Описание
Security update for python36
This update for python36 fixes the following issues:
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
configparsermodule is used (bsc#1269066). - CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF bytes (bsc#1261969).
- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously
crafted
wheelarchives (bsc#1257599). - CVE-2026-3219:
piphandles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file (bsc#1262467). - CVE-2026-3276: quadratic complexity in
unicodedata.normalize()can lead to DoS when processing specially crafted Unicode input (bsc#1267581). - CVE-2026-4360: in the
Tarfile.extract()function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959). - CVE-2026-4786: URLs prefixed with
%actioncan pass the dash-prefix safety check and allow for command injection (bsc#1262319). - CVE-2026-6019:
BaseCookie.js_output()does not neutralize characters in cookie values embedded in JS (bsc#1262654). - CVE-2026-6100: use-after-free in decompression modules when a memory allocation fails with
MemoryErrorand the decompression instance is re-used (bsc#1262098). - CVE-2026-6357:
pipself-updatefunctionality can import newly installed modules after wheel installation (bsc#1263442, bsc#1263443). - CVE-2026-7210:
xml.parsers.expatandxml.etree.ElementTreeuse insufficient entropy for Expat hash-flooding protection (bsc#1264962). - CVE-2026-7774:
tarfile.data_filterpath traversal bypass allows writing outside the extraction directory (bsc#1267821). - CVE-2026-8328:
ftpcp()does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268). - CVE-2026-8643: path traversal via malicious entry point name in
pipwheelinstallation allows arbitrary file overwrite (bsc#1266669). - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
- CVE-2026-11972: infinite loop due to improper EOF handling in the
tarfilemodule streaming mode can lead to DoS (bsc#1269788). - CVE-2026-15308: incremental
HTMLParserallows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192). - Regression in
http.cookiesdue to CVE-2026-6019 fix not handling non-ASCII characters correctly (bsc#1263083).
Список пакетов
Image SLES12-SP5-Azure-SAP-BYOS
Image SLES12-SP5-Azure-SAP-On-Demand
Image SLES12-SP5-EC2-SAP-BYOS
Image SLES12-SP5-EC2-SAP-On-Demand
SUSE Linux Enterprise Server 12 SP5-LTSS
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2026:3855-1
- E-Mail link for SUSE-SU-2026:3855-1
- SUSE Security Ratings
- SUSE Bug 1257599
- SUSE Bug 1261969
- SUSE Bug 1262098
- SUSE Bug 1262319
- SUSE Bug 1262467
- SUSE Bug 1262654
- SUSE Bug 1263083
- SUSE Bug 1263442
- SUSE Bug 1263443
- SUSE Bug 1264962
- SUSE Bug 1265268
- SUSE Bug 1266669
- SUSE Bug 1267581
- SUSE Bug 1267821
- SUSE Bug 1268977
- SUSE Bug 1269066
- SUSE Bug 1269788
Описание
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
Затронутые продукты
Ссылки
- CVE-2026-0864
- SUSE Bug 1269066
Описание
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
Затронутые продукты
Ссылки
- CVE-2026-11940
- SUSE Bug 1268977
Описание
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
Затронутые продукты
Ссылки
- CVE-2026-11972
- SUSE Bug 1269788
Описание
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.
Затронутые продукты
Ссылки
- CVE-2026-1502
- SUSE Bug 1261969
Описание
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
Затронутые продукты
Ссылки
- CVE-2026-15308
- SUSE Bug 1271192
Описание
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Затронутые продукты
Ссылки
- CVE-2026-1703
- SUSE Bug 1257599
Описание
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.
Затронутые продукты
Ссылки
- CVE-2026-3219
- SUSE Bug 1262429
Описание
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
Затронутые продукты
Ссылки
- CVE-2026-3276
- SUSE Bug 1267581
Описание
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Затронутые продукты
Ссылки
- CVE-2026-4360
- SUSE Bug 1269959
Описание
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
Затронутые продукты
Ссылки
- CVE-2026-4786
- SUSE Bug 1260026
- SUSE Bug 1262319
Описание
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Затронутые продукты
Ссылки
- CVE-2026-6019
- SUSE Bug 1262654
Описание
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
Затронутые продукты
Ссылки
- CVE-2026-6100
- SUSE Bug 1262098
Описание
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
Затронутые продукты
Ссылки
- CVE-2026-6357
- SUSE Bug 1263442
Описание
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
Затронутые продукты
Ссылки
- CVE-2026-7210
- SUSE Bug 1264962
Описание
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
Затронутые продукты
Ссылки
- CVE-2026-7774
- SUSE Bug 1267821
Описание
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
Затронутые продукты
Ссылки
- CVE-2026-8328
- SUSE Bug 1265268
Описание
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
Затронутые продукты
Ссылки
- CVE-2026-8643
- SUSE Bug 1266669