SUSE-SU-2026:4174-1: python39-core&distro=SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:4174-1 is a vulnerability in python39-core&distro=SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 14-09-2026
   PublishedVulnerability first disclosed.
2. 15-09-2026
   Last modifiedVulnerability information updated.

Description

Security update for python39.SUSE_SLE-15-SP3_Update This update for python39.SUSE_SLE-15-SP3_Update fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the `configparser` module is used (bsc#1269066). - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1274743). - CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429). - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted Unicode input (bsc#1267581). - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959). - CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction directory (bsc#1267821). - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788). - CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094). - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192). Non security issues fixed: - crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel, openssh, libssh and more packages (bsc#1211301). - Update bundled pip wheels to pip-20.0.2-py2.py3-none-any.whl

No weakness data has been published for this record.