{
  "document": {
    "aggregate_severity": {
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      },
      {
        "category": "details",
        "text": "* SECURITY UPDATE: tarfile ignored a \"skip this member\" answer from a\n     custom extraction filter on the hard-link fallback. The CVE-2026-11940\n     hardening re-validates a link's target under the link's own name before\n     extracting it as a copy, but makelink_with_filter() threw that call's\n     return value away and the next line overwrote it with the result of the\n     ordinary filter call. A filter that returns None - the documented PEP 706\n     way to say \"skip\" - was therefore ignored for the re-rooted member, and\n     the member was extracted anyway at the link's shallower name, exactly the\n     placement the filter had declined. The bundled \"data\" and \"tar\" filters\n     raise instead of returning None, so only custom filter callables are\n     affected.\n     - debian/patches/CVE-2026-87910.patch: backport of cpython\n       9c17bace90f88dfba6d0e2fe23c8e7ae35f83955 (gh-157265, GH-157266,\n       GH-157308), the 3.13-branch form of the fix, together with its test\n       follow-up d9565e54b1fc6d63c5be9afd58114499128fa57b. The two added lines\n       are upstream's verbatim; only the hunk anchor differs. The upstream test\n       test_extract_filters_target_none is carried too, minus the @symlink_test\n       decorator and with os_helper.can_symlink() spelled\n       support.can_symlink(), neither of which exists in 3.7.\n     - Applied strictly after CVE-2026-11940.patch in all three packaging\n       paths: that patch is carried by this package rather than native to\n       3.7, and it supplies the re-rooted filter call this fix repairs.\n       Reordering the two would leave this patch nothing to apply against.\n     - CVE-2026-87910\n   * SECURITY UPDATE: the tarfile \"tar\" and \"data\" extraction filters created\n     directories outside the destination for a member whose name leaves the\n     destination and comes back, such as \"../evil/../dest/sub/file\".\n     _get_filtered_attrs() decided containment on the resolved path, which for\n     such a name lands back inside and passes the check, but tarfile creates\n     the intermediate directories from the name as given and so walked out of\n     the destination on the way, leaving an attacker-named directory beside it.\n     Normalizing the name before the check, and writing the normalized form\n     back into the member attributes, makes the directories that get created\n     match the path that was validated.\n     - debian/patches/CVE-2026-19672.patch: backport of cpython\n       97688346ada2df3e5b9c279348862c3d64ab0823 (gh-155999, GH-156000). The\n       seven added lines and all of their context are upstream's verbatim; the\n       hunk applies to this tree unchanged. The upstream regression test\n       test_parent_dir_out_and_back is carried as merged, only re-anchored,\n       because this tree's test_parent_symlink has no @symlink_test decorator\n       for the hunk to end on.\n     - Behaviour change: the \"tar\" and \"data\" filters now normalize member\n       names containing \"..\" with os.path.normpath(), which removes internal\n       \"..\" components and may change the meaning of a name that traverses\n       symbolic links.\n     - This CVE reaches this package only because the PEP 706 extraction\n       filters are backported here by CVE-2007-4559.patch and the\n       realpath(strict=ALLOW_MISSING) containment check by CVE-2026-7774.patch;\n       upstream 3.7 has no filter machinery at all. The patch is\n       therefore ordered after every other tarfile-touching patch in all three\n       packaging paths.\n     - CVE-2026-19672\n   * The Misc/NEWS.d fragments of both upstream commits are omitted; this\n     version ships a single Misc/NEWS file.",
        "title": "Details"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790680734",
        "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790680734"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_alt_python/debian11/advisories/2026/clsa-2026_1790680734.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-09-29T11:19:44Z",
      "generator": {
        "date": "2026-09-29T11:19:44Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CLSA-2026:1790680734",
      "initial_release_date": "2026-09-29T11:19:44Z",
      "revision_history": [
        {
          "date": "2026-09-29T11:19:44Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    },
    "title": "Fix CVE(s): CVE-2026-19672, CVE-2026-87910"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Debian 11",
                "product": {
                  "name": "Debian 11",
                  "product_id": "Debian-11",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Debian"
          }
        ],
        "category": "vendor",
        "name": "Software in the Public Interest, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "alt-python37-debug-0:3.7.17-33.amd64",
                "product": {
                  "name": "alt-python37-debug-0:3.7.17-33.amd64",
                  "product_id": "alt-python37-debug-0:3.7.17-33.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-debug@3.7.17-33?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-libs-0:3.7.17-33.amd64",
                "product": {
                  "name": "alt-python37-libs-0:3.7.17-33.amd64",
                  "product_id": "alt-python37-libs-0:3.7.17-33.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-libs@3.7.17-33?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-devel-0:3.7.17-33.amd64",
                "product": {
