[CLSA-2026:1776324400] Fix CVE(s): CVE-2022-40897, CVE-2024-6345, CVE-2025-47273

Type:

security

Severity:

('Important', ['ELSLANG-26190', 'ELSLANG-26187', 'ELSLANG-26184'])

Release date:

2026-04-16 07:26:44 UTC

Description:

   * SECURITY UPDATE: regex denial of service via crafted HTML
     - debian/patches/CVE-2022-40897.patch: limit whitespace matching in REL regex
     - CVE-2022-40897
   * SECURITY UPDATE: remote code execution via command injection in VCS downloads
     - debian/patches/CVE-2024-6345.patch: replace os.system with subprocess.check_call
     - CVE-2024-6345
   * SECURITY UPDATE: path traversal in download filename resolution
     - debian/patches/CVE-2025-47273.patch: validate download filename stays within tmpdir
     - CVE-2025-47273

Updated packages:

alt-python37-setuptools_58.3.0-3_all.deb
sha:5b57a060c63707e1403de6c4030aea1298f5b8d8
alt-python37-setuptools-wheel_58.3.0-3_all.deb
sha:f348f3c63487385fe9ac964cc8bd0db4f6d054d5

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.