7.5

CVE-2019-20907: canonical ubuntu_linux Loop with Unreachable Exit Condition

Modified
AliasesALPINE-CVE-2019-20907SUSE-SU-2020:2275-1SUSE-SU-2020:2276-1
Published 13-07-2020Last modified 14-10-2026

Vulnerability summary

CVE-2019-20907 is a high (CVSS 7.5) Loop with Unreachable Exit Condition vulnerability in canonical ubuntu_linux. EPSS estimates a 2.96% chance of exploitation in the next 30 days, higher than 87.2% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
2.96%
0%100%
Low · -3.30 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 33 · Related 22
DLA-2337-1DLA-2456-1DLA-3432-1MGASA-2020-0451OPENSUSE-SU-2020:2332-1OPENSUSE-SU-2020:2333-1

Timeline

  1. 13-07-2020
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

2.96%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

Decrease -3.30 pp

From 6.25% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse24 products
  • python-base&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 2.7.17-7.41.1
  • python-base&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 2.7.17-7.41.1
  • python-base&distro=SUSE Linux Enterprise Module for Python 2 15 SP1< 2.7.17-7.41.1
  • python-base&distro=SUSE Linux Enterprise Module for Python 2 15 SP2< 2.7.17-7.41.1
  • python-base&distro=SUSE Linux Enterprise Server 12 SP5< 2.7.17-28.48.1
Opensuse12 products
  • leapEOL15.1 | 15.2
  • python-base&distro=openSUSE Leap 15.1< 2.7.17-lp151.10.21.1
  • python-base&distro=openSUSE Leap 15.2< 2.7.17-lp152.3.3.1
  • python-doc&distro=openSUSE Leap 15.1< 2.7.17-lp151.10.21.1
  • python-doc&distro=openSUSE Leap 15.2< 2.7.17-lp152.3.3.1
Redhat8 products
  • python< 0:2.7.5-90.el7 | < 0:2.7.5-88.el7_7 | < 0:2.7.5-64.el7_4 | < 0:2.7.5-84.el7_6
  • python-debug< 0:2.7.5-90.el7 | < 0:2.7.5-88.el7_7 | < 0:2.7.5-64.el7_4 | < 0:2.7.5-84.el7_6
  • python-debuginfo< 0:2.7.5-90.el7 | < 0:2.7.5-88.el7_7 | < 0:2.7.5-64.el7_4 | < 0:2.7.5-84.el7_6
  • python-devel< 0:2.7.5-90.el7 | < 0:2.7.5-88.el7_7 | < 0:2.7.5-64.el7_4 | < 0:2.7.5-84.el7_6
  • python-libs< 0:2.7.5-90.el7 | < 0:2.7.5-88.el7_7 | < 0:2.7.5-64.el7_4 | < 0:2.7.5-84.el7_6
Ubuntu6 products
  • python2.7< 2.7.6-8ubuntu0.6+esm6 | < 2.7.12-1ubuntu0~16.04.12 | < 2.7.17-1~18.04ubuntu1.1 | < 2.7.18-1~20.04.1
  • python3.4< 3.4.3-1ubuntu1~14.04.7+esm7
  • python3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | < 3.5.2-2ubuntu0~16.04.11
  • python3.6< 3.6.9-1~18.04ubuntu1.1
  • python3.7< 3.7.5-2ubuntu1~18.04.2+esm3
Debian2 products
Netapp2 products
Alpine1 product
  • python3< 3.8.5-r0
Canonical1 product
Fedoraproject1 product
Oracle1 product
Python1 product
  • python≥ 3.5.0, < 3.5.10 | ≥ 3.6.0, < 3.6.12 | ≥ 3.7.0, < 3.7.9 | ≥ 3.8.0, < 3.8.5

11 vendors · 59 products

References

56 links
Show all 56 references