SUSE-SU-2026:0613-1

Опубликовано: 24 фев. 2026

Источник: suse-cvrf

Описание

Security update for python310

This update for python310 fixes the following issues:

CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

libpython3_10-1_0-3.10.19-150400.4.97.1

python310-3.10.19-150400.4.97.1

python310-base-3.10.19-150400.4.97.1

python310-curses-3.10.19-150400.4.97.1

python310-dbm-3.10.19-150400.4.97.1

python310-devel-3.10.19-150400.4.97.1

python310-idle-3.10.19-150400.4.97.1

python310-tk-3.10.19-150400.4.97.1

python310-tools-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

libpython3_10-1_0-3.10.19-150400.4.97.1

python310-3.10.19-150400.4.97.1

python310-base-3.10.19-150400.4.97.1

python310-curses-3.10.19-150400.4.97.1

python310-dbm-3.10.19-150400.4.97.1

python310-devel-3.10.19-150400.4.97.1

python310-idle-3.10.19-150400.4.97.1

python310-tk-3.10.19-150400.4.97.1

python310-tools-3.10.19-150400.4.97.1

SUSE Linux Enterprise Server 15 SP4-LTSS

libpython3_10-1_0-3.10.19-150400.4.97.1

python310-3.10.19-150400.4.97.1

python310-base-3.10.19-150400.4.97.1

python310-curses-3.10.19-150400.4.97.1

python310-dbm-3.10.19-150400.4.97.1

python310-devel-3.10.19-150400.4.97.1

python310-idle-3.10.19-150400.4.97.1

python310-tk-3.10.19-150400.4.97.1

python310-tools-3.10.19-150400.4.97.1

SUSE Linux Enterprise Server for SAP Applications 15 SP4

libpython3_10-1_0-3.10.19-150400.4.97.1

python310-3.10.19-150400.4.97.1

python310-base-3.10.19-150400.4.97.1

python310-curses-3.10.19-150400.4.97.1

python310-dbm-3.10.19-150400.4.97.1

python310-devel-3.10.19-150400.4.97.1

python310-idle-3.10.19-150400.4.97.1

python310-tk-3.10.19-150400.4.97.1

python310-tools-3.10.19-150400.4.97.1

openSUSE Leap 15.6

libpython3_10-1_0-3.10.19-150400.4.97.1

libpython3_10-1_0-32bit-3.10.19-150400.4.97.1

python310-3.10.19-150400.4.97.1

python310-32bit-3.10.19-150400.4.97.1

python310-base-3.10.19-150400.4.97.1

python310-base-32bit-3.10.19-150400.4.97.1

python310-curses-3.10.19-150400.4.97.1

python310-dbm-3.10.19-150400.4.97.1

python310-devel-3.10.19-150400.4.97.1

python310-doc-3.10.19-150400.4.97.1

python310-doc-devhelp-3.10.19-150400.4.97.1

python310-idle-3.10.19-150400.4.97.1

python310-testsuite-3.10.19-150400.4.97.1

python310-tk-3.10.19-150400.4.97.1

python310-tools-3.10.19-150400.4.97.1

Ссылки

https://www.suse.com/support/update/announcement/2026/suse-su-20260613-1/
Link for SUSE-SU-2026:0613-1
https://lists.suse.com/pipermail/sle-security-updates/2026-February/024382.html
E-Mail link for SUSE-SU-2026:0613-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1257029
SUSE Bug 1257029
https://bugzilla.suse.com/1257031
SUSE Bug 1257031
https://bugzilla.suse.com/1257041
SUSE Bug 1257041
https://bugzilla.suse.com/1257042
SUSE Bug 1257042
https://bugzilla.suse.com/1257044
SUSE Bug 1257044
https://bugzilla.suse.com/1257046
SUSE Bug 1257046
https://www.suse.com/security/cve/CVE-2025-11468/
SUSE CVE CVE-2025-11468 page
https://www.suse.com/security/cve/CVE-2025-15282/
SUSE CVE CVE-2025-15282 page
https://www.suse.com/security/cve/CVE-2025-15366/
SUSE CVE CVE-2025-15366 page
https://www.suse.com/security/cve/CVE-2025-15367/
SUSE CVE CVE-2025-15367 page
https://www.suse.com/security/cve/CVE-2026-0672/
SUSE CVE CVE-2026-0672 page
https://www.suse.com/security/cve/CVE-2026-0865/
SUSE CVE CVE-2026-0865 page

Описание

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

Затронутые продукты

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libpython3_10-1_0-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-base-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-curses-3.10.19-150400.4.97.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-11468.html
CVE-2025-11468
https://bugzilla.suse.com/1257029
SUSE Bug 1257029

Описание

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

Затронутые продукты

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libpython3_10-1_0-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-base-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-curses-3.10.19-150400.4.97.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-15282.html
CVE-2025-15282
https://bugzilla.suse.com/1257046
SUSE Bug 1257046

Описание

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Затронутые продукты

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libpython3_10-1_0-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-base-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-curses-3.10.19-150400.4.97.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-15366.html
CVE-2025-15366
https://bugzilla.suse.com/1257044
SUSE Bug 1257044

Описание

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Затронутые продукты

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libpython3_10-1_0-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-base-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-curses-3.10.19-150400.4.97.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-15367.html
CVE-2025-15367
https://bugzilla.suse.com/1257041
SUSE Bug 1257041

Описание

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

Затронутые продукты

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libpython3_10-1_0-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-base-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-curses-3.10.19-150400.4.97.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-0672.html
CVE-2026-0672
https://bugzilla.suse.com/1257031
SUSE Bug 1257031

Описание

User-controlled header names and values containing newlines can allow injecting HTTP headers.

Затронутые продукты

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libpython3_10-1_0-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-base-3.10.19-150400.4.97.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python310-curses-3.10.19-150400.4.97.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-0865.html
CVE-2026-0865
https://bugzilla.suse.com/1257042
SUSE Bug 1257042

SUSE-SU-2026:0613-1

Описание

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

SUSE Linux Enterprise Server 15 SP4-LTSS

SUSE Linux Enterprise Server for SAP Applications 15 SP4

openSUSE Leap 15.6

Ссылки

Уязвимость: CVE-2025-11468

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2025-15282

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2025-15366

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2025-15367

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-0672

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-0865

Описание

Затронутые продукты

Ссылки