                  "name": "alt-python37-devel-0:3.7.17-33.amd64",
                  "product_id": "alt-python37-devel-0:3.7.17-33.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-devel@3.7.17-33?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-test-0:3.7.17-33.amd64",
                "product": {
                  "name": "alt-python37-test-0:3.7.17-33.amd64",
                  "product_id": "alt-python37-test-0:3.7.17-33.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-test@3.7.17-33?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-tools-0:3.7.17-33.amd64",
                "product": {
                  "name": "alt-python37-tools-0:3.7.17-33.amd64",
                  "product_id": "alt-python37-tools-0:3.7.17-33.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-tools@3.7.17-33?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-tkinter-0:3.7.17-33.amd64",
                "product": {
                  "name": "alt-python37-tkinter-0:3.7.17-33.amd64",
                  "product_id": "alt-python37-tkinter-0:3.7.17-33.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-tkinter@3.7.17-33?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-0:3.7.17-33.amd64",
                "product": {
                  "name": "alt-python37-0:3.7.17-33.amd64",
                  "product_id": "alt-python37-0:3.7.17-33.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37@3.7.17-33?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-devel-0:3.7.17-32.amd64",
                "product": {
                  "name": "alt-python37-devel-0:3.7.17-32.amd64",
                  "product_id": "alt-python37-devel-0:3.7.17-32.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-devel@3.7.17-32?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-tools-0:3.7.17-32.amd64",
                "product": {
                  "name": "alt-python37-tools-0:3.7.17-32.amd64",
                  "product_id": "alt-python37-tools-0:3.7.17-32.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-tools@3.7.17-32?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-0:3.7.17-32.amd64",
                "product": {
                  "name": "alt-python37-0:3.7.17-32.amd64",
                  "product_id": "alt-python37-0:3.7.17-32.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37@3.7.17-32?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-test-0:3.7.17-32.amd64",
                "product": {
                  "name": "alt-python37-test-0:3.7.17-32.amd64",
                  "product_id": "alt-python37-test-0:3.7.17-32.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-test@3.7.17-32?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-libs-0:3.7.17-32.amd64",
                "product": {
                  "name": "alt-python37-libs-0:3.7.17-32.amd64",
                  "product_id": "alt-python37-libs-0:3.7.17-32.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-libs@3.7.17-32?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-debug-0:3.7.17-32.amd64",
                "product": {
                  "name": "alt-python37-debug-0:3.7.17-32.amd64",
                  "product_id": "alt-python37-debug-0:3.7.17-32.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-debug@3.7.17-32?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-tkinter-0:3.7.17-32.amd64",
                "product": {
                  "name": "alt-python37-tkinter-0:3.7.17-32.amd64",
                  "product_id": "alt-python37-tkinter-0:3.7.17-32.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-tkinter@3.7.17-32?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-devel-0:3.7.17-31.amd64",
                "product": {
                  "name": "alt-python37-devel-0:3.7.17-31.amd64",
                  "product_id": "alt-python37-devel-0:3.7.17-31.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-devel@3.7.17-31?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-0:3.7.17-31.amd64",
                "product": {
                  "name": "alt-python37-0:3.7.17-31.amd64",
                  "product_id": "alt-python37-0:3.7.17-31.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37@3.7.17-31?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-libs-0:3.7.17-31.amd64",
                "product": {
                  "name": "alt-python37-libs-0:3.7.17-31.amd64",
                  "product_id": "alt-python37-libs-0:3.7.17-31.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-libs@3.7.17-31?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-test-0:3.7.17-31.amd64",
                "product": {
                  "name": "alt-python37-test-0:3.7.17-31.amd64",
                  "product_id": "alt-python37-test-0:3.7.17-31.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-test@3.7.17-31?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-tkinter-0:3.7.17-31.amd64",
                "product": {
                  "name": "alt-python37-tkinter-0:3.7.17-31.amd64",
                  "product_id": "alt-python37-tkinter-0:3.7.17-31.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-tkinter@3.7.17-31?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-tools-0:3.7.17-31.amd64",
                "product": {
                  "name": "alt-python37-tools-0:3.7.17-31.amd64",
                  "product_id": "alt-python37-tools-0:3.7.17-31.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-tools@3.7.17-31?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-debug-0:3.7.17-31.amd64",
                "product": {
                  "name": "alt-python37-debug-0:3.7.17-31.amd64",
                  "product_id": "alt-python37-debug-0:3.7.17-31.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-debug@3.7.17-31?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-debug-0:3.7.17-30.amd64",
