The vulnerability is in the Python tarfile package, in code that ... for a comment about CVE-2007-4559 but has not received an answer at publishing time. Patching used to mean complex scripts ...