SUSE-SU-2026:0645-1

Опубликовано: 25 фев. 2026

Источник: suse-cvrf

Описание

Security update for python3

This update for python3 fixes the following issues:

CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029).
CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031).
CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).

Список пакетов

Image SLES12-SP5-Azure-BYOS

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

Image SLES12-SP5-Azure-HPC-BYOS

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

Image SLES12-SP5-Azure-HPC-On-Demand

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

Image SLES12-SP5-Azure-SAP-BYOS

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

python3-curses-3.4.10-25.172.1

Image SLES12-SP5-Azure-SAP-On-Demand

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

python3-curses-3.4.10-25.172.1

Image SLES12-SP5-Azure-Standard-On-Demand

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

Image SLES12-SP5-EC2-BYOS

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

Image SLES12-SP5-EC2-ECS-On-Demand

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

Image SLES12-SP5-EC2-On-Demand

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

Image SLES12-SP5-EC2-SAP-BYOS

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

python3-curses-3.4.10-25.172.1

Image SLES12-SP5-EC2-SAP-On-Demand

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

python3-curses-3.4.10-25.172.1

Image SLES12-SP5-GCE-BYOS

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

Image SLES12-SP5-GCE-On-Demand

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

Image SLES12-SP5-GCE-SAP-BYOS

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

python3-curses-3.4.10-25.172.1

Image SLES12-SP5-GCE-SAP-On-Demand

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

python3-curses-3.4.10-25.172.1

Image SLES12-SP5-SAP-Azure-LI-BYOS-Production

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

python3-curses-3.4.10-25.172.1

Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production

libpython3_4m1_0-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

python3-curses-3.4.10-25.172.1

SUSE Linux Enterprise Server 12 SP5-LTSS

libpython3_4m1_0-3.4.10-25.172.1

libpython3_4m1_0-32bit-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

python3-curses-3.4.10-25.172.1

python3-devel-3.4.10-25.172.1

python3-tk-3.4.10-25.172.1

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5

libpython3_4m1_0-3.4.10-25.172.1

libpython3_4m1_0-32bit-3.4.10-25.172.1

python3-3.4.10-25.172.1

python3-base-3.4.10-25.172.1

python3-curses-3.4.10-25.172.1

python3-devel-3.4.10-25.172.1

python3-tk-3.4.10-25.172.1

Ссылки

https://www.suse.com/support/update/announcement/2026/suse-su-20260645-1/
Link for SUSE-SU-2026:0645-1
https://lists.suse.com/pipermail/sle-security-updates/2026-February/024402.html
E-Mail link for SUSE-SU-2026:0645-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1257029
SUSE Bug 1257029
https://bugzilla.suse.com/1257031
SUSE Bug 1257031
https://bugzilla.suse.com/1257041
SUSE Bug 1257041
https://bugzilla.suse.com/1257042
SUSE Bug 1257042
https://bugzilla.suse.com/1257044
SUSE Bug 1257044
https://bugzilla.suse.com/1257046
SUSE Bug 1257046
https://www.suse.com/security/cve/CVE-2025-11468/
SUSE CVE CVE-2025-11468 page
https://www.suse.com/security/cve/CVE-2025-15282/
SUSE CVE CVE-2025-15282 page
https://www.suse.com/security/cve/CVE-2025-15366/
SUSE CVE CVE-2025-15366 page
https://www.suse.com/security/cve/CVE-2025-15367/
SUSE CVE CVE-2025-15367 page
https://www.suse.com/security/cve/CVE-2026-0672/
SUSE CVE CVE-2026-0672 page
https://www.suse.com/security/cve/CVE-2026-0865/
SUSE CVE CVE-2026-0865 page

Описание

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

Затронутые продукты

Image SLES12-SP5-Azure-BYOS:libpython3_4m1_0-3.4.10-25.172.1

Image SLES12-SP5-Azure-BYOS:python3-3.4.10-25.172.1

Image SLES12-SP5-Azure-BYOS:python3-base-3.4.10-25.172.1

Image SLES12-SP5-Azure-HPC-BYOS:libpython3_4m1_0-3.4.10-25.172.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-11468.html
CVE-2025-11468
https://bugzilla.suse.com/1257029
SUSE Bug 1257029

