Описание
Security update for python313
This update for python313 fixes the following issues
Security issues:
- CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
- CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).
- CVE-2026-4786: [oss-security][] CPython: Incomplete mitigation of , %action expansion for command injection to webbrowser.open() (bsc#1262319).
- CVE-2026-6019:
BaseCookie.js_output()does not neutralize characters in cookie values embedded in JS (bsc#1262654). - CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).
Non security issue:
- Add missing BR
crypto-policies-scripts(need for the fix of bsc#1211301).
Список пакетов
SUSE Linux Enterprise Module for Python 3 15 SP7
Ссылки
- Link for SUSE-SU-2026:2464-1
- E-Mail link for SUSE-SU-2026:2464-1
- SUSE Security Ratings
- SUSE Bug 1211301
- SUSE Bug 1261969
- SUSE Bug 1261970
- SUSE Bug 1262098
- SUSE Bug 1262319
- SUSE Bug 1262654
- SUSE Bug 1263787
- SUSE CVE CVE-2026-1502 page
- SUSE CVE CVE-2026-3446 page
- SUSE CVE CVE-2026-4786 page
- SUSE CVE CVE-2026-6019 page
- SUSE CVE CVE-2026-6100 page
Описание
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.
Затронутые продукты
Ссылки
- CVE-2026-1502
- SUSE Bug 1261969
Описание
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
Затронутые продукты
Ссылки
- CVE-2026-3446
- SUSE Bug 1261970
Описание
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
Затронутые продукты
Ссылки
- CVE-2026-4786
- SUSE Bug 1260026
- SUSE Bug 1262319
Описание
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Затронутые продукты
Ссылки
- CVE-2026-6019
- SUSE Bug 1262654
Описание
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
Затронутые продукты
Ссылки
- CVE-2026-6100
- SUSE Bug 1262098