Описание
Security update for python39.SUSE_SLE-15-SP3_Update
This update for python39.SUSE_SLE-15-SP3_Update fixes the following issues:
Security issues fixed:
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
configparsermodule is used (bsc#1269066). - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1274743).
- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).
- CVE-2026-3276: quadratic complexity in
unicodedata.normalize()can lead to DoS when processing specially crafted Unicode input (bsc#1267581). - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
- CVE-2026-7774:
tarfile.data_filterpath traversal bypass allows writing outside the extraction directory (bsc#1267821). - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
- CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).
- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).
Non security issues fixed:
- crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel, openssh, libssh and more packages (bsc#1211301).
- Update bundled pip wheels to pip-20.0.2-py2.py3-none-any.whl
Список пакетов
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP5
Ссылки
- Link for SUSE-SU-2026:4174-1
- E-Mail link for SUSE-SU-2026:4174-1
- SUSE Security Ratings
- SUSE Bug 1211301
- SUSE Bug 1262429
- SUSE Bug 1267581
- SUSE Bug 1267821
- SUSE Bug 1269066
- SUSE Bug 1269788
- SUSE Bug 1269959
- SUSE Bug 1271192
- SUSE Bug 1273090
- SUSE Bug 1273091
- SUSE Bug 1273094
- SUSE Bug 1274743
- SUSE Bug 1276903
- SUSE Bug 1277271
- SUSE CVE CVE-2026-0864 page
- SUSE CVE CVE-2026-11972 page
- SUSE CVE CVE-2026-13346 page
Описание
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
Затронутые продукты
Ссылки
- CVE-2026-0864
- SUSE Bug 1269066
Описание
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
Затронутые продукты
Ссылки
- CVE-2026-11972
- SUSE Bug 1269788
Описание
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
Затронутые продукты
Ссылки
- CVE-2026-13346
- SUSE Bug 1273090
Описание
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
Затронутые продукты
Ссылки
- CVE-2026-15308
- SUSE Bug 1271192
Описание
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Затронутые продукты
Ссылки
- CVE-2026-1703
- SUSE Bug 1257599
Описание
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.
Затронутые продукты
Ссылки
- CVE-2026-3219
- SUSE Bug 1262429
Описание
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
Затронутые продукты
Ссылки
- CVE-2026-3276
- SUSE Bug 1267581
Описание
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Затронутые продукты
Ссылки
- CVE-2026-4360
- SUSE Bug 1269959
Описание
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
Затронутые продукты
Ссылки
- CVE-2026-7774
- SUSE Bug 1267821