Описание
Security update for python3
This update for python3 fixes the following issues:
Security issues fixed:
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
configparsermodule is used (bsc#1269066). - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599 bsc#1274743).
- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429 bsc#1262467).
- CVE-2026-3276: quadratic complexity in
unicodedata.normalize()can lead to DoS when processing specially crafted Unicode input (bsc#1267581). - CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).
- CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
- CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442 bsc#1263443).
- CVE-2026-6879: quadratic behavior in
xml.etree.ElementPathindex predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-7210:
xml.parsers.expatandxml.etree.ElementTreeuse insufficient entropy for Expat hash-flooding protection (bsc#1264962). - CVE-2026-7774:
tarfile.data_filterpath traversal bypass allows writing outside the extraction directory (bsc#1267821). - CVE-2026-8328:
ftpcp()does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268). - CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (bsc#1266669).
- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
- CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).
- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).
- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683).
- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).
- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file modification and content disclosure (bsc#1280459).
Non security issue fixed:
- Fix an error that returned non-zero exit status 1 (bsc#1277271).
- Fix regression in
http.cookies(bsc#1263083). - Update bundled pip wheels to pip-20.0.2-py2.py3-none-any.whl.
Список пакетов
Container bci/spack:latest
Container suse/kiosk/pulseaudio:latest
Container suse/kiosk/tigervnc-x11vnc:latest
Container suse/ltss/sle15.4/bci-base-fips:latest
Image SLES15-SP5-SAP-Azure-3P
Image SLES15-SP5-SAP-BYOS-Azure
Image SLES15-SP5-SAP-BYOS-EC2
Image SLES15-SP5-SAP-BYOS-GCE
Image SLES15-SP6-Hardened-BYOS
Image SLES15-SP6-Hardened-BYOS-Azure
Image SLES15-SP6-Hardened-BYOS-EC2
Image SLES15-SP6-SAP-Hardened-BYOS
Image SLES15-SP6-SAP-Hardened-BYOS-GCE
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Micro 5.3
SUSE Linux Enterprise Micro 5.4
SUSE Linux Enterprise Micro 5.5
SUSE Linux Enterprise Module for Basesystem 15 SP7
SUSE Linux Enterprise Module for Development Tools 15 SP7
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:4754-1
- E-Mail link for SUSE-SU-2026:4754-1
- SUSE Security Ratings
- SUSE Bug 1257599
- SUSE Bug 1259735
- SUSE Bug 1259989
- SUSE Bug 1261970
- SUSE Bug 1262467
- SUSE Bug 1263083
- SUSE Bug 1263443
- SUSE Bug 1264962
- SUSE Bug 1265268
- SUSE Bug 1266669
- SUSE Bug 1267581
- SUSE Bug 1267821
- SUSE Bug 1267974
- SUSE Bug 1268977
- SUSE Bug 1269066
- SUSE Bug 1269788
- SUSE Bug 1269959
Описание
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
Затронутые продукты
Ссылки
- CVE-2026-0864
- SUSE Bug 1269066
Описание
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
Затронутые продукты
Ссылки
- CVE-2026-11940
- SUSE Bug 1268977
Описание
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
Затронутые продукты
Ссылки
- CVE-2026-11972
- SUSE Bug 1269788
Описание
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
Затронутые продукты
Ссылки
- CVE-2026-13346
- SUSE Bug 1273090
Описание
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
Затронутые продукты
Ссылки
- CVE-2026-15308
- SUSE Bug 1271192
Описание
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
Затронутые продукты
Ссылки
- CVE-2026-15310
- SUSE Bug 1277111
Описание
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.
Затронутые продукты
Ссылки
- CVE-2026-15806
- SUSE Bug 1276223
Описание
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Затронутые продукты
Ссылки
- CVE-2026-1703
- SUSE Bug 1257599
Описание
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
Затронутые продукты
Ссылки
- CVE-2026-17084
- SUSE Bug 1276226
Описание
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
Затронутые продукты
Ссылки
- CVE-2026-18503
- SUSE Bug 1274683
Описание
The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.
Затронутые продукты
Ссылки
- CVE-2026-19672
- SUSE Bug 1276227
Описание
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.
Затронутые продукты
Ссылки
- CVE-2026-3219
- SUSE Bug 1262429
Описание
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
Затронутые продукты
Ссылки
- CVE-2026-3276
- SUSE Bug 1267581
Описание
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
Затронутые продукты
Ссылки
- CVE-2026-3446
- SUSE Bug 1261970
Описание
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
Затронутые продукты
Ссылки
- CVE-2026-3479
- SUSE Bug 1259989
Описание
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
Затронутые продукты
Ссылки
- CVE-2026-4224
- SUSE Bug 1259735
Описание
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Затронутые продукты
Ссылки
- CVE-2026-4360
- SUSE Bug 1269959
Описание
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Затронутые продукты
Ссылки
- CVE-2026-6019
- SUSE Bug 1262654
Описание
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
Затронутые продукты
Ссылки
- CVE-2026-6357
- SUSE Bug 1263442
Описание
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match.
Затронутые продукты
Ссылки
- CVE-2026-6879
- SUSE Bug 1273148
Описание
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
Затронутые продукты
Ссылки
- CVE-2026-7210
- SUSE Bug 1264962
Описание
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
Затронутые продукты
Ссылки
- CVE-2026-7774
- SUSE Bug 1267821
Описание
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
Затронутые продукты
Ссылки
- CVE-2026-82049
- SUSE Bug 1280459
Описание
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
Затронутые продукты
Ссылки
- CVE-2026-8328
- SUSE Bug 1265268
Описание
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
Затронутые продукты
Ссылки
- CVE-2026-8643
- SUSE Bug 1266669
Описание
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
Затронутые продукты
Ссылки
- CVE-2026-9669
- SUSE Bug 1267974