{ "document": { "aggregate_severity": { "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "SECURITY UPDATE: tarfile: honor a None result from the link-fallback filter call\n (CVE-2026-87910). When a hard link cannot be created, tarfile extracts the\n target member under the link's name and runs the filter on that renamed\n member first; a None result (skip this member) from that call was discarded,\n so a filter that refused the name was overridden and the member extracted\n anyway. That result is now honored before the second filter call.\n- SECURITY UPDATE: tarfile: normalize member names that leave the destination\n and come back (CVE-2026-19672, upstream commit 97688346). The tar and data\n filters checked containment on the resolved path, but directories are created\n from the name as given, so a name like '../evil/../dest/sub/file' passed the\n check while creating '../evil' outside the destination. Such names are now\n normalized before the check, so the directories created are the ones that\n were validated. Normalization drops internal '..' components and may change\n the meaning of a name that traverses symbolic links.", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790698399", "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790698399" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_python/el8/advisories/2026/clsa-2026_1790698399.json" } ], "tracking": { "current_release_date": "2026-09-29T16:14:02Z", "generator": { "date": "2026-09-29T16:14:02Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1790698399", "initial_release_date": "2026-09-29T16:14:02Z", "revision_history": [ { "date": "2026-09-29T16:14:02Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "alt-python314: Fix of 2 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 8", "product": { "name": "Community Enterprise Operating System 8", "product_id": "CentOS-8", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-python314-debug-0:3.14.7-2.el8.x86_64", "product": { "name": "alt-python314-debug-0:3.14.7-2.el8.x86_64", "product_id": "alt-python314-debug-0:3.14.7-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314-debug@3.14.7-2.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-python314-idle-0:3.14.7-2.el8.x86_64", "product": { "name": "alt-python314-idle-0:3.14.7-2.el8.x86_64", "product_id": "alt-python314-idle-0:3.14.7-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314-idle@3.14.7-2.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-python314-0:3.14.7-2.el8.x86_64", "product": { "name": "alt-python314-0:3.14.7-2.el8.x86_64", "product_id": "alt-python314-0:3.14.7-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314@3.14.7-2.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-python314-libs-0:3.14.7-2.el8.x86_64", "product": { "name": "alt-python314-libs-0:3.14.7-2.el8.x86_64", "product_id": "alt-python314-libs-0:3.14.7-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314-libs@3.14.7-2.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-python314-test-0:3.14.7-2.el8.x86_64", "product": { "name": "alt-python314-test-0:3.14.7-2.el8.x86_64", "product_id": "alt-python314-test-0:3.14.7-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314-test@3.14.7-2.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-python314-tkinter-0:3.14.7-2.el8.x86_64", "product": { "name": "alt-python314-tkinter-0:3.14.7-2.el8.x86_64", "product_id": "alt-python314-tkinter-0:3.14.7-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314-tkinter@3.14.7-2.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-python314-devel-0:3.14.7-2.el8.x86_64", "product": { "name": "alt-python314-devel-0:3.14.7-2.el8.x86_64", "product_id": "alt-python314-devel-0:3.14.7-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314-devel@3.14.7-2.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-python314-libs-0:3.14.7-1.el8.x86_64", "product": { "name": "alt-python314-libs-0:3.14.7-1.el8.x86_64", "product_id": "alt-python314-libs-0:3.14.7-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314-libs@3.14.7-1.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-python314-test-0:3.14.7-1.el8.x86_64", "product": { "name": "alt-python314-test-0:3.14.7-1.el8.x86_64", "product_id": "alt-python314-test-0:3.14.7-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314-test@3.14.7-1.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-python314-devel-0:3.14.7-1.el8.x86_64", "product": { "name": "alt-python314-devel-0:3.14.7-1.el8.x86_64", "product_id": "alt-python314-devel-0:3.14.7-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314-devel@3.14.7-1.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-python314-tkinter-0:3.14.7-1.el8.x86_64", "product": { "name": "alt-python314-tkinter-0:3.14.7-1.el8.x86_64", "product_id": "alt-python314-tkinter-0:3.14.7-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314-tkinter@3.14.7-1.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-python314-debug-0:3.14.7-1.el8.x86_64", "product": { "name": "alt-python314-debug-0:3.14.7-1.el8.x86_64", "product_id": "alt-python314-debug-0:3.14.7-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314-debug@3.14.7-1.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-python314-0:3.14.7-1.el8.x86_64", "product": { "name": "alt-python314-0:3.14.7-1.el8.x86_64", "product_id": "alt-python314-0:3.14.7-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314@3.14.7-1.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-python314-idle-0:3.14.7-1.el8.x86_64", "product": { "name": "alt-python314-idle-0:3.14.7-1.el8.x86_64", "product_id": "alt-python314-idle-0:3.14.7-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-python314-idle@3.14.7-1.el8?arch=x86_64&os_name=centos&os_version=8" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-python314-debug-0:3.14.7-2.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-debug-0:3.14.7-2.el8.x86_64" }, "product_reference": "alt-python314-debug-0:3.14.7-2.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python314-idle-0:3.14.7-2.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-idle-0:3.14.7-2.el8.x86_64" }, "product_reference": "alt-python314-idle-0:3.14.7-2.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python314-0:3.14.7-2.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-0:3.14.7-2.el8.x86_64" }, "product_reference": "alt-python314-0:3.14.7-2.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python314-libs-0:3.14.7-2.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-libs-0:3.14.7-2.el8.x86_64" }, "product_reference": "alt-python314-libs-0:3.14.7-2.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python314-test-0:3.14.7-2.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-test-0:3.14.7-2.el8.x86_64" }, "product_reference": "alt-python314-test-0:3.14.7-2.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python314-tkinter-0:3.14.7-2.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-tkinter-0:3.14.7-2.el8.x86_64" }, "product_reference": "alt-python314-tkinter-0:3.14.7-2.