{"schemaVersion":3,"id":"SUSE-SU-2026:4630-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for python310\n\nThis update for python310 fixes the following issues:\n\n- CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding\n  protection (bsc#1264962).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free\n  (bsc#1283969).\n- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses\n  (bsc#1283826).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python310:\n\n- Update to 3.10.22 (final release, upstream EOS)\n - Security\n - gh-158446: Fix a crash or incorrect output that could occur\n when formatting a float or complex with a precision close\n to the platform's INT_MAX. PyOS_double_to_string() now\n raises ValueError for any precision of that magnitude,\n regardless of presentation type or value, as the format\n string parsers already did for precisions above INT_MAX.\n - gh-156793: asyncio: loop.start_tls() and\n loop.create_connection() now validate the server_hostname\n argument if an ssl.SSLContext is passed with check_hostname\n set to True, emitting DeprecationWarning if server_hostname\n is missing. (This will raise ValueError in Python 3.13 and\n later.) (bsc#1283826, CVE-2026-19553)\n - gh-156793: ssl.SSLContext.wrap_bio() now validates its\n server_side, server_hostname and session arguments similar\n to ssl.SSLContext.wrap_socket(), but for backward\n compatiblity reasons emits DeprecationWarning instead of\n ValueError.\n In particular, a context with check_hostname enabled and no\n server_hostname passed to wrap_bio() now emits\n DeprecationWarning to indicate the hostname wasn't\n checked. (In Python 3.13 and later, this raises\n ValueError.)\n - gh-157265: In tarfile, when extracting a link falls back to\n extracting a member of the archive, skip the member when\n the filter function returns None when called with the\n extracted member's name replaced with the link's.\n - gh-157190: Fixed a vulnerability in the tarfile data and\n tar extraction filters where a crafted archive using a hard\n link to a symbolic link could change the permissions and\n modification time of a file outside the destination\n directory, and expose its contents inside the extracted\n tree. This addresses CVE 2026-82049.(bsc#1280459,\n CVE-2026-82049)\n - gh-157953: Update bundled libexpat to version 2.8.5.\n - gh-156002: Bound the amount of data zipfile decompresses\n per read for members compressed with bzip2, LZMA, or\n Zstandard, matching the existing limit for deflate. A small\n archive member could previously expand into an unbounded\n allocation even when read in small chunks. (bsc#1277111,\n CVE-2026-15310)\n - gh-155999: Fix the tarfile tar and data extraction filters\n creating directories outside the destination for members\n whose name leaves the destination and returns to it, such\n as ../evil/../dest/sub/file. The containment check used the\n resolved path, but intermediate directories were created\n from the name as given. (bsc#1276227, CVE-2026-19672)\n - gh-156293: Fix a crash in ssl when an sni_callback switches\n a connection to another SSLContext and the context that\n carries the callback is no longer referenced by the\n application. Servers that keep their sni_callback context\n alive (the usual case when it wraps the listening socket or\n is stored on the server object) were not affected. This\n addresses CVE-2026-19445. (bsc#1283969, CVE-2026-19445)\n - gh-155292: Change the stringprep module and encodings.idna\n codec to not consider Unicode codepoint attributes beyond\n those defined in RFC 3454. (bsc#1276226, CVE-2026-17084)\n - gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr\n credentials to the URL scheme, preventing credentials\n stored for an HTTPS URL from being used for a matching HTTP\n URL, while URIs without a scheme continue to match any\n scheme. (bsc#1276223, CVE-2026-15806)\n - gh-149018: Improved protection against XML hash-flooding\n attacks in xml.parsers.expat and xml.etree.ElementTree when\n Python is compiled with libExpat 2.8.0 or later.\n (bsc#1264962, CVE-2026-7210)\n - Library\n - gh-156002: zipfile again reads members through a\n third-party decompressor installed by monkey-patching the\n private _get_decompressor() to return an object that only\n implements old BZ2Decompressor API from Python 3.3. Note\n that decompressors without needs_input and two-argument\n decompress() are vulnerable to CVE 2026-15310.\n - gh-156353: Fix configparser parsing when using whitespace\n in delimiters.","dates":{"published":"2026-10-12T15:25:09.000Z","modified":"2026-10-13T10:30:06.861Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"python310-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","name":"python310-core","label":"python310-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python310-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","purlType":"rpm","versions":[{"text":"< 3.10.22-150400.4.129.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.22-150400.4.129.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python310-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","name":"python310-core","label":"python310-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python310-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 3.10.22-150400.4.129.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.22-150400.4.129.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python310-core&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","name":"python310-core","label":"python310-core&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python310-core&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 3.10.22-150400.4.129.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.22-150400.4.129.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python310-core&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","name":"python310-core","label":"python310-core&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python310-core&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","purlType":"rpm","versions":[{"text":"< 3.10.22-150400.4.129.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.22-150400.4.129.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python310&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","name":"python310","label":"python310&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python310&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","purlType":"rpm","versions":[{"text":"< 3.10.22-150400.4.129.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.22-150400.4.129.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python310&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","name":"python310","label":"python310&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python310&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 3.10.22-150400.4.129.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.22-150400.4.129.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python310&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","name":"python310","label":"python310&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python310&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 3.10.22-150400.4.129.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.22-150400.4.129.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python310&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","name":"python310","label":"python310&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python310&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","purlType":"rpm","versions":[{"text":"< 3.10.22-150400.4.129.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.22-150400.4.129.1","eol":null,"hubHref":null}],"affectedCount":8,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264630-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20264630-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1264962","label":"bugzilla.suse.com/1264962","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276223","label":"bugzilla.suse.com/1276223","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276226","label":"bugzilla.suse.com/1276226","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1276227","label":"bugzilla.suse.com/1276227","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1277111","label":"bugzilla.suse.com/1277111","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1280459","label":"bugzilla.suse.com/1280459","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1283826","label":"bugzilla.suse.com/1283826","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1283969","label":"bugzilla.suse.com/1283969","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15310","label":"www.suse.com/security/cve/CVE-2026-15310","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15806","label":"www.suse.com/security/cve/CVE-2026-15806","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17084","label":"www.suse.com/security/cve/CVE-2026-17084","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19445","label":"www.suse.com/security/cve/CVE-2026-19445","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19553","label":"www.suse.com/security/cve/CVE-2026-19553","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19672","label":"www.suse.com/security/cve/CVE-2026-19672","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7210","label":"www.suse.com/security/cve/CVE-2026-7210","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82049","label":"www.suse.com/security/cve/CVE-2026-82049","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-15310","CVE-2026-15806","CVE-2026-17084","CVE-2026-19445","CVE-2026-19553","CVE-2026-19672","CVE-2026-7210","CVE-2026-82049"],"downstream":[],"duplicates":[],"related":["CVE-2026-15310","CVE-2026-15806","CVE-2026-17084","CVE-2026-19445","CVE-2026-19553","CVE-2026-19672","CVE-2026-7210","CVE-2026-82049"]},"timeline":[{"kind":"published","date":"2026-10-12T15:25:09.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-13T10:30:06.861Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T04:57:48.821Z","stale":false,"partial":false}}