[CLSA-2026:1790685935] Fix CVE(s): CVE-2026-19672, CVE-2026-87910
Type:
security
Severity:
Moderate
Release date:
2026-09-29 12:45:49 UTC
Description:
* SECURITY UPDATE: tarfile: honor a None result from the link-fallback filter call, so a custom filter that returns None for the renamed member no longer has its decision silently discarded - CVE-2026-87910 * SECURITY UPDATE: tarfile: normalize member names that leave the destination and come back, so the tar and data filters no longer create intermediate directories outside the destination (upstream commit 97688346, test carried as merged) - CVE-2026-19672 - Behaviour change: the tar and data filters now rewrite member names containing '..' with os.path.normpath(); this drops internal '..' components and may change the meaning of a name that traverses symbolic links.
CVEs fixed:
Updated packages:
  • alt-python314_3.14.7-3_amd64.deb
    sha:97083b4bbfe8edf32caa4f78a2f8b6403b156f4a
  • alt-python314-debug_3.14.7-3_amd64.deb
    sha:a139345432b3b0b6ca8503203aae9106f4d9fc5c
  • alt-python314-devel_3.14.7-3_amd64.deb
    sha:a5aa798120694b2e89494ce84477e658664aac29
  • alt-python314-idle_3.14.7-3_amd64.deb
    sha:d83512f8ac3a7f9c1138f0b47c6e7551fc209df6
  • alt-python314-libs_3.14.7-3_amd64.deb
    sha:7ff495b0565f46c836ad799cdc99cd692174e409
  • alt-python314-test_3.14.7-3_amd64.deb
    sha:902177893788b78a277fa08cbb365d80b3dbd657
  • alt-python314-tkinter_3.14.7-3_amd64.deb
    sha:19b0865394465f271b76094db1c8247a9ff8db4c
  • alt-python314_3.14.7-3_arm64.deb
    sha:0c427b1c20ea792e567018a5993bd5c309374a21
  • alt-python314-debug_3.14.7-3_arm64.deb
    sha:2216d8ae69ee1bbb8eef35b5701cd5b5c692a831
  • alt-python314-devel_3.14.7-3_arm64.deb
    sha:e6f22bbb5e225fd584621dca99631e1d91d50e56
  • alt-python314-idle_3.14.7-3_arm64.deb
    sha:213202bd4386e90428c00bce0d8f0c4a6945e5d0
  • alt-python314-libs_3.14.7-3_arm64.deb
    sha:8edb1283a9e4928091f0aa68c8d1ac0d1ab439cb
  • alt-python314-test_3.14.7-3_arm64.deb
    sha:491ebfb29764364358b390c4dc1d9bd03f6b70ce
  • alt-python314-tkinter_3.14.7-3_arm64.deb
    sha:595b7ca261d92a07e13e948c2036a75d44d02727
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.