Описание

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

Затронутые продукты

Image SLES12-SP5-Azure-BYOS:libpython3_4m1_0-3.4.10-25.172.1

Image SLES12-SP5-Azure-BYOS:python3-3.4.10-25.172.1

Image SLES12-SP5-Azure-BYOS:python3-base-3.4.10-25.172.1

Image SLES12-SP5-Azure-HPC-BYOS:libpython3_4m1_0-3.4.10-25.172.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-15282.html
CVE-2025-15282
https://bugzilla.suse.com/1257046
SUSE Bug 1257046

Описание

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Затронутые продукты

Image SLES12-SP5-Azure-BYOS:libpython3_4m1_0-3.4.10-25.172.1

Image SLES12-SP5-Azure-BYOS:python3-3.4.10-25.172.1

Image SLES12-SP5-Azure-BYOS:python3-base-3.4.10-25.172.1

Image SLES12-SP5-Azure-HPC-BYOS:libpython3_4m1_0-3.4.10-25.172.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-15366.html
CVE-2025-15366
https://bugzilla.suse.com/1257044
SUSE Bug 1257044

Описание

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Затронутые продукты

Image SLES12-SP5-Azure-BYOS:libpython3_4m1_0-3.4.10-25.172.1

Image SLES12-SP5-Azure-BYOS:python3-3.4.10-25.172.1

Image SLES12-SP5-Azure-BYOS:python3-base-3.4.10-25.172.1

Image SLES12-SP5-Azure-HPC-BYOS:libpython3_4m1_0-3.4.10-25.172.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-15367.html
CVE-2025-15367
https://bugzilla.suse.com/1257041
SUSE Bug 1257041

Описание

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

Затронутые продукты

Image SLES12-SP5-Azure-BYOS:libpython3_4m1_0-3.4.10-25.172.1

Image SLES12-SP5-Azure-BYOS:python3-3.4.10-25.172.1

Image SLES12-SP5-Azure-BYOS:python3-base-3.4.10-25.172.1

Image SLES12-SP5-Azure-HPC-BYOS:libpython3_4m1_0-3.4.10-25.172.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-0672.html
CVE-2026-0672
https://bugzilla.suse.com/1257031
SUSE Bug 1257031
https://bugzilla.suse.com/1259734
SUSE Bug 1259734

Описание

User-controlled header names and values containing newlines can allow injecting HTTP headers.

Затронутые продукты

Image SLES12-SP5-Azure-BYOS:libpython3_4m1_0-3.4.10-25.172.1

Image SLES12-SP5-Azure-BYOS:python3-3.4.10-25.172.1

Image SLES12-SP5-Azure-BYOS:python3-base-3.4.10-25.172.1

Image SLES12-SP5-Azure-HPC-BYOS:libpython3_4m1_0-3.4.10-25.172.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-0865.html
CVE-2026-0865
https://bugzilla.suse.com/1257042
SUSE Bug 1257042

SUSE-SU-2026:0645-1

Описание

Список пакетов

Image SLES12-SP5-Azure-BYOS

Image SLES12-SP5-Azure-HPC-BYOS

Image SLES12-SP5-Azure-HPC-On-Demand

Image SLES12-SP5-Azure-SAP-BYOS

Image SLES12-SP5-Azure-SAP-On-Demand

Image SLES12-SP5-Azure-Standard-On-Demand

Image SLES12-SP5-EC2-BYOS

Image SLES12-SP5-EC2-ECS-On-Demand

Image SLES12-SP5-EC2-On-Demand

Image SLES12-SP5-EC2-SAP-BYOS

Image SLES12-SP5-EC2-SAP-On-Demand

Image SLES12-SP5-GCE-BYOS

Image SLES12-SP5-GCE-On-Demand

Image SLES12-SP5-GCE-SAP-BYOS

Image SLES12-SP5-GCE-SAP-On-Demand

Image SLES12-SP5-SAP-Azure-LI-BYOS-Production

Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production

SUSE Linux Enterprise Server 12 SP5-LTSS

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5

Ссылки

Уязвимость: CVE-2025-11468

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2025-15282

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2025-15366

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2025-15367

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-0672

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-0865

Описание

Затронутые продукты

Ссылки