SUSE-SU-2026:3855-1: python36-core&distro=SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:3855-1 is a vulnerability in python36-core&distro=SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 28-08-2026
   PublishedVulnerability first disclosed.
2. 04-09-2026
   Last modifiedVulnerability information updated.

Description

Security update for python36 This update for python36 fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the `configparser` module is used (bsc#1269066). - CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF bytes (bsc#1261969). - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted `wheel` archives (bsc#1257599). - CVE-2026-3219: `pip` handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file (bsc#1262467). - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted Unicode input (bsc#1267581). - CVE-2026-4360: in the `Tarfile.extract()` function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959). - CVE-2026-4786: URLs prefixed with `%action` can pass the dash-prefix safety check and allow for command injection (bsc#1262319). - CVE-2026-6019: `BaseCookie.js_output()` does not neutralize characters in cookie values embedded in JS (bsc#1262654). - CVE-2026-6100: use-after-free in decompression modules when a memory allocation fails with `MemoryError` and the decompression instance is re-used (bsc#1262098). - CVE-2026-6357: `pip` `self-update` functionality can import newly installed modules after wheel installation (bsc#1263442, bsc#1263443). - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection (bsc#1264962). - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction directory (bsc#1267821). - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268). - CVE-2026-8643: path traversal via malicious entry point name in `pip` `wheel` installation allows arbitrary file overwrite (bsc#1266669). - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977). - CVE-2026-11972: infinite loop due to improper EOF handling in the `tarfile` module streaming mode can lead to DoS (bsc#1269788). - CVE-2026-15308: incremental `HTMLParser` allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192). - Regression in `http.cookies` due to CVE-2026-6019 fix not handling non-ASCII characters correctly (bsc#1263083).

No weakness data has been published for this record.