Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:1820-1

Опубликовано: 12 мая 2026
Источник: suse-cvrf

Описание

Security update for python-Mako

This update for python-Mako fixes the following issue:

  • CVE-2026-41205: Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal (bsc#1262716).

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
python3-Mako-1.0.7-150000.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
python3-Mako-1.0.7-150000.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
python3-Mako-1.0.7-150000.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
python3-Mako-1.0.7-150000.3.6.1
SUSE Linux Enterprise Server 15 SP4-LTSS
python3-Mako-1.0.7-150000.3.6.1
SUSE Linux Enterprise Server 15 SP5-LTSS
python3-Mako-1.0.7-150000.3.6.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4
python3-Mako-1.0.7-150000.3.6.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5
python3-Mako-1.0.7-150000.3.6.1

Ссылки

Описание

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python3-Mako-1.0.7-150000.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python3-Mako-1.0.7-150000.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python3-Mako-1.0.7-150000.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python3-Mako-1.0.7-150000.3.6.1
Ссылки