Release date:
2026-09-29 13:13:34 UTC
Description:
* SECURITY UPDATE: tarfile: honor a None result from the link-fallback
filter call, so a custom filter that returns None for the renamed
member no longer has its decision silently discarded
- CVE-2026-87910
* SECURITY UPDATE: tarfile: normalize member names that leave the
destination and come back, so the tar and data filters no longer
create intermediate directories outside the destination
(upstream commit 97688346, test carried as merged)
- CVE-2026-19672
- Behaviour change: the tar and data filters now rewrite member names
containing '..' with os.path.normpath(); this drops internal '..'
components and may change the meaning of a name that traverses
symbolic links.
Updated packages:
-
alt-python314_3.14.7-3_amd64.deb
sha:bca7f54a8d9979baeba8fe8bd7ef00b3fb2efbed
-
alt-python314-debug_3.14.7-3_amd64.deb
sha:e27f7a530c63f4a8e8921dae0e1bc268a683458f
-
alt-python314-devel_3.14.7-3_amd64.deb
sha:9c73a2329ceeec8fa41e26f2055197dc1ca854e3
-
alt-python314-idle_3.14.7-3_amd64.deb
sha:b717b0a6d1239f10563199722babf8c3b584224b
-
alt-python314-libs_3.14.7-3_amd64.deb
sha:b88fb4f0cbc6f4177ef7b604081250654629b6ba
-
alt-python314-test_3.14.7-3_amd64.deb
sha:bdad482c61c7e3bc3472c024a3674c97e95614a8
-
alt-python314-tkinter_3.14.7-3_amd64.deb
sha:33dad4701a4d8ff59a12b019121be589cc8fffdf
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
