{ "document": { "aggregate_severity": { "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-7774: tarfile: make data_filter validate the normalised link\n target that is actually written to disk, strip trailing separators from a\n symlink member's name before resolving its directory, and reject link\n members that resolve to the destination directory itself, closing\n path-traversal bypasses of the 'data' extraction filter via crafted link\n entries (symlinks with empty or directory-like names)\n- Register TestFtpcpSecurity (CVE-2026-8328) in test_ftplib's test_main so\n regrtest actually runs the test (fixes an omission in the original\n backport; no functional change to the CVE fix itself)", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1786680256", "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1786680256" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_python/el7/advisories/2026/clsa-2026_1786680256.json" } ], "tracking": { "current_release_date": "2026-08-14T04:04:56Z", "generator": { "date": "2026-08-14T04:04:56Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1786680256", "initial_release_date": "2026-08-14T04:04:56Z", "revision_history": [ { "date": "2026-08-14T04:04:56Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "alt-python38: Fix of 2 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 7", "product": { "name": "Community Enterprise Operating System 7", "product_id": "CentOS-7", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-python38-0:3.8.20-24.el7.x86_64", "product": { "name": "alt-python38-0:3.8.20-24.el7.x86_64", "product_id": "alt-python38-0:3.8.20-24.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38@3.8.20-24.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-debug-0:3.8.20-24.el7.x86_64", "product": { "name": "alt-python38-debug-0:3.8.20-24.el7.x86_64", "product_id": "alt-python38-debug-0:3.8.20-24.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-debug@3.8.20-24.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-test-0:3.8.20-24.el7.x86_64", "product": { "name": "alt-python38-test-0:3.8.20-24.el7.x86_64", "product_id": "alt-python38-test-0:3.8.20-24.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-test@3.8.20-24.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-libs-0:3.8.20-24.el7.x86_64", "product": { "name": "alt-python38-libs-0:3.8.20-24.el7.x86_64", "product_id": "alt-python38-libs-0:3.8.20-24.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-libs@3.8.20-24.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-idle-0:3.8.20-24.el7.x86_64", "product": { "name": "alt-python38-idle-0:3.8.20-24.el7.x86_64", "product_id": "alt-python38-idle-0:3.8.20-24.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-idle@3.8.20-24.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-devel-0:3.8.20-24.el7.x86_64", "product": { "name": "alt-python38-devel-0:3.8.20-24.el7.x86_64", "product_id": "alt-python38-devel-0:3.8.20-24.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-devel@3.8.20-24.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-tkinter-0:3.8.20-24.el7.x86_64", "product": { "name": "alt-python38-tkinter-0:3.8.20-24.el7.x86_64", "product_id": "alt-python38-tkinter-0:3.8.20-24.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-tkinter@3.8.20-24.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-libs-0:3.8.20-22.el7.x86_64", "product": { "name": "alt-python38-libs-0:3.8.20-22.el7.x86_64", "product_id": "alt-python38-libs-0:3.8.20-22.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-libs@3.8.20-22.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-test-0:3.8.20-22.el7.x86_64", "product": { "name": "alt-python38-test-0:3.8.20-22.el7.x86_64", "product_id": "alt-python38-test-0:3.8.20-22.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-test@3.8.20-22.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-debug-0:3.8.20-22.el7.x86_64", "product": { "name": "alt-python38-debug-0:3.8.20-22.el7.x86_64", "product_id": "alt-python38-debug-0:3.8.20-22.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-debug@3.8.20-22.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-0:3.8.20-22.el7.x86_64", "product": { "name": "alt-python38-0:3.8.20-22.el7.x86_64", "product_id": "alt-python38-0:3.8.20-22.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38@3.8.20-22.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-devel-0:3.8.20-22.el7.x86_64", "product": { "name": "alt-python38-devel-0:3.8.20-22.el7.x86_64", "product_id": "alt-python38-devel-0:3.8.20-22.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-devel@3.8.20-22.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-idle-0:3.8.20-22.el7.x86_64", "product": { "name": "alt-python38-idle-0:3.8.20-22.el7.x86_64", "product_id": "alt-python38-idle-0:3.8.20-22.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-idle@3.8.20-22.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-tkinter-0:3.8.20-22.el7.x86_64", "product": { "name": "alt-python38-tkinter-0:3.8.20-22.el7.x86_64", "product_id": "alt-python38-tkinter-0:3.8.20-22.