Описание
Security update for python313
This update for python313 fixes the following issues:
- CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
- CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
configparsermodule is used (bsc#1269066). - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
- CVE-2026-8328:
ftpcp()does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268). - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1257041
- SUSE Bug 1257044
- SUSE Bug 1265268
- SUSE Bug 1268977
- SUSE Bug 1269066
- SUSE Bug 1269788
- SUSE Bug 1269959
- SUSE Bug 1271192
- SUSE CVE CVE-2025-15366 page
- SUSE CVE CVE-2025-15367 page
- SUSE CVE CVE-2026-0864 page
- SUSE CVE CVE-2026-11940 page
- SUSE CVE CVE-2026-11972 page
- SUSE CVE CVE-2026-15308 page
- SUSE CVE CVE-2026-4360 page
- SUSE CVE CVE-2026-8328 page
Описание
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Затронутые продукты
Ссылки
- CVE-2025-15366
- SUSE Bug 1257044
Описание
The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Затронутые продукты
Ссылки
- CVE-2025-15367
- SUSE Bug 1257041
Описание
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
Затронутые продукты
Ссылки
- CVE-2026-0864
- SUSE Bug 1269066
Описание
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
Затронутые продукты
Ссылки
- CVE-2026-11940
- SUSE Bug 1268977
Описание
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
Затронутые продукты
Ссылки
- CVE-2026-11972
- SUSE Bug 1269788
Описание
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
Затронутые продукты
Ссылки
- CVE-2026-15308
- SUSE Bug 1271192
Описание
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Затронутые продукты
Ссылки
- CVE-2026-4360
- SUSE Bug 1269959
Описание
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
Затронутые продукты
Ссылки
- CVE-2026-8328
- SUSE Bug 1265268