{
  "document": {
    "aggregate_severity": {
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      },
      {
        "category": "details",
        "text": "CVE-2026-87910: honour a None result from the extraction filter on\n  tarfile's hard-link fallback. The CVE-2026-11940 guard re-runs the filter\n  on the link target re-rooted at the link's own name, but discarded the\n  result and overwrote it on the next line, so a custom filter returning\n  None (\"skip this member\") was ignored and the member was extracted at the\n  shallower name the filter had declined. The bundled \"data\" and \"tar\"\n  filters raise rather than return None, so only custom filters are\n  affected. Carries upstream's test_extract_filters_target_none. Must stay\n  ordered after CVE-2026-11940.patch, which supplies the re-rooted call\n- CVE-2026-19672: normalize a member name that leaves the destination and\n  comes back (\"../evil/../dest/sub/file\") before tarfile's \"tar\"/\"data\"\n  filters check containment. The check used the resolved path, which lands\n  back inside, while the intermediate directories were created from the name\n  as given, so a directory appeared outside the extraction root. Backport\n  of cpython 97688346ada2df3e5b9c279348862c3d64ab0823; carries upstream's\n  test_parent_dir_out_and_back. Applies to this package only\n  because CVE-2007-4559.patch backports the PEP 706 filters, so it must stay\n  ordered after that patch",
        "title": "Details"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790687868",
        "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790687868"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_alt_python/el8/advisories/2026/clsa-2026_1790687868.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-09-29T13:18:55Z",
      "generator": {
        "date": "2026-09-29T13:18:55Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CLSA-2026:1790687868",
      "initial_release_date": "2026-09-29T13:18:55Z",
      "revision_history": [
        {
          "date": "2026-09-29T13:18:55Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    },
    "title": "alt-python37: Fix of 2 CVEs"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Community Enterprise Operating System 8",
                "product": {
                  "name": "Community Enterprise Operating System 8",
                  "product_id": "CentOS-8",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:centos:centos:8:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Community Enterprise Operating System"
          }
        ],
        "category": "vendor",
        "name": "Cloud Linux Software, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "alt-python37-tools-0:3.7.17-30.el8.x86_64",
                "product": {
                  "name": "alt-python37-tools-0:3.7.17-30.el8.x86_64",
                  "product_id": "alt-python37-tools-0:3.7.17-30.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-tools@3.7.17-30.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-devel-0:3.7.17-30.el8.x86_64",
                "product": {
                  "name": "alt-python37-devel-0:3.7.17-30.el8.x86_64",
                  "product_id": "alt-python37-devel-0:3.7.17-30.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-devel@3.7.17-30.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-tkinter-0:3.7.17-30.el8.x86_64",
                "product": {
                  "name": "alt-python37-tkinter-0:3.7.17-30.el8.x86_64",
                  "product_id": "alt-python37-tkinter-0:3.7.17-30.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-tkinter@3.7.17-30.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-debug-0:3.7.17-30.el8.x86_64",
                "product": {
                  "name": "alt-python37-debug-0:3.7.17-30.el8.x86_64",
                  "product_id": "alt-python37-debug-0:3.7.17-30.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-debug@3.7.17-30.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-libs-0:3.7.17-30.el8.x86_64",
                "product": {
                  "name": "alt-python37-libs-0:3.7.17-30.el8.x86_64",
                  "product_id": "alt-python37-libs-0:3.7.17-30.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-libs@3.7.17-30.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-0:3.7.17-30.el8.x86_64",
                "product": {
                  "name": "alt-python37-0:3.7.17-30.el8.x86_64",
                  "product_id": "alt-python37-0:3.7.17-30.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37@3.7.17-30.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-test-0:3.7.17-30.el8.x86_64",
                "product": {
                  "name": "alt-python37-test-0:3.7.17-30.el8.x86_64",
                  "product_id": "alt-python37-test-0:3.7.17-30.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-test@3.7.17-30.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-libs-0:3.7.17-29.el8.x86_64",
                "product": {
                  "name": "alt-python37-libs-0:3.7.17-29.el8.x86_64",
                  "product_id": "alt-python37-libs-0:3.7.17-29.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-libs@3.7.17-29.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-test-0:3.7.17-29.el8.x86_64",
                "product": {
                  "name": "alt-python37-test-0:3.7.17-29.el8.x86_64",