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python314-devel-0:3.14.7-2.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-devel-0:3.14.7-2.el8.x86_64" }, "product_reference": "alt-python314-devel-0:3.14.7-2.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python314-libs-0:3.14.7-1.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-libs-0:3.14.7-1.el8.x86_64" }, "product_reference": "alt-python314-libs-0:3.14.7-1.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python314-test-0:3.14.7-1.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-test-0:3.14.7-1.el8.x86_64" }, "product_reference": "alt-python314-test-0:3.14.7-1.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python314-devel-0:3.14.7-1.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-devel-0:3.14.7-1.el8.x86_64" }, "product_reference": "alt-python314-devel-0:3.14.7-1.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python314-tkinter-0:3.14.7-1.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-tkinter-0:3.14.7-1.el8.x86_64" }, "product_reference": "alt-python314-tkinter-0:3.14.7-1.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python314-debug-0:3.14.7-1.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-debug-0:3.14.7-1.el8.x86_64" }, "product_reference": "alt-python314-debug-0:3.14.7-1.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python314-0:3.14.7-1.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-0:3.14.7-1.el8.x86_64" }, "product_reference": "alt-python314-0:3.14.7-1.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python314-idle-0:3.14.7-1.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-python314-idle-0:3.14.7-1.el8.x86_64" }, "product_reference": "alt-python314-idle-0:3.14.7-1.el8.x86_64", "relates_to_product_reference": "CentOS-8" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-19672", "notes": [ { "category": "description", "text": "The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.\n", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-8:alt-python314-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-debug-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-devel-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-idle-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-libs-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-test-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-tkinter-0:3.14.7-2.el8.x86_64" ], "known_affected": [ "CentOS-8:alt-python314-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-debug-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-devel-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-idle-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-libs-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-test-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-tkinter-0:3.14.7-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-19672" } ], "remediations": [ { "category": "vendor_fix", "date": "2026-09-29T16:13:21.254676Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790698399", "product_ids": [ "CentOS-8:alt-python314-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-debug-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-devel-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-idle-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-libs-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-test-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-tkinter-0:3.14.7-2.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790698399" }, { "category": "none_available", "details": "Affected", "product_ids": [ "CentOS-8:alt-python314-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-debug-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-devel-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-idle-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-libs-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-test-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-tkinter-0:3.14.7-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-87910", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "description", "text": "When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-8:alt-python314-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-debug-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-devel-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-idle-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-libs-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-test-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-tkinter-0:3.14.7-2.el8.x86_64" ], "known_affected": [ "CentOS-8:alt-python314-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-debug-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-devel-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-idle-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-libs-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-test-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-tkinter-0:3.14.7-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-87910" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955", "url": "https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b", "url": "https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2", "url": "https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2" }, { "category": "external", "summary": "https://github.com/python/cpython/issues/157265", "url": "https://github.com/python/cpython/issues/157265" }, { "category": "external", "summary": "https://github.com/python/cpython/pull/157266", "url": "https://github.com/python/cpython/pull/157266" }, { "category": "external", "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/09/11/8", "url": "http://www.openwall.com/lists/oss-security/2026/09/11/8" } ], "release_date": "2026-09-11T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-29T16:13:21.254676Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790698399", "product_ids": [ "CentOS-8:alt-python314-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-debug-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-devel-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-idle-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-libs-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-test-0:3.14.7-2.el8.x86_64", "CentOS-8:alt-python314-tkinter-0:3.14.7-2.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1790698399" }, { "category": "none_available", "date": "2026-09-11T18:16:00Z", "details": "Affected", "product_ids": [ "CentOS-8:alt-python314-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-debug-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-devel-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-idle-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-libs-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-test-0:3.14.7-1.el8.x86_64", "CentOS-8:alt-python314-tkinter-0:3.14.7-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }