[CLSA-2026:1794319163] Fix CVE(s): CVE-2026-114583, CVE-2026-116566
Type:
security
Severity:
Moderate
Release date:
2026-11-10 13:59:39 UTC
Description:
* SECURITY UPDATE: reject a link member that names the destination directory itself in the tarfile extraction filters - debian/patches/CVE-2026-114583.patch: move the destination-replacement check out of the 'data' filter branch in Lib/tarfile.py so both the 'tar' and 'data' filters raise OutsideDestinationError, and extend Lib/test/test_tarfile.py to cover both filters - CVE-2026-114583 * SECURITY UPDATE: reject embedded null characters in the host and port arguments of socket.getaddrinfo() - debian/patches/CVE-2026-116566.patch: track the byte length of the host and port arguments in Modules/socketmodule.c and raise ValueError when a NUL byte truncates them - CVE-2026-116566
CVEs fixed:
Updated packages:
  • alt-python38_3.8.20-36_amd64.deb
    sha:a0dfcc6eb7c747bd96925d55e21ec371b1d58956
  • alt-python38-debug_3.8.20-36_amd64.deb
    sha:175401bf702044a513d404a18e4544361e2a9e46
  • alt-python38-devel_3.8.20-36_amd64.deb
    sha:73510ac5aa62758725be0d9848c9beda72916ff0
  • alt-python38-idle_3.8.20-36_amd64.deb
    sha:a1277daa21d4b350eb3a0832cd251030d9632b1b
  • alt-python38-libs_3.8.20-36_amd64.deb
    sha:b76ba538309d4a44f59ef1df61e3148cf3f1c902
  • alt-python38-test_3.8.20-36_amd64.deb
    sha:998413f838a131a06859547cf894fa4fd5240f56
  • alt-python38-tkinter_3.8.20-36_amd64.deb
    sha:428faad2e97d5859da03ae0fe323af2207647cc5
  • alt-python38_3.8.20-36_arm64.deb
    sha:fcc9cec34012532983ca9f7eda40ec5afdc5d57b
  • alt-python38-debug_3.8.20-36_arm64.deb
    sha:3da92d1c45994755eb3239b3865655b933a36f59
  • alt-python38-devel_3.8.20-36_arm64.deb
    sha:4af7c266648d7606cbb3c31458a589dfa99e8f3c
  • alt-python38-idle_3.8.20-36_arm64.deb
    sha:b6090e914acba5ad8ae373062576d99f10f5f8c6
  • alt-python38-libs_3.8.20-36_arm64.deb
    sha:85429d4ef125558b3f9fdaf27dd7cbb5572de46e
  • alt-python38-test_3.8.20-36_arm64.deb
    sha:3e3329cf08635240ca71d441331e167fc43e76e0
  • alt-python38-tkinter_3.8.20-36_arm64.deb
    sha:25207220cf51792a9c46a690d37d9371bd68c053
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.