Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:1818-1

Опубликовано: 12 мая 2026
Источник: suse-cvrf

Описание

Security update for python39

This update for python39 fixes the following issues:

Security issues fixed:

  • CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
  • CVE-2026-3446: base64 decoding stops at first padded quad by default and ignores other information that could be processed (bsc#1261970).
  • CVE-2026-3479: improper resource argument validation in pkgutil.get_data() can lead to path traversal (bsc#1259989).
  • CVE-2026-4786: URLs prefixed with %action can pass the dash-prefix safety check and allow for command injection (bsc#1262319).
  • CVE-2026-6019: BaseCookie.js_output() does not neutralize characters in cookie values embedded in JS (bsc#1262654).
  • CVE-2026-6100: use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when process is under memory pressure(bsc#1262098).

Other updates and bugfixes:

  • Rewrite structure of Python interpreter packages. python3* symbols should be now provided by real python3 packages and its subpackages instead of the virtual provides (bsc#1258364).

Список пакетов

SUSE Linux Enterprise Server 15 SP5-LTSS
libpython3_9-1_0-3.9.25-150300.4.106.1
python39-3.9.25-150300.4.106.1
python39-base-3.9.25-150300.4.106.1
python39-curses-3.9.25-150300.4.106.1
python39-dbm-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5
libpython3_9-1_0-3.9.25-150300.4.106.1
python39-3.9.25-150300.4.106.1
python39-base-3.9.25-150300.4.106.1
python39-curses-3.9.25-150300.4.106.1
python39-dbm-3.9.25-150300.4.106.1

Описание

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.


Затронутые продукты
SUSE Linux Enterprise Server 15 SP5-LTSS:libpython3_9-1_0-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-base-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-curses-3.9.25-150300.4.106.1

Ссылки

Описание

When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.


Затронутые продукты
SUSE Linux Enterprise Server 15 SP5-LTSS:libpython3_9-1_0-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-base-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-curses-3.9.25-150300.4.106.1

Ссылки

Описание

DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.


Затронутые продукты
SUSE Linux Enterprise Server 15 SP5-LTSS:libpython3_9-1_0-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-base-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-curses-3.9.25-150300.4.106.1

Ссылки

Описание

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.


Затронутые продукты
SUSE Linux Enterprise Server 15 SP5-LTSS:libpython3_9-1_0-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-base-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-curses-3.9.25-150300.4.106.1

Ссылки

Описание

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.


Затронутые продукты
SUSE Linux Enterprise Server 15 SP5-LTSS:libpython3_9-1_0-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-base-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-curses-3.9.25-150300.4.106.1

Ссылки

Описание

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.


Затронутые продукты
SUSE Linux Enterprise Server 15 SP5-LTSS:libpython3_9-1_0-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-base-3.9.25-150300.4.106.1
SUSE Linux Enterprise Server 15 SP5-LTSS:python39-curses-3.9.25-150300.4.106.1

Ссылки
Уязвимость SUSE-SU-2026:1818-1