[3.11] gh-130577: tarfile now validates archives to ensure member offsets are non-negative (GH-137027)

[miss-islington]

(cherry picked from commit 7040aa5)

Co-authored-by: Alexander Urieles [email protected]
Co-authored-by: Gregory P. Smith [email protected]

• Issue: tarfile.StreamError: seeking backwards is not allowed due to unskipped block with bad checksum #130577

[Kevin-Molina]

Howdy! Wondering if there's any ETA on this high CVE fix getting rolled out? Thank you!

CC: @pablogsal

[pablogsal]

Howdy! Wondering if there's any ETA on this high CVE fix getting rolled out? Thank you!

We can coordinate a release with the rest of the RM team. Will check with them soon

[Kevin-Molina]

Howdy! Wondering if there's any ETA on this high CVE fix getting rolled out? Thank you!

We can coordinate a release with the rest of the RM team. Will check with them soon

Happy Monday! Any luck on the 3.11 release for this CVE @pablogsal? 🙇

[pablogsal]

Howdy! Wondering if there's any ETA on this high CVE fix getting rolled out? Thank you!

We can coordinate a release with the rest of the RM team. Will check with them soon

Happy Monday! Any luck on the 3.11 release for this CVE @pablogsal? 🙇

We will probably coordinate to do a release of all supported versions around or after the core dev sprint (mid September) but still not confirmed. CC @ambv @Yhg1s

[jgauth]

Hey @pablogsal, as we are nearing the end of September I wanted to check if you have an idea of when we might get the next 3.11 release. Thanks!