[CLSA-2026:1790686186] Fix CVE(s): CVE-2026-19672, CVE-2026-87910
Type:
security
Severity:
Moderate
Release date:
2026-09-29 12:49:57 UTC
Description:
* SECURITY UPDATE: tarfile: honor a None result from the link-fallback filter call, so a custom filter that returns None for the renamed member no longer has its decision silently discarded - CVE-2026-87910 * SECURITY UPDATE: tarfile: normalize member names that leave the destination and come back, so the tar and data filters no longer create intermediate directories outside the destination (upstream commit 97688346, test carried as merged) - CVE-2026-19672 - Behaviour change: the tar and data filters now rewrite member names containing '..' with os.path.normpath(); this drops internal '..' components and may change the meaning of a name that traverses symbolic links.
CVEs fixed:
Updated packages:
  • alt-python314_3.14.7-3_amd64.deb
    sha:9e6490ee5438023f758e966af0507aa8bd346639
  • alt-python314-debug_3.14.7-3_amd64.deb
    sha:a139345432b3b0b6ca8503203aae9106f4d9fc5c
  • alt-python314-devel_3.14.7-3_amd64.deb
    sha:2cd365f582282b95af18f382446574221cb9a2c9
  • alt-python314-idle_3.14.7-3_amd64.deb
    sha:4b080eaed1b0cc415d4080575d9e051bacd2a0ed
  • alt-python314-libs_3.14.7-3_amd64.deb
    sha:a2c60ac41e6d996f17caddef9e7d65c5935bf3c9
  • alt-python314-test_3.14.7-3_amd64.deb
    sha:d82cfc52870ca05c0263d7bf14cba224f43ac088
  • alt-python314-tkinter_3.14.7-3_amd64.deb
    sha:bbb78ab9564272d09f57fac07dadaf3fba1dee03
  • alt-python314_3.14.7-3_arm64.deb
    sha:efab4a224afe8022fe34792e479ab1464490ccaa
  • alt-python314-debug_3.14.7-3_arm64.deb
    sha:2216d8ae69ee1bbb8eef35b5701cd5b5c692a831
  • alt-python314-devel_3.14.7-3_arm64.deb
    sha:767f20271cc45c779a893eedaeccb92af53b2749
  • alt-python314-idle_3.14.7-3_arm64.deb
    sha:54bb3612c2205e34edfd8006826e188dd6522606
  • alt-python314-libs_3.14.7-3_arm64.deb
    sha:6677f8d2ec57ce0e4bfc615640f6c1aa10281a7c
  • alt-python314-test_3.14.7-3_arm64.deb
    sha:277e4b8b51d73109f60285d60120c5672785a41e
  • alt-python314-tkinter_3.14.7-3_arm64.deb
    sha:7e5b71213e9ffb9ce35a4c3b4061f83ff1380ece
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.