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-tkinter@3.8.20-22.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-0:3.8.20-20.el7.x86_64", "product": { "name": "alt-python38-0:3.8.20-20.el7.x86_64", "product_id": "alt-python38-0:3.8.20-20.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38@3.8.20-20.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-devel-0:3.8.20-20.el7.x86_64", "product": { "name": "alt-python38-devel-0:3.8.20-20.el7.x86_64", "product_id": "alt-python38-devel-0:3.8.20-20.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-devel@3.8.20-20.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-debug-0:3.8.20-20.el7.x86_64", "product": { "name": "alt-python38-debug-0:3.8.20-20.el7.x86_64", "product_id": "alt-python38-debug-0:3.8.20-20.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-debug@3.8.20-20.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-test-0:3.8.20-20.el7.x86_64", "product": { "name": "alt-python38-test-0:3.8.20-20.el7.x86_64", "product_id": "alt-python38-test-0:3.8.20-20.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-test@3.8.20-20.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-libs-0:3.8.20-20.el7.x86_64", "product": { "name": "alt-python38-libs-0:3.8.20-20.el7.x86_64", "product_id": "alt-python38-libs-0:3.8.20-20.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-libs@3.8.20-20.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-idle-0:3.8.20-20.el7.x86_64", "product": { "name": "alt-python38-idle-0:3.8.20-20.el7.x86_64", "product_id": "alt-python38-idle-0:3.8.20-20.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-idle@3.8.20-20.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-tkinter-0:3.8.20-20.el7.x86_64", "product": { "name": "alt-python38-tkinter-0:3.8.20-20.el7.x86_64", "product_id": "alt-python38-tkinter-0:3.8.20-20.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-tkinter@3.8.20-20.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-debug-0:3.8.20-19.el7.x86_64", "product": { "name": "alt-python38-debug-0:3.8.20-19.el7.x86_64", "product_id": "alt-python38-debug-0:3.8.20-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-debug@3.8.20-19.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-devel-0:3.8.20-19.el7.x86_64", "product": { "name": "alt-python38-devel-0:3.8.20-19.el7.x86_64", "product_id": "alt-python38-devel-0:3.8.20-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-devel@3.8.20-19.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-idle-0:3.8.20-19.el7.x86_64", "product": { "name": "alt-python38-idle-0:3.8.20-19.el7.x86_64", "product_id": "alt-python38-idle-0:3.8.20-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-idle@3.8.20-19.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-libs-0:3.8.20-19.el7.x86_64", "product": { "name": "alt-python38-libs-0:3.8.20-19.el7.x86_64", "product_id": "alt-python38-libs-0:3.8.20-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-libs@3.8.20-19.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-test-0:3.8.20-19.el7.x86_64", "product": { "name": "alt-python38-test-0:3.8.20-19.el7.x86_64", "product_id": "alt-python38-test-0:3.8.20-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-test@3.8.20-19.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-tkinter-0:3.8.20-19.el7.x86_64", "product": { "name": "alt-python38-tkinter-0:3.8.20-19.el7.x86_64", "product_id": "alt-python38-tkinter-0:3.8.20-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38-tkinter@3.8.20-19.el7?arch=x86_64&os_name=centos&os_version=7" } } }, { "category": "product_version", "name": "alt-python38-0:3.8.20-19.el7.x86_64", "product": { "name": "alt-python38-0:3.8.20-19.el7.x86_64", "product_id": "alt-python38-0:3.8.20-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python38@3.8.20-19.el7?arch=x86_64&os_name=centos&os_version=7" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-python38-0:3.8.20-24.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-0:3.8.20-24.el7.x86_64" }, "product_reference": "alt-python38-0:3.8.20-24.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-debug-0:3.8.20-24.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-debug-0:3.8.20-24.el7.x86_64" }, "product_reference": "alt-python38-debug-0:3.8.20-24.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-test-0:3.8.20-24.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-test-0:3.8.20-24.el7.x86_64" }, "product_reference": "alt-python38-test-0:3.8.20-24.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-libs-0:3.8.20-24.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-libs-0:3.8.20-24.el7.x86_64" }, "product_reference": "alt-python38-libs-0:3.8.20-24.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-idle-0:3.8.20-24.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-idle-0:3.8.20-24.el7.x86_64" }, "product_reference": "alt-python38-idle-0:3.8.20-24.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-devel-0:3.8.20-24.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-devel-0:3.8.20-24.el7.x86_64" }, "product_reference": "alt-python38-devel-0:3.8.20-24.