SUSE-SU-2026:0663-1

Опубликовано: 26 фев. 2026

Источник: suse-cvrf

Описание

Security update for python

This update for python fixes the following issues:

CVE-2025-6075: Fixed performance degradation when using os.path.expandvars() (bsc#1252974).
CVE-2026-0672: Fixed a HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel. (bsc#1257031)
CVE-2026-0865: Fixed a bug where a user-controlled header containing newlines can allow injecting HTTP headers. (bsc#1257042)
CVE-2025-15366: Fixed a bug wherer a user-controlled command can allow additional commands injected using newlines. (bsc#1257044)
CVE-2025-15367: Fixed control characters which may allow the injection of additional commands. (bsc#1257041)

Список пакетов

Image SLES12-SP5-Azure-BYOS

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-Azure-HPC-BYOS

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-Azure-HPC-On-Demand

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-Azure-SAP-BYOS

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-Azure-SAP-On-Demand

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-Azure-Standard-On-Demand

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-EC2-BYOS

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-EC2-ECS-On-Demand

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-EC2-On-Demand

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-EC2-SAP-BYOS

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-EC2-SAP-On-Demand

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-GCE-BYOS

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-GCE-On-Demand

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-GCE-SAP-BYOS

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-GCE-SAP-On-Demand

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-SAP-Azure-LI-BYOS-Production

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production

libpython2_7-1_0-2.7.18-33.63.1

python-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

SUSE Linux Enterprise Server 12 SP5-LTSS

libpython2_7-1_0-2.7.18-33.63.1

libpython2_7-1_0-32bit-2.7.18-33.63.1

python-2.7.18-33.63.1

python-32bit-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-base-32bit-2.7.18-33.63.1

python-curses-2.7.18-33.63.1

python-demo-2.7.18-33.63.1

python-devel-2.7.18-33.63.1

python-doc-2.7.18-33.63.1

python-doc-pdf-2.7.18-33.63.1

python-gdbm-2.7.18-33.63.1

python-idle-2.7.18-33.63.1

python-tk-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5

libpython2_7-1_0-2.7.18-33.63.1

libpython2_7-1_0-32bit-2.7.18-33.63.1

python-2.7.18-33.63.1

python-32bit-2.7.18-33.63.1

python-base-2.7.18-33.63.1

python-base-32bit-2.7.18-33.63.1

python-curses-2.7.18-33.63.1

python-demo-2.7.18-33.63.1

python-devel-2.7.18-33.63.1

python-doc-2.7.18-33.63.1

python-doc-pdf-2.7.18-33.63.1

python-gdbm-2.7.18-33.63.1

python-idle-2.7.18-33.63.1

python-tk-2.7.18-33.63.1

python-xml-2.7.18-33.63.1

Ссылки

https://www.suse.com/support/update/announcement/2026/suse-su-20260663-1/
Link for SUSE-SU-2026:0663-1
https://lists.suse.com/pipermail/sle-security-updates/2026-February/024447.html
E-Mail link for SUSE-SU-2026:0663-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1252974
SUSE Bug 1252974
https://bugzilla.suse.com/1254867
SUSE Bug 1254867
https://bugzilla.suse.com/1257031
SUSE Bug 1257031
https://bugzilla.suse.com/1257041
SUSE Bug 1257041
https://bugzilla.suse.com/1257042
SUSE Bug 1257042
https://bugzilla.suse.com/1257044
SUSE Bug 1257044
https://bugzilla.suse.com/1257064
SUSE Bug 1257064
https://www.suse.com/security/cve/CVE-2025-15366/
SUSE CVE CVE-2025-15366 page
https://www.suse.com/security/cve/CVE-2025-15367/
SUSE CVE CVE-2025-15367 page
https://www.suse.com/security/cve/CVE-2025-6075/
SUSE CVE CVE-2025-6075 page
https://www.suse.com/security/cve/CVE-2026-0672/
SUSE CVE CVE-2026-0672 page
https://www.suse.com/security/cve/CVE-2026-0865/
SUSE CVE CVE-2026-0865 page

Описание

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Затронутые продукты

Image SLES12-SP5-Azure-BYOS:libpython2_7-1_0-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-base-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-xml-2.7.18-33.63.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-15366.html
CVE-2025-15366
https://bugzilla.suse.com/1257044
SUSE Bug 1257044

Описание

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Затронутые продукты

Image SLES12-SP5-Azure-BYOS:libpython2_7-1_0-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-base-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-xml-2.7.18-33.63.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-15367.html
CVE-2025-15367
https://bugzilla.suse.com/1257041
SUSE Bug 1257041

Описание

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

Затронутые продукты

Image SLES12-SP5-Azure-BYOS:libpython2_7-1_0-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-base-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-xml-2.7.18-33.63.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-6075.html
CVE-2025-6075
https://bugzilla.suse.com/1252974
SUSE Bug 1252974

Описание

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

Затронутые продукты

Image SLES12-SP5-Azure-BYOS:libpython2_7-1_0-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-base-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-xml-2.7.18-33.63.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-0672.html
CVE-2026-0672
https://bugzilla.suse.com/1257031
SUSE Bug 1257031
https://bugzilla.suse.com/1259734
SUSE Bug 1259734

Описание

User-controlled header names and values containing newlines can allow injecting HTTP headers.

Затронутые продукты

Image SLES12-SP5-Azure-BYOS:libpython2_7-1_0-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-base-2.7.18-33.63.1

Image SLES12-SP5-Azure-BYOS:python-xml-2.7.18-33.63.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-0865.html
CVE-2026-0865
https://bugzilla.suse.com/1257042
SUSE Bug 1257042

SUSE-SU-2026:0663-1

Описание

Список пакетов

Image SLES12-SP5-Azure-BYOS

Image SLES12-SP5-Azure-HPC-BYOS

Image SLES12-SP5-Azure-HPC-On-Demand

Image SLES12-SP5-Azure-SAP-BYOS

Image SLES12-SP5-Azure-SAP-On-Demand

Image SLES12-SP5-Azure-Standard-On-Demand

Image SLES12-SP5-EC2-BYOS

Image SLES12-SP5-EC2-ECS-On-Demand

Image SLES12-SP5-EC2-On-Demand

Image SLES12-SP5-EC2-SAP-BYOS

Image SLES12-SP5-EC2-SAP-On-Demand

Image SLES12-SP5-GCE-BYOS

Image SLES12-SP5-GCE-On-Demand

Image SLES12-SP5-GCE-SAP-BYOS

Image SLES12-SP5-GCE-SAP-On-Demand

Image SLES12-SP5-SAP-Azure-LI-BYOS-Production

Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production

SUSE Linux Enterprise Server 12 SP5-LTSS

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5

Ссылки

Уязвимость: CVE-2025-15366

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2025-15367

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2025-6075

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-0672

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-0865

Описание

Затронутые продукты

Ссылки