Release date:
2026-11-10 10:12:06 UTC
Description:
- CVE-2026-114583: in the tarfile extraction filters, reject a link member
that names the destination directory itself, which would replace the
destination with a (sym)link and redirect all later members
- CVE-2026-116566: reject embedded null characters in the host and port
arguments of socket.getaddrinfo() instead of silently truncating them
Updated packages:
-
alt-python38-3.8.20-34.el9.x86_64.rpm
sha:f0fc5f856e0758b21fadc7ff423800e150e9dde474590bd0866c5a08ab57ed8e
-
alt-python38-devel-3.8.20-34.el9.x86_64.rpm
sha:65d26f8ed1719ebbdd4ba21512001cf9b73cd17a54383563357df167172fbd50
-
alt-python38-idle-3.8.20-34.el9.x86_64.rpm
sha:99364a9704dd5b1e19577ed3ea700814032deafb234a211590869cfe3ff10270
-
alt-python38-libs-3.8.20-34.el9.x86_64.rpm
sha:a5f9f96765c3873e48bfaf5048b361b88073ea8cbe689cc3fdaaa35b721480e0
-
alt-python38-test-3.8.20-34.el9.x86_64.rpm
sha:00b6d6b6cc6ff0b7fa45679a29ca3bb6fcc670dfd5f5e718914e0139cfe4dbc5
-
alt-python38-tkinter-3.8.20-34.el9.x86_64.rpm
sha:d10ec0932993e798900487b0182e53b632d33d90deb820ce6e0fddd84bd72003
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