                "product": {
                  "name": "alt-python37-debug-0:3.7.17-30.amd64",
                  "product_id": "alt-python37-debug-0:3.7.17-30.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-debug@3.7.17-30?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-test-0:3.7.17-30.amd64",
                "product": {
                  "name": "alt-python37-test-0:3.7.17-30.amd64",
                  "product_id": "alt-python37-test-0:3.7.17-30.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-test@3.7.17-30?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-tkinter-0:3.7.17-30.amd64",
                "product": {
                  "name": "alt-python37-tkinter-0:3.7.17-30.amd64",
                  "product_id": "alt-python37-tkinter-0:3.7.17-30.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-tkinter@3.7.17-30?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-tools-0:3.7.17-30.amd64",
                "product": {
                  "name": "alt-python37-tools-0:3.7.17-30.amd64",
                  "product_id": "alt-python37-tools-0:3.7.17-30.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-tools@3.7.17-30?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-0:3.7.17-30.amd64",
                "product": {
                  "name": "alt-python37-0:3.7.17-30.amd64",
                  "product_id": "alt-python37-0:3.7.17-30.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37@3.7.17-30?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-libs-0:3.7.17-30.amd64",
                "product": {
                  "name": "alt-python37-libs-0:3.7.17-30.amd64",
                  "product_id": "alt-python37-libs-0:3.7.17-30.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-libs@3.7.17-30?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-devel-0:3.7.17-30.amd64",
                "product": {
                  "name": "alt-python37-devel-0:3.7.17-30.amd64",
                  "product_id": "alt-python37-devel-0:3.7.17-30.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/alt-python37-devel@3.7.17-30?arch=amd64&os_name=debian&os_version=11"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-debug-0:3.7.17-33.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-debug-0:3.7.17-33.amd64"
        },
        "product_reference": "alt-python37-debug-0:3.7.17-33.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-libs-0:3.7.17-33.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-libs-0:3.7.17-33.amd64"
        },
        "product_reference": "alt-python37-libs-0:3.7.17-33.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-devel-0:3.7.17-33.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-devel-0:3.7.17-33.amd64"
        },
        "product_reference": "alt-python37-devel-0:3.7.17-33.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-test-0:3.7.17-33.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-test-0:3.7.17-33.amd64"
        },
        "product_reference": "alt-python37-test-0:3.7.17-33.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tools-0:3.7.17-33.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-tools-0:3.7.17-33.amd64"
        },
        "product_reference": "alt-python37-tools-0:3.7.17-33.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tkinter-0:3.7.17-33.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-tkinter-0:3.7.17-33.amd64"
        },
        "product_reference": "alt-python37-tkinter-0:3.7.17-33.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-0:3.7.17-33.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-0:3.7.17-33.amd64"
        },
        "product_reference": "alt-python37-0:3.7.17-33.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-devel-0:3.7.17-32.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-devel-0:3.7.17-32.amd64"
        },
        "product_reference": "alt-python37-devel-0:3.7.17-32.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tools-0:3.7.17-32.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-tools-0:3.7.17-32.amd64"
        },
        "product_reference": "alt-python37-tools-0:3.7.17-32.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-0:3.7.17-32.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-0:3.7.17-32.amd64"
        },
        "product_reference": "alt-python37-0:3.7.17-32.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-test-0:3.7.17-32.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-test-0:3.7.17-32.amd64"
        },
        "product_reference": "alt-python37-test-0:3.7.17-32.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-libs-0:3.7.17-32.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-libs-0:3.7.17-32.amd64"
        },
        "product_reference": "alt-python37-libs-0:3.7.17-32.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-debug-0:3.7.17-32.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-debug-0:3.7.17-32.amd64"
        },
        "product_reference": "alt-python37-debug-0:3.7.17-32.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tkinter-0:3.7.17-32.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-tkinter-0:3.7.17-32.amd64"
        },
        "product_reference": "alt-python37-tkinter-0:3.7.17-32.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-devel-0:3.7.17-31.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-devel-0:3.7.17-31.amd64"
        },
        "product_reference": "alt-python37-devel-0:3.7.17-31.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-0:3.7.17-31.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-0:3.7.17-31.amd64"
        },
