatory user interaction rather than by the headline score.