Release date:
2026-11-10 10:02:08 UTC
Description:
* SECURITY UPDATE: reject a link member that names the destination
directory itself in the tarfile extraction filters
- debian/patches/CVE-2026-114583.patch: move the destination-replacement
check out of the 'data' filter branch in Lib/tarfile.py so both the
'tar' and 'data' filters raise OutsideDestinationError, and extend
Lib/test/test_tarfile.py to cover both filters
- CVE-2026-114583
* SECURITY UPDATE: reject embedded null characters in the host and port
arguments of socket.getaddrinfo()
- debian/patches/CVE-2026-116566.patch: track the byte length of the host
and port arguments in Modules/socketmodule.c and raise ValueError when
a NUL byte truncates them
- CVE-2026-116566
Updated packages:
-
alt-python310_3.10.22-4_amd64.deb
sha:6fb0215772ba850c1fc6c216b511c4c02f6ab9ec
-
alt-python310-debug_3.10.22-4_amd64.deb
sha:45b0f47dadd7f4be05c5737a512aaf93ce6e45ac
-
alt-python310-devel_3.10.22-4_amd64.deb
sha:55ed4821896bbea96f99ae2a630edcad191a9930
-
alt-python310-idle_3.10.22-4_amd64.deb
sha:5737dcf97fa14a73af687aa6dfa61a9d92d1f450
-
alt-python310-libs_3.10.22-4_amd64.deb
sha:fc6d09a1f23b89e2e5f38aeccbc0a07abdaf7d85
-
alt-python310-test_3.10.22-4_amd64.deb
sha:feebb525dd6d52c8b446cfe5bb4969d27d549fcb
-
alt-python310-tkinter_3.10.22-4_amd64.deb
sha:b5794cdeb28f484a8c4841b5e576d6de25b05b8c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
