p PatchFirst

SUSE-SU-2026:4743-1

SUSE-SU-2026:4743-1 · Security update for python36

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

This update for python36 fixes the following issues: Security issues fixed: - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1274743). - CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429). - CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970). - CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989). - CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735). - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094). - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683). - CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227). - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file modification and content disclosure (bsc#1280459). Non security issue fixed: - Update bundled setuptools wheels to setuptools-44.1.1-py2.py3-none-any.whl (bsc#1277271)

Correctif disponible

Publication
Mise à jour

Pile logicielle: system

Produits et versions concernés

  • python36 SUSE:Linux Enterprise Server 12 SP5-LTSS

    Plages de versions concernées
    • ECOSYSTEM: < 3.6.15-125.1

    Mettez à jour vers 3.6.15-125.1

  • python36-core SUSE:Linux Enterprise Server 12 SP5-LTSS

    Plages de versions concernées
    • ECOSYSTEM: < 3.6.15-125.1

    Mettez à jour vers 3.6.15-125.1

  • python36 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5

    Plages de versions concernées
    • ECOSYSTEM: < 3.6.15-125.1

    Mettez à jour vers 3.6.15-125.1

  • python36-core SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5

    Plages de versions concernées
    • ECOSYSTEM: < 3.6.15-125.1

    Mettez à jour vers 3.6.15-125.1

Sources originales

Vérifiez votre serveur →