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-tkinter-0:3.8.20-24.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-tkinter-0:3.8.20-24.el7.x86_64" }, "product_reference": "alt-python38-tkinter-0:3.8.20-24.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-libs-0:3.8.20-22.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-libs-0:3.8.20-22.el7.x86_64" }, "product_reference": "alt-python38-libs-0:3.8.20-22.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-test-0:3.8.20-22.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-test-0:3.8.20-22.el7.x86_64" }, "product_reference": "alt-python38-test-0:3.8.20-22.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-debug-0:3.8.20-22.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-debug-0:3.8.20-22.el7.x86_64" }, "product_reference": "alt-python38-debug-0:3.8.20-22.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-0:3.8.20-22.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-0:3.8.20-22.el7.x86_64" }, "product_reference": "alt-python38-0:3.8.20-22.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-devel-0:3.8.20-22.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-devel-0:3.8.20-22.el7.x86_64" }, "product_reference": "alt-python38-devel-0:3.8.20-22.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-idle-0:3.8.20-22.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-idle-0:3.8.20-22.el7.x86_64" }, "product_reference": "alt-python38-idle-0:3.8.20-22.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-tkinter-0:3.8.20-22.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-tkinter-0:3.8.20-22.el7.x86_64" }, "product_reference": "alt-python38-tkinter-0:3.8.20-22.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-0:3.8.20-20.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-0:3.8.20-20.el7.x86_64" }, "product_reference": "alt-python38-0:3.8.20-20.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-devel-0:3.8.20-20.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-devel-0:3.8.20-20.el7.x86_64" }, "product_reference": "alt-python38-devel-0:3.8.20-20.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-debug-0:3.8.20-20.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-debug-0:3.8.20-20.el7.x86_64" }, "product_reference": "alt-python38-debug-0:3.8.20-20.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-test-0:3.8.20-20.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-test-0:3.8.20-20.el7.x86_64" }, "product_reference": "alt-python38-test-0:3.8.20-20.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-libs-0:3.8.20-20.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-libs-0:3.8.20-20.el7.x86_64" }, "product_reference": "alt-python38-libs-0:3.8.20-20.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-idle-0:3.8.20-20.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-idle-0:3.8.20-20.el7.x86_64" }, "product_reference": "alt-python38-idle-0:3.8.20-20.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-tkinter-0:3.8.20-20.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-tkinter-0:3.8.20-20.el7.x86_64" }, "product_reference": "alt-python38-tkinter-0:3.8.20-20.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-debug-0:3.8.20-19.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-debug-0:3.8.20-19.el7.x86_64" }, "product_reference": "alt-python38-debug-0:3.8.20-19.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-devel-0:3.8.20-19.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-devel-0:3.8.20-19.el7.x86_64" }, "product_reference": "alt-python38-devel-0:3.8.20-19.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-idle-0:3.8.20-19.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-idle-0:3.8.20-19.el7.x86_64" }, "product_reference": "alt-python38-idle-0:3.8.20-19.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-libs-0:3.8.20-19.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-libs-0:3.8.20-19.el7.x86_64" }, "product_reference": "alt-python38-libs-0:3.8.20-19.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-test-0:3.8.20-19.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-test-0:3.8.20-19.el7.x86_64" }, "product_reference": "alt-python38-test-0:3.8.20-19.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-tkinter-0:3.8.20-19.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-tkinter-0:3.8.20-19.el7.x86_64" }, "product_reference": "alt-python38-tkinter-0:3.8.20-19.el7.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python38-0:3.8.20-19.el7.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:alt-python38-0:3.8.20-19.el7.x86_64" }, "product_reference": "alt-python38-0:3.8.20-19.el7.x86_64", "relates_to_product_reference": "CentOS-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-3276", "cwe": { "id": "CWE-407", "name": "Inefficient Algorithmic Complexity" }, "notes": [ { "category": "description", "text": "unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:alt-python38-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-24.el7.x86_64" ], "known_affected": [ "CentOS-7:alt-python38-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-22.