        "product_reference": "alt-python37-0:3.7.17-31.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-libs-0:3.7.17-31.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-libs-0:3.7.17-31.amd64"
        },
        "product_reference": "alt-python37-libs-0:3.7.17-31.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-test-0:3.7.17-31.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-test-0:3.7.17-31.amd64"
        },
        "product_reference": "alt-python37-test-0:3.7.17-31.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tkinter-0:3.7.17-31.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-tkinter-0:3.7.17-31.amd64"
        },
        "product_reference": "alt-python37-tkinter-0:3.7.17-31.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tools-0:3.7.17-31.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-tools-0:3.7.17-31.amd64"
        },
        "product_reference": "alt-python37-tools-0:3.7.17-31.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-debug-0:3.7.17-31.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-debug-0:3.7.17-31.amd64"
        },
        "product_reference": "alt-python37-debug-0:3.7.17-31.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-debug-0:3.7.17-30.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-debug-0:3.7.17-30.amd64"
        },
        "product_reference": "alt-python37-debug-0:3.7.17-30.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-test-0:3.7.17-30.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-test-0:3.7.17-30.amd64"
        },
        "product_reference": "alt-python37-test-0:3.7.17-30.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tkinter-0:3.7.17-30.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-tkinter-0:3.7.17-30.amd64"
        },
        "product_reference": "alt-python37-tkinter-0:3.7.17-30.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tools-0:3.7.17-30.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-tools-0:3.7.17-30.amd64"
        },
        "product_reference": "alt-python37-tools-0:3.7.17-30.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-0:3.7.17-30.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-0:3.7.17-30.amd64"
        },
        "product_reference": "alt-python37-0:3.7.17-30.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-libs-0:3.7.17-30.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-libs-0:3.7.17-30.amd64"
        },
        "product_reference": "alt-python37-libs-0:3.7.17-30.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-devel-0:3.7.17-30.amd64 as a component of Debian 11",
          "product_id": "Debian-11:alt-python37-devel-0:3.7.17-30.amd64"
        },
        "product_reference": "alt-python37-devel-0:3.7.17-30.amd64",
        "relates_to_product_reference": "Debian-11"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-19672",
      "notes": [
        {
          "category": "description",
          "text": "The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.\n",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:alt-python37-0:3.7.17-33.amd64",
          "Debian-11:alt-python37-debug-0:3.7.17-33.amd64",
          "Debian-11:alt-python37-devel-0:3.7.17-33.amd64",
          "Debian-11:alt-python37-libs-0:3.7.17-33.amd64",
          "Debian-11:alt-python37-test-0:3.7.17-33.amd64",
          "Debian-11:alt-python37-tkinter-0:3.7.17-33.amd64",
          "Debian-11:alt-python37-tools-0:3.7.17-33.amd64"
        ],
        "known_affected": [
          "Debian-11:alt-python37-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-0:3.7.17-32.amd64",
          "Debian-11:alt-python37-debug-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-debug-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-debug-0:3.7.17-32.amd64",
          "Debian-11:alt-python37-devel-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-devel-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-devel-0:3.7.17-32.amd64",
          "Debian-11:alt-python37-libs-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-libs-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-libs-0:3.7.17-32.amd64",
          "Debian-11:alt-python37-test-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-test-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-test-0:3.7.17-32.amd64",
          "Debian-11:alt-python37-tkinter-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-tkinter-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-tkinter-0:3.7.17-32.amd64",
          "Debian-11:alt-python37-tools-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-tools-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-tools-0:3.7.17-32.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-19672"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-29T11:18:56.818966Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790680734",
          "product_ids": [
            "Debian-11:alt-python37-0:3.7.17-33.amd64",
            "Debian-11:alt-python37-debug-0:3.7.17-33.amd64",
            "Debian-11:alt-python37-devel-0:3.7.17-33.amd64",
            "Debian-11:alt-python37-libs-0:3.7.17-33.amd64",
            "Debian-11:alt-python37-test-0:3.7.17-33.amd64",
            "Debian-11:alt-python37-tkinter-0:3.7.17-33.amd64",
            "Debian-11:alt-python37-tools-0:3.7.17-33.amd64"
          ],
          "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790680734"
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "Debian-11:alt-python37-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-0:3.7.17-32.amd64",
            "Debian-11:alt-python37-debug-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-debug-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-debug-0:3.7.17-32.amd64",