                  "product_id": "alt-python37-test-0:3.7.17-29.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-test@3.7.17-29.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-debug-0:3.7.17-29.el8.x86_64",
                "product": {
                  "name": "alt-python37-debug-0:3.7.17-29.el8.x86_64",
                  "product_id": "alt-python37-debug-0:3.7.17-29.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-debug@3.7.17-29.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-tkinter-0:3.7.17-29.el8.x86_64",
                "product": {
                  "name": "alt-python37-tkinter-0:3.7.17-29.el8.x86_64",
                  "product_id": "alt-python37-tkinter-0:3.7.17-29.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-tkinter@3.7.17-29.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-tools-0:3.7.17-29.el8.x86_64",
                "product": {
                  "name": "alt-python37-tools-0:3.7.17-29.el8.x86_64",
                  "product_id": "alt-python37-tools-0:3.7.17-29.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-tools@3.7.17-29.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-0:3.7.17-29.el8.x86_64",
                "product": {
                  "name": "alt-python37-0:3.7.17-29.el8.x86_64",
                  "product_id": "alt-python37-0:3.7.17-29.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37@3.7.17-29.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-devel-0:3.7.17-29.el8.x86_64",
                "product": {
                  "name": "alt-python37-devel-0:3.7.17-29.el8.x86_64",
                  "product_id": "alt-python37-devel-0:3.7.17-29.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-devel@3.7.17-29.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-test-0:3.7.17-28.el8.x86_64",
                "product": {
                  "name": "alt-python37-test-0:3.7.17-28.el8.x86_64",
                  "product_id": "alt-python37-test-0:3.7.17-28.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-test@3.7.17-28.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-0:3.7.17-28.el8.x86_64",
                "product": {
                  "name": "alt-python37-0:3.7.17-28.el8.x86_64",
                  "product_id": "alt-python37-0:3.7.17-28.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37@3.7.17-28.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-debug-0:3.7.17-28.el8.x86_64",
                "product": {
                  "name": "alt-python37-debug-0:3.7.17-28.el8.x86_64",
                  "product_id": "alt-python37-debug-0:3.7.17-28.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-debug@3.7.17-28.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-tools-0:3.7.17-28.el8.x86_64",
                "product": {
                  "name": "alt-python37-tools-0:3.7.17-28.el8.x86_64",
                  "product_id": "alt-python37-tools-0:3.7.17-28.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-tools@3.7.17-28.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-devel-0:3.7.17-28.el8.x86_64",
                "product": {
                  "name": "alt-python37-devel-0:3.7.17-28.el8.x86_64",
                  "product_id": "alt-python37-devel-0:3.7.17-28.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-devel@3.7.17-28.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-tkinter-0:3.7.17-28.el8.x86_64",
                "product": {
                  "name": "alt-python37-tkinter-0:3.7.17-28.el8.x86_64",
                  "product_id": "alt-python37-tkinter-0:3.7.17-28.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-tkinter@3.7.17-28.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python37-libs-0:3.7.17-28.el8.x86_64",
                "product": {
                  "name": "alt-python37-libs-0:3.7.17-28.el8.x86_64",
                  "product_id": "alt-python37-libs-0:3.7.17-28.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python37-libs@3.7.17-28.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tools-0:3.7.17-30.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-tools-0:3.7.17-30.el8.x86_64"
        },
        "product_reference": "alt-python37-tools-0:3.7.17-30.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-devel-0:3.7.17-30.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-devel-0:3.7.17-30.el8.x86_64"
        },
        "product_reference": "alt-python37-devel-0:3.7.17-30.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tkinter-0:3.7.17-30.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-tkinter-0:3.7.17-30.el8.x86_64"
        },
        "product_reference": "alt-python37-tkinter-0:3.7.17-30.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-debug-0:3.7.17-30.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-debug-0:3.7.17-30.el8.x86_64"
        },
        "product_reference": "alt-python37-debug-0:3.7.17-30.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-libs-0:3.7.17-30.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-libs-0:3.7.17-30.el8.x86_64"
        },
        "product_reference": "alt-python37-libs-0:3.7.17-30.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-0:3.7.17-30.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-0:3.7.17-30.el8.x86_64"
        },
        "product_reference": "alt-python37-0:3.7.17-30.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-test-0:3.7.17-30.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-test-0:3.7.17-30.el8.x86_64"
