Описание
Security update for python3, python3-base, python3-doc
This update for python3, python3-base, python3-doc fixes the following issues:
Security issues fixed:
- CVE-2026-6879: quadratic behavior in
xml.etree.ElementPathindex predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683).
- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).
- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file modification and content disclosure (bsc#1280459).
Changes for python3:
- Update bundled setuptools wheels to setuptools-40.6.2 (bsc#1276903).
Список пакетов
SUSE Linux Enterprise Server 12 SP5-LTSS
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2026:4744-1
- E-Mail link for SUSE-SU-2026:4744-1
- SUSE Security Ratings
- SUSE Bug 1267974
- SUSE Bug 1273148
- SUSE Bug 1274683
- SUSE Bug 1276223
- SUSE Bug 1276226
- SUSE Bug 1276227
- SUSE Bug 1276903
- SUSE Bug 1277111
- SUSE Bug 1277271
- SUSE Bug 1280459
- SUSE CVE CVE-2025-4435 page
- SUSE CVE CVE-2026-15310 page
- SUSE CVE CVE-2026-15806 page
- SUSE CVE CVE-2026-17084 page
- SUSE CVE CVE-2026-18503 page
- SUSE CVE CVE-2026-19672 page
- SUSE CVE CVE-2026-3276 page
Описание
When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped.
Затронутые продукты
Ссылки
- CVE-2025-4435
- SUSE Bug 1244061
Описание
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
Затронутые продукты
Ссылки
- CVE-2026-15310
- SUSE Bug 1277111
Описание
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.
Затронутые продукты
Ссылки
- CVE-2026-15806
- SUSE Bug 1276223
Описание
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
Затронутые продукты
Ссылки
- CVE-2026-17084
- SUSE Bug 1276226
Описание
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
Затронутые продукты
Ссылки
- CVE-2026-18503
- SUSE Bug 1274683
Описание
The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.
Затронутые продукты
Ссылки
- CVE-2026-19672
- SUSE Bug 1276227
Описание
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
Затронутые продукты
Ссылки
- CVE-2026-3276
- SUSE Bug 1267581
Описание
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
Затронутые продукты
Ссылки
- CVE-2026-6879
- SUSE Bug 1273148
Описание
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
Затронутые продукты
Ссылки
- CVE-2026-7774
- SUSE Bug 1267821
Описание
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
Затронутые продукты
Ссылки
- CVE-2026-82049
- SUSE Bug 1280459
Описание
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
Затронутые продукты
Ссылки
- CVE-2026-9669
- SUSE Bug 1267974