Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:1819-1

Опубликовано: 12 мая 2026
Источник: suse-cvrf

Описание

Security update for python-Mako

This update for python-Mako fixes the following issue:

  • CVE-2026-41205: Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal (bsc#1262716).

Список пакетов

SUSE Linux Enterprise Module for Python 3 15 SP7
python311-Mako-1.3.0-150600.3.3.1
SUSE Linux Enterprise Server 15 SP6-LTSS
python311-Mako-1.3.0-150600.3.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6
python311-Mako-1.3.0-150600.3.3.1

Ссылки

Описание

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

Затронутые продукты
SUSE Linux Enterprise Module for Python 3 15 SP7:python311-Mako-1.3.0-150600.3.3.1
SUSE Linux Enterprise Server 15 SP6-LTSS:python311-Mako-1.3.0-150600.3.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-Mako-1.3.0-150600.3.3.1
Ссылки