        },
        "product_reference": "alt-python37-test-0:3.7.17-30.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-libs-0:3.7.17-29.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-libs-0:3.7.17-29.el8.x86_64"
        },
        "product_reference": "alt-python37-libs-0:3.7.17-29.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-test-0:3.7.17-29.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-test-0:3.7.17-29.el8.x86_64"
        },
        "product_reference": "alt-python37-test-0:3.7.17-29.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-debug-0:3.7.17-29.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-debug-0:3.7.17-29.el8.x86_64"
        },
        "product_reference": "alt-python37-debug-0:3.7.17-29.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tkinter-0:3.7.17-29.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-tkinter-0:3.7.17-29.el8.x86_64"
        },
        "product_reference": "alt-python37-tkinter-0:3.7.17-29.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tools-0:3.7.17-29.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-tools-0:3.7.17-29.el8.x86_64"
        },
        "product_reference": "alt-python37-tools-0:3.7.17-29.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-0:3.7.17-29.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-0:3.7.17-29.el8.x86_64"
        },
        "product_reference": "alt-python37-0:3.7.17-29.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-devel-0:3.7.17-29.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-devel-0:3.7.17-29.el8.x86_64"
        },
        "product_reference": "alt-python37-devel-0:3.7.17-29.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-test-0:3.7.17-28.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-test-0:3.7.17-28.el8.x86_64"
        },
        "product_reference": "alt-python37-test-0:3.7.17-28.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-0:3.7.17-28.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-0:3.7.17-28.el8.x86_64"
        },
        "product_reference": "alt-python37-0:3.7.17-28.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-debug-0:3.7.17-28.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-debug-0:3.7.17-28.el8.x86_64"
        },
        "product_reference": "alt-python37-debug-0:3.7.17-28.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tools-0:3.7.17-28.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-tools-0:3.7.17-28.el8.x86_64"
        },
        "product_reference": "alt-python37-tools-0:3.7.17-28.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-devel-0:3.7.17-28.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-devel-0:3.7.17-28.el8.x86_64"
        },
        "product_reference": "alt-python37-devel-0:3.7.17-28.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-tkinter-0:3.7.17-28.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-tkinter-0:3.7.17-28.el8.x86_64"
        },
        "product_reference": "alt-python37-tkinter-0:3.7.17-28.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python37-libs-0:3.7.17-28.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python37-libs-0:3.7.17-28.el8.x86_64"
        },
        "product_reference": "alt-python37-libs-0:3.7.17-28.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-19672",
      "notes": [
        {
          "category": "description",
          "text": "The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.\n",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "CentOS-8:alt-python37-0:3.7.17-30.el8.x86_64",
          "CentOS-8:alt-python37-debug-0:3.7.17-30.el8.x86_64",
          "CentOS-8:alt-python37-devel-0:3.7.17-30.el8.x86_64",
          "CentOS-8:alt-python37-libs-0:3.7.17-30.el8.x86_64",
          "CentOS-8:alt-python37-test-0:3.7.17-30.el8.x86_64",
          "CentOS-8:alt-python37-tkinter-0:3.7.17-30.el8.x86_64",
          "CentOS-8:alt-python37-tools-0:3.7.17-30.el8.x86_64"
        ],
        "known_affected": [
          "CentOS-8:alt-python37-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-0:3.7.17-29.el8.x86_64",
          "CentOS-8:alt-python37-debug-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-debug-0:3.7.17-29.el8.x86_64",
          "CentOS-8:alt-python37-devel-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-devel-0:3.7.17-29.el8.x86_64",
          "CentOS-8:alt-python37-libs-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-libs-0:3.7.17-29.el8.x86_64",
          "CentOS-8:alt-python37-test-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-test-0:3.7.17-29.el8.x86_64",
          "CentOS-8:alt-python37-tkinter-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-tkinter-0:3.7.17-29.el8.x86_64",
          "CentOS-8:alt-python37-tools-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-tools-0:3.7.17-29.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-19672"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-29T13:17:52.067921Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790687868",
          "product_ids": [
            "CentOS-8:alt-python37-0:3.7.17-30.el8.x86_64",
            "CentOS-8:alt-python37-debug-0:3.7.17-30.el8.x86_64",
            "CentOS-8:alt-python37-devel-0:3.7.17-30.el8.x86_64",
            "CentOS-8:alt-python37-libs-0:3.7.17-30.el8.x86_64",