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-3276" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0", "url": "https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598", "url": "https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f", "url": "https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32", "url": "https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066", "url": "https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f", "url": "https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc", "url": "https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c", "url": "https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c" }, { "category": "external", "summary": "https://github.com/python/cpython/issues/149079", "url": "https://github.com/python/cpython/issues/149079" }, { "category": "external", "summary": "https://github.com/python/cpython/pull/149080", "url": "https://github.com/python/cpython/pull/149080" }, { "category": "external", "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/06/03/15", "url": "http://www.openwall.com/lists/oss-security/2026/06/03/15" } ], "release_date": "2026-06-03T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-14T04:04:18.475952Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1786680256", "product_ids": [ "CentOS-7:alt-python38-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-24.el7.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1786680256" }, { "category": "none_available", "date": "2026-06-03T16:16:00Z", "details": "Affected", "product_ids": [ "CentOS-7:alt-python38-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-22.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-7774", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "description", "text": "tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:alt-python38-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-24.el7.x86_64" ], "known_affected": [ "CentOS-7:alt-python38-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-22.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-7774" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/0478bd83d82b255e0f29f613367a59d261e7eaa2", "url": "https://github.com/python/cpython/commit/0478bd83d82b255e0f29f613367a59d261e7eaa2" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/0d28f5e46e151718972dfabd91205444d0037b6d", "url": "https://github.com/python/cpython/commit/0d28f5e46e151718972dfabd91205444d0037b6d" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/10a13bee3c24f9c62b602e696334ff2272a40efc", "url": "https://github.com/python/cpython/commit/10a13bee3c24f9c62b602e696334ff2272a40efc" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/578411982c16f753f4893532510099ef665117da", "url": "https://github.com/python/cpython/commit/578411982c16f753f4893532510099ef665117da" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/5cf47a248c35c375d610b87b2f72fd1ed454b558", "url": "https://github.com/python/cpython/commit/5cf47a248c35c375d610b87b2f72fd1ed454b558" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/74cca9a92fb7d653e404843a56b8bdc7b0afdbbf", "url": "https://github.com/python/cpython/commit/74cca9a92fb7d653e404843a56b8bdc7b0afdbbf" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/c063191cb7f9170f9565e305f8aa2b79ab2bf609", "url": "https://github.com/python/cpython/commit/c063191cb7f9170f9565e305f8aa2b79ab2bf609" }, { "category": "external", "summary": "https://github.com/python/cpython/issues/149486", "url": "https://github.com/python/cpython/issues/149486" }, { "category": "external", "summary": "https://github.com/python/cpython/pull/149487", "url": "https://github.com/python/cpython/pull/149487" }, { "category": "external", "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/4FU62L2M6RMMHT2QPGQNPEHHUND7CEX5/", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/4FU62L2M6RMMHT2QPGQNPEHHUND7CEX5/" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/06/04/9", "url": "http://www.openwall.com/lists/oss-security/2026/06/04/9" } ], "release_date": "2026-06-04T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-14T04:04:18.475952Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1786680256", "product_ids": [ "CentOS-7:alt-python38-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-24.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-24.el7.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1786680256" }, { "category": "none_available", "date": "2026-06-04T16:16:00Z", "details": "Affected", "product_ids": [ "CentOS-7:alt-python38-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-debug-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-devel-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-idle-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-libs-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-test-0:3.8.20-22.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-19.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-20.el7.x86_64", "CentOS-7:alt-python38-tkinter-0:3.8.20-22.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }