Security update for python3, python3-base, python3-doc
This update for python3, python3-base, python3-doc fixes the following issues:
Security issues fixed:
- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high
CPU usage (bsc#1273148).
- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2
This update for python3 fixes the following issues:
Security issues fixed:
- CVE-2026-13346: arbitrary file installation via malicious package indexes (bsc#1273091).
Non security issue fixed:
- Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl
This update for python3 fixes the following issues:
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
`configparser` module is used (bsc#1269066).
- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously
crafted wheel archives (bsc#1257599).
- CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262467).
- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted
Unicode input (bsc#1267581).
- CVE-2026-4360: in the Tarfile.extract() function, t
This update for python3 fixes the following issues:
- CVE-2026-7210: insufficient entropy used for Expat hash-flooding protection allows a crafted XML document to trigger
hash flooding (bsc#1264962).
- CVE-2026-8328: server-supplied PASV host address is trusted by `ftpcp()` and allows for SSRF (bsc#1265268).
- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and
enables arbitrary file reads and writes (bsc#1268977).
This update for python3 fixes the following issues:
- CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).
- CVE-2026-3479: improper resource argument validation can allow path traversal (bsc#1259989).
- CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
- CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web browser command
line option injection (bsc#1260026).
This update for python3 fixes the following issues:
- CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in BytesGenerator (bsc#1257181).
This update for python3 fixes the following issues:
- CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable
characters (bsc#1257029).
- CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel
(bsc#1257031).
- CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
- CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
- CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
- CV
This update for python3 fixes the following issues:
Security fixes:
- CVE-2025-4517: Fixed arbitrary filesystem writes outside the extraction directory during extraction
with filter='data' (bsc#1244032)
- CVE-2025-4330: Fixed extraction filter bypass for linking outside extraction directory (bsc#1244060)
- CVE-2007-4559: Fixed python tarfile module directory traversal (bsc#1203750)
- CVE-2024-12718: Fixed bypass extraction filter to modify file metadata outside extraction directory
(bsc#1244056)
- CVE-2025-4138: Fixed symlinking targets to not point outside the destination directory, and the modification
of some file metadata (bsc#
This update for python3 fixes the following issues:
- CVE-2025-12084: cpython: Fixed quadratic algorithm in xml.dom.minidom leading to denial of service (bsc#1254997)
- CVE-2025-13836: Fixed default Content-Lenght read amount from HTTP response (bsc#1254400)
- CVE-2025-13837: Fixed plistlib module denial of service (bsc#1254401)
This update for python3 fixes the following issues:
Security issues fixed:
- CVE-2025-6075: Fixed simple quadratic complexity vulnerabilities on `os.path.expandvars()` (bsc#1252974).
- CVE-2025-8291: Fixed missing validity checks of the ZIP64 End of Central Directory (EOCD) (bsc#1251305).
Other issues fixed:
- Added @requires_lchmod operator for skipping tests on platforms were changing the mode of symbolic links is supported.
- Fixed decoding byte strings in `localeconv()` for consistent output.
This update for python3 fixes the following issues:
- CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705)
- CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249)
Other fixes:
- Limit buffer size for IPv6 address parsing (bsc#1244401).
This update for python3 fixes the following issues:
- CVE-2025-0938: domain names containing square brackets are not identified as incorrect by urlparse. (bsc#1236705)
This update for python3 fixes the following issues:
- CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses (bsc#1233307)
Other fixes:
- Remove -IVendor/ from python-config (bsc#1231795)
This update for python3 fixes the following issues:
- CVE-2024-9287: Fixed quoted path names provided when creating a virtual environment (bsc#1232241).
Bug fixes:
- Drop .pyc files from docdir for reproducible builds (bsc#1230906).