p PatchFirst

SUSE-SU-2026:4411-1

SUSE-SU-2026:4411-1 · Security update for python

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683). - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and retu (bsc#1276227). Changes for python: - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)

Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • python SUSE:Linux Enterprise Module for Package Hub 15 SP7

    Affected ranges
    • ECOSYSTEM: < 2.7.18-150000.133.1

    Update to 2.7.18-150000.133.1

  • python-base SUSE:Linux Enterprise Module for Package Hub 15 SP7

    Affected ranges
    • ECOSYSTEM: < 2.7.18-150000.133.1

    Update to 2.7.18-150000.133.1

Original sources

Check your server →