Описание
Security update for python311
This update for python311 fixes the following issues:
Security issues fixed:
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
configparsermodule is used (bsc#1269066). - CVE-2026-3276: quadratic complexity in
unicodedata.normalize()can lead to DoS when processing specially crafted Unicode input (bsc#1267581). - CVE-2026-4360: in the
Tarfile.extract()function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959). - CVE-2026-7210:
xml.parsers.expatandxml.etree.ElementTreeuse insufficient entropy for Expat hash-flooding protection (bsc#1264962). - CVE-2026-7774:
tarfile.data_filterpath traversal bypass allows writing outside the extraction directory (bsc#1267821). - CVE-2026-8328:
ftpcp()does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268). - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
- CVE-2026-15308: incremental
HTMLParserallows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).
Non security issue fixed:
- Improve testing for the support of
IPPROTO_UDPLITE, which could be not present although header files are (bsc#1268375).
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Module for Public Cloud 15 SP4
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
Ссылки
- Link for SUSE-SU-2026:3548-1
- E-Mail link for SUSE-SU-2026:3548-1
- SUSE Security Ratings
- SUSE Bug 1264962
- SUSE Bug 1265268
- SUSE Bug 1267581
- SUSE Bug 1267821
- SUSE Bug 1268375
- SUSE Bug 1268977
- SUSE Bug 1269066
- SUSE Bug 1269788
- SUSE Bug 1269959
- SUSE Bug 1271192
- SUSE CVE CVE-2026-0864 page
- SUSE CVE CVE-2026-11940 page
- SUSE CVE CVE-2026-11972 page
- SUSE CVE CVE-2026-15308 page
- SUSE CVE CVE-2026-3276 page
- SUSE CVE CVE-2026-4360 page
- SUSE CVE CVE-2026-7210 page
Описание
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
Затронутые продукты
Ссылки
- CVE-2026-0864
- SUSE Bug 1269066
Описание
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
Затронутые продукты
Ссылки
- CVE-2026-11940
- SUSE Bug 1268977
Описание
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
Затронутые продукты
Ссылки
- CVE-2026-11972
- SUSE Bug 1269788
Описание
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
Затронутые продукты
Ссылки
- CVE-2026-15308
- SUSE Bug 1271192
Описание
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
Затронутые продукты
Ссылки
- CVE-2026-3276
- SUSE Bug 1267581
Описание
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Затронутые продукты
Ссылки
- CVE-2026-4360
- SUSE Bug 1269959
Описание
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
Затронутые продукты
Ссылки
- CVE-2026-7210
- SUSE Bug 1264962
Описание
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
Затронутые продукты
Ссылки
- CVE-2026-7774
- SUSE Bug 1267821
Описание
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
Затронутые продукты
Ссылки
- CVE-2026-8328
- SUSE Bug 1265268