SUSE-SU-2026:23212-1

SUSE-SU-2026:23212-1 · Security update for python311

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Diese Seite zeigt ausgewählte Angaben aus den Quellen. Die vollständige Beschreibung und betroffene Versionen finden Sie in den verlinkten Sicherheitshinweisen.

This update for python311 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the `configparser` module is used (bsc#1269066). - CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969). - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted Unicode input (bsc#1267581). - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959). - CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319). - CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters (bsc#1262654). - CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098). - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection (bsc#1264962). - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction directory (bsc#1267821). - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268). - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977). - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788). - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192). Non security issues fixed: - Regression in `http.cookies` (bsc#1263083). - udplite was removed -> python fails in tests (bsc#1268375). - Conflicts between different versions of Python (bsc#1258364).

Korrektur verfügbar

Veröffentlicht

2026-08-18T11:57:55Z

Aktualisiert

2026-08-26T18:23:32.504384216Z

Technologie-Stack: system

Prüfen Sie Ihren Server →