Описание
Security update for python311
This update for python311 fixes the following issues:
- CVE-2025-12084: prevent quadratic behavior in node ID cache clearing (bsc#1254997).
- CVE-2025-13836: prevent reading an HTTP response from a server, if no read amount is specified, with using Content-Length per default as the length (bsc#1254400).
- CVE-2025-13837: protect against OOM when loading malicious content (bsc#1254401).
Список пакетов
Container bci/python:3
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
python311-devel-3.11.14-150600.3.41.2
Image SLES15-SP6
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
Image SLES15-SP6-EC2
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
Image SLES15-SP6-EC2-ECS-HVM
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
Image SLES15-SP6-Hardened-BYOS
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
Image SLES15-SP6-Hardened-BYOS-EC2
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
Image SLES15-SP6-SAP
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
Image SLES15-SP6-SAP-BYOS
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
Image SLES15-SP6-SAP-BYOS-EC2
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
Image SLES15-SP6-SAP-EC2
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
Image SLES15-SP6-SAPCAL
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
Image SLES15-SP6-SAPCAL-EC2
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
Image SLES15-SP7-EC2
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
Image SLES15-SP7-EC2-ECS-HVM
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
Image SLES15-SP7-SAPCAL-EC2
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
SUSE Linux Enterprise Module for Basesystem 15 SP7
libpython3_11-1_0-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
SUSE Linux Enterprise Module for Python 3 15 SP7
python311-3.11.14-150600.3.41.2
python311-curses-3.11.14-150600.3.41.2
python311-dbm-3.11.14-150600.3.41.2
python311-devel-3.11.14-150600.3.41.2
python311-idle-3.11.14-150600.3.41.2
python311-tk-3.11.14-150600.3.41.2
python311-tools-3.11.14-150600.3.41.2
openSUSE Leap 15.6
libpython3_11-1_0-3.11.14-150600.3.41.2
libpython3_11-1_0-32bit-3.11.14-150600.3.41.2
python311-3.11.14-150600.3.41.2
python311-32bit-3.11.14-150600.3.41.2
python311-base-3.11.14-150600.3.41.2
python311-base-32bit-3.11.14-150600.3.41.2
python311-curses-3.11.14-150600.3.41.2
python311-dbm-3.11.14-150600.3.41.2
python311-devel-3.11.14-150600.3.41.2
python311-doc-3.11.14-150600.3.41.1
python311-doc-devhelp-3.11.14-150600.3.41.1
python311-idle-3.11.14-150600.3.41.2
python311-testsuite-3.11.14-150600.3.41.2
python311-tk-3.11.14-150600.3.41.2
python311-tools-3.11.14-150600.3.41.2
Ссылки
- Link for SUSE-SU-2026:0314-1
- E-Mail link for SUSE-SU-2026:0314-1
- SUSE Security Ratings
- SUSE Bug 1254400
- SUSE Bug 1254401
- SUSE Bug 1254997
- SUSE CVE CVE-2025-12084 page
- SUSE CVE CVE-2025-13836 page
- SUSE CVE CVE-2025-13837 page
Описание
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
Затронутые продукты
Container bci/python:3:libpython3_11-1_0-3.11.14-150600.3.41.2
Container bci/python:3:python311-3.11.14-150600.3.41.2
Container bci/python:3:python311-base-3.11.14-150600.3.41.2
Container bci/python:3:python311-devel-3.11.14-150600.3.41.2
Ссылки
- CVE-2025-12084
- SUSE Bug 1254997
Описание
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
Затронутые продукты
Container bci/python:3:libpython3_11-1_0-3.11.14-150600.3.41.2
Container bci/python:3:python311-3.11.14-150600.3.41.2
Container bci/python:3:python311-base-3.11.14-150600.3.41.2
Container bci/python:3:python311-devel-3.11.14-150600.3.41.2
Ссылки
- CVE-2025-13836
- SUSE Bug 1254400
Описание
When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
Затронутые продукты
Container bci/python:3:libpython3_11-1_0-3.11.14-150600.3.41.2
Container bci/python:3:python311-3.11.14-150600.3.41.2
Container bci/python:3:python311-base-3.11.14-150600.3.41.2
Container bci/python:3:python311-devel-3.11.14-150600.3.41.2
Ссылки
- CVE-2025-13837
- SUSE Bug 1254401