            "CentOS-8:alt-python37-test-0:3.7.17-30.el8.x86_64",
            "CentOS-8:alt-python37-tkinter-0:3.7.17-30.el8.x86_64",
            "CentOS-8:alt-python37-tools-0:3.7.17-30.el8.x86_64"
          ],
          "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790687868"
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "CentOS-8:alt-python37-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-0:3.7.17-29.el8.x86_64",
            "CentOS-8:alt-python37-debug-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-debug-0:3.7.17-29.el8.x86_64",
            "CentOS-8:alt-python37-devel-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-devel-0:3.7.17-29.el8.x86_64",
            "CentOS-8:alt-python37-libs-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-libs-0:3.7.17-29.el8.x86_64",
            "CentOS-8:alt-python37-test-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-test-0:3.7.17-29.el8.x86_64",
            "CentOS-8:alt-python37-tkinter-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-tkinter-0:3.7.17-29.el8.x86_64",
            "CentOS-8:alt-python37-tools-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-tools-0:3.7.17-29.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    },
    {
      "cve": "CVE-2026-87910",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
      },
      "notes": [
        {
          "category": "description",
          "text": "When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "CentOS-8:alt-python37-0:3.7.17-30.el8.x86_64",
          "CentOS-8:alt-python37-debug-0:3.7.17-30.el8.x86_64",
          "CentOS-8:alt-python37-devel-0:3.7.17-30.el8.x86_64",
          "CentOS-8:alt-python37-libs-0:3.7.17-30.el8.x86_64",
          "CentOS-8:alt-python37-test-0:3.7.17-30.el8.x86_64",
          "CentOS-8:alt-python37-tkinter-0:3.7.17-30.el8.x86_64",
          "CentOS-8:alt-python37-tools-0:3.7.17-30.el8.x86_64"
        ],
        "known_affected": [
          "CentOS-8:alt-python37-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-0:3.7.17-29.el8.x86_64",
          "CentOS-8:alt-python37-debug-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-debug-0:3.7.17-29.el8.x86_64",
          "CentOS-8:alt-python37-devel-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-devel-0:3.7.17-29.el8.x86_64",
          "CentOS-8:alt-python37-libs-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-libs-0:3.7.17-29.el8.x86_64",
          "CentOS-8:alt-python37-test-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-test-0:3.7.17-29.el8.x86_64",
          "CentOS-8:alt-python37-tkinter-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-tkinter-0:3.7.17-29.el8.x86_64",
          "CentOS-8:alt-python37-tools-0:3.7.17-28.el8.x86_64",
          "CentOS-8:alt-python37-tools-0:3.7.17-29.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-87910"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955",
          "url": "https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b",
          "url": "https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2",
          "url": "https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/157265",
          "url": "https://github.com/python/cpython/issues/157265"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/157266",
          "url": "https://github.com/python/cpython/pull/157266"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/09/11/8",
          "url": "http://www.openwall.com/lists/oss-security/2026/09/11/8"
        }
      ],
      "release_date": "2026-09-11T18:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-29T13:17:52.067921Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790687868",
          "product_ids": [
            "CentOS-8:alt-python37-0:3.7.17-30.el8.x86_64",
            "CentOS-8:alt-python37-debug-0:3.7.17-30.el8.x86_64",
            "CentOS-8:alt-python37-devel-0:3.7.17-30.el8.x86_64",
            "CentOS-8:alt-python37-libs-0:3.7.17-30.el8.x86_64",
            "CentOS-8:alt-python37-test-0:3.7.17-30.el8.x86_64",
            "CentOS-8:alt-python37-tkinter-0:3.7.17-30.el8.x86_64",
            "CentOS-8:alt-python37-tools-0:3.7.17-30.el8.x86_64"
          ],
          "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790687868"
        },
        {
          "category": "none_available",
          "date": "2026-09-11T18:16:00Z",
          "details": "Affected",
          "product_ids": [
            "CentOS-8:alt-python37-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-0:3.7.17-29.el8.x86_64",
            "CentOS-8:alt-python37-debug-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-debug-0:3.7.17-29.el8.x86_64",
            "CentOS-8:alt-python37-devel-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-devel-0:3.7.17-29.el8.x86_64",
            "CentOS-8:alt-python37-libs-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-libs-0:3.7.17-29.el8.x86_64",
            "CentOS-8:alt-python37-test-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-test-0:3.7.17-29.el8.x86_64",
            "CentOS-8:alt-python37-tkinter-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-tkinter-0:3.7.17-29.el8.x86_64",
            "CentOS-8:alt-python37-tools-0:3.7.17-28.el8.x86_64",
            "CentOS-8:alt-python37-tools-0:3.7.17-29.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}