Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:02359-1

Опубликовано: 23 сент. 2025
Источник: suse-cvrf

Описание

Security update for python312

This update for python312 fixes the following issues:

  • CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705).
  • CVE-2025-4435: Fixed that Tarfile extracts filtered members when errorlevel=0 (bsc#1244061)

Список пакетов

SUSE Linux Enterprise Module for Python 3 15 SP6
libpython3_12-1_0-3.12.11-150600.3.33.1
python312-3.12.11-150600.3.33.1
python312-base-3.12.11-150600.3.33.1
python312-curses-3.12.11-150600.3.33.1
python312-dbm-3.12.11-150600.3.33.1
python312-devel-3.12.11-150600.3.33.1
python312-idle-3.12.11-150600.3.33.1
python312-tk-3.12.11-150600.3.33.1
python312-tools-3.12.11-150600.3.33.1
openSUSE Leap 15.6
libpython3_12-1_0-3.12.11-150600.3.33.1
libpython3_12-1_0-32bit-3.12.11-150600.3.33.1
python312-3.12.11-150600.3.33.1
python312-32bit-3.12.11-150600.3.33.1
python312-base-3.12.11-150600.3.33.1
python312-base-32bit-3.12.11-150600.3.33.1
python312-curses-3.12.11-150600.3.33.1
python312-dbm-3.12.11-150600.3.33.1
python312-devel-3.12.11-150600.3.33.1
python312-doc-3.12.11-150600.3.33.1
python312-doc-devhelp-3.12.11-150600.3.33.1
python312-idle-3.12.11-150600.3.33.1
python312-testsuite-3.12.11-150600.3.33.1
python312-tk-3.12.11-150600.3.33.1
python312-tools-3.12.11-150600.3.33.1

Ссылки

Описание

When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.

Затронутые продукты
SUSE Linux Enterprise Module for Python 3 15 SP6:libpython3_12-1_0-3.12.11-150600.3.33.1
SUSE Linux Enterprise Module for Python 3 15 SP6:python312-3.12.11-150600.3.33.1
SUSE Linux Enterprise Module for Python 3 15 SP6:python312-base-3.12.11-150600.3.33.1
SUSE Linux Enterprise Module for Python 3 15 SP6:python312-curses-3.12.11-150600.3.33.1
Ссылки

Описание

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

Затронутые продукты
SUSE Linux Enterprise Module for Python 3 15 SP6:libpython3_12-1_0-3.12.11-150600.3.33.1
SUSE Linux Enterprise Module for Python 3 15 SP6:python312-3.12.11-150600.3.33.1
SUSE Linux Enterprise Module for Python 3 15 SP6:python312-base-3.12.11-150600.3.33.1
SUSE Linux Enterprise Module for Python 3 15 SP6:python312-curses-3.12.11-150600.3.33.1
Ссылки