            "Debian-11:alt-python37-devel-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-devel-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-devel-0:3.7.17-32.amd64",
            "Debian-11:alt-python37-libs-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-libs-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-libs-0:3.7.17-32.amd64",
            "Debian-11:alt-python37-test-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-test-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-test-0:3.7.17-32.amd64",
            "Debian-11:alt-python37-tkinter-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-tkinter-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-tkinter-0:3.7.17-32.amd64",
            "Debian-11:alt-python37-tools-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-tools-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-tools-0:3.7.17-32.amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    },
    {
      "cve": "CVE-2026-87910",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
      },
      "notes": [
        {
          "category": "description",
          "text": "When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:alt-python37-0:3.7.17-33.amd64",
          "Debian-11:alt-python37-debug-0:3.7.17-33.amd64",
          "Debian-11:alt-python37-devel-0:3.7.17-33.amd64",
          "Debian-11:alt-python37-libs-0:3.7.17-33.amd64",
          "Debian-11:alt-python37-test-0:3.7.17-33.amd64",
          "Debian-11:alt-python37-tkinter-0:3.7.17-33.amd64",
          "Debian-11:alt-python37-tools-0:3.7.17-33.amd64"
        ],
        "known_affected": [
          "Debian-11:alt-python37-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-0:3.7.17-32.amd64",
          "Debian-11:alt-python37-debug-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-debug-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-debug-0:3.7.17-32.amd64",
          "Debian-11:alt-python37-devel-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-devel-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-devel-0:3.7.17-32.amd64",
          "Debian-11:alt-python37-libs-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-libs-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-libs-0:3.7.17-32.amd64",
          "Debian-11:alt-python37-test-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-test-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-test-0:3.7.17-32.amd64",
          "Debian-11:alt-python37-tkinter-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-tkinter-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-tkinter-0:3.7.17-32.amd64",
          "Debian-11:alt-python37-tools-0:3.7.17-30.amd64",
          "Debian-11:alt-python37-tools-0:3.7.17-31.amd64",
          "Debian-11:alt-python37-tools-0:3.7.17-32.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-87910"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955",
          "url": "https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b",
          "url": "https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2",
          "url": "https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/157265",
          "url": "https://github.com/python/cpython/issues/157265"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/157266",
          "url": "https://github.com/python/cpython/pull/157266"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/09/11/8",
          "url": "http://www.openwall.com/lists/oss-security/2026/09/11/8"
        }
      ],
      "release_date": "2026-09-11T18:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-29T11:18:56.818966Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790680734",
          "product_ids": [
            "Debian-11:alt-python37-0:3.7.17-33.amd64",
            "Debian-11:alt-python37-debug-0:3.7.17-33.amd64",
            "Debian-11:alt-python37-devel-0:3.7.17-33.amd64",
            "Debian-11:alt-python37-libs-0:3.7.17-33.amd64",
            "Debian-11:alt-python37-test-0:3.7.17-33.amd64",
            "Debian-11:alt-python37-tkinter-0:3.7.17-33.amd64",
            "Debian-11:alt-python37-tools-0:3.7.17-33.amd64"
          ],
          "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790680734"
        },
        {
          "category": "none_available",
          "date": "2026-09-11T18:16:00Z",
          "details": "Affected",
          "product_ids": [
            "Debian-11:alt-python37-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-0:3.7.17-32.amd64",
            "Debian-11:alt-python37-debug-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-debug-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-debug-0:3.7.17-32.amd64",
            "Debian-11:alt-python37-devel-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-devel-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-devel-0:3.7.17-32.amd64",
            "Debian-11:alt-python37-libs-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-libs-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-libs-0:3.7.17-32.amd64",
            "Debian-11:alt-python37-test-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-test-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-test-0:3.7.17-32.amd64",
            "Debian-11:alt-python37-tkinter-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-tkinter-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-tkinter-0:3.7.17-32.amd64",
            "Debian-11:alt-python37-tools-0:3.7.17-30.amd64",
            "Debian-11:alt-python37-tools-0:3.7.17-31.amd64",
            "Debian-11:alt-python37-tools-0:3.7.17-32.amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}