Описание
Security update for python, python-base, python-doc
This update for python, python-base, python-doc fixes the following issues
Security fixes:
- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599).
- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).
- CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).
- CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319).
- CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters (bsc#1262654).
- CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).
- CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442).
Other fixes:
- For SLE-12 use vendored libffi (bsc#1261652).
Список пакетов
Image SLES12-SP5-Azure-HPC-BYOS
Image SLES12-SP5-Azure-HPC-On-Demand
SUSE Linux Enterprise Server 12 SP5-LTSS
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2026:2664-1
- E-Mail link for SUSE-SU-2026:2664-1
- SUSE Security Ratings
- SUSE Bug 1257599
- SUSE Bug 1261652
- SUSE Bug 1261970
- SUSE Bug 1262098
- SUSE Bug 1262319
- SUSE Bug 1262429
- SUSE Bug 1262654
- SUSE Bug 1263442
- SUSE CVE CVE-2026-1703 page
- SUSE CVE CVE-2026-3219 page
- SUSE CVE CVE-2026-3446 page
- SUSE CVE CVE-2026-4786 page
- SUSE CVE CVE-2026-6019 page
- SUSE CVE CVE-2026-6100 page
- SUSE CVE CVE-2026-6357 page
Описание
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Затронутые продукты
Ссылки
- CVE-2026-1703
- SUSE Bug 1257599
Описание
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.
Затронутые продукты
Ссылки
- CVE-2026-3219
- SUSE Bug 1262429
Описание
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
Затронутые продукты
Ссылки
- CVE-2026-3446
- SUSE Bug 1261970
Описание
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
Затронутые продукты
Ссылки
- CVE-2026-4786
- SUSE Bug 1260026
- SUSE Bug 1262319
Описание
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Затронутые продукты
Ссылки
- CVE-2026-6019
- SUSE Bug 1262654
Описание
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
Затронутые продукты
Ссылки
- CVE-2026-6100
- SUSE Bug 1262098
Описание
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
Затронутые продукты
Ссылки
- CVE-2026-6357
- SUSE Bug 1263442