PatchFirst · Aktuelle Sicherheitslücken
In den letzten 30 Tagen veröffentlichte Sicherheitslücken für python-base: 3. Davon im KEV-Katalog: 0.
Sicherheitslücken: 18
This update for python fixes the following issue: - CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free (bsc#1283969).
This update for python fixes the following issue: - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file modification and content disclosure (bsc#1280459).
This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consu
This update for python fixes the following issues: Security issues fixed: - CVE-2026-13346: pip: arbitrary file installation via malicious package indexes (bsc#1273091). Non security issue fixed: - Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl
This update for python fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the `configparser` module is used (bsc#1269066). - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599). - CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262467). - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted Unicode input (bsc#1267581). - CVE-2026-6357: pip self-update functionality can imp
This update for python fixes the following issues - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599). - CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429). - CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319). - CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters (bsc#1262654). - CVE-2026-6100: arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098). - CVE-2026-6357: pip self-updat
This update for python fixes the following issue: - CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).
This update for python fixes the following issues: - CVE-2026-3479: improper resource argument validation in `pkgutil.get_data` can allow path traversal (bsc#1259989).
This update for python fixes the following issues: - CVE-2025-13462: incorrect parsing of TarInfo when GNU long name and type AREGTYPE are combined can lead to misinterpretation of tar archives (bsc#1259611). - CVE-2026-3644: incomplete control character validation in http.cookies can lead to input validation bypass (bsc#1259734). - CVE-2026-4224: parsing XML with deeply nested DTD content models can lead to C stack overflow (bsc#1259735). - CVE-2026-4519: failure to sanitize leading dashes in URLs in the `webbrowser.open()` API can lead to web browser command line option injection (bsc#1260026).
This update for python fixes the following issue: - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in `BytesGenerator` (bsc#1257181).
This update for python fixes the following issue: - CVE-2024-7592: uncontrolled CPU resource consumption when in http.cookies module (bsc#1229596).
This update for python fixes the following issues: - CVE-2026-0672: Fixed a HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel. (bsc#1257031) - CVE-2026-0865: Fixed a bug where a user-controlled header containing newlines can allow injecting HTTP headers. (bsc#1257042) - CVE-2025-15366: Fixed a bug wherer a user-controlled command can allow additional commands injected using newlines. (bsc#1257044) - CVE-2025-15367: Fixed control characters which may allow the injection of additional commands. (bsc#1257041)
This update for python fixes the following issues: - Modified CVE-2025-6075 fix to not use `re.ASCII` flag (not available in Python 2.7) (bsc#1257064).
This update for python fixes the following issues: - CVE-2025-13836: Fixed reading an HTTP response from a server, if no read amount is specified, with using Content-Length per default as the length (bsc#1254400) - CVE-2025-12084: Fixed Denial of Service due to quadratic algorithm in xml.dom.minidom (bsc#1254997).
This update for python fixes the following issues: - CVE-2025-6075: quadratic complexity in `os.path.expandvars()` can lead to performance degradation when values passed to it are user-controlled (bsc#1252974). - CVE-2025-8291: lack of validity checks on the ZIP64 End of Central Directory (EOCD) record allows for the creation of ZIP archives that are processed inconsistently by the `zipfile` module (bsc#1251305).
This update for python fixes the following issues: - CVE-2025-8291: Check the validity the ZIP64 End of Central Directory (EOCD). (bsc#1251305)
This update for python fixes the following issues: - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).
This update for python fixes the following issues: - CVE-2025-6069: Fixed worst case quadratic complexity that can lead to amplified DoS. (bsc#1244705)
Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.