Release date:
2026-11-10 10:02:30 UTC
Description:
* SECURITY UPDATE: reject a link member that names the destination
directory itself in the tarfile extraction filters
- debian/patches/CVE-2026-114583.patch: move the destination-replacement
check out of the 'data' filter branch in Lib/tarfile.py so both the
'tar' and 'data' filters raise OutsideDestinationError, and extend
Lib/test/test_tarfile.py to cover both filters
- CVE-2026-114583
* SECURITY UPDATE: reject embedded null characters in the host and port
arguments of socket.getaddrinfo()
- debian/patches/CVE-2026-116566.patch: track the byte length of the host
and port arguments in Modules/socketmodule.c and raise ValueError when
a NUL byte truncates them
- CVE-2026-116566
Updated packages:
-
alt-python36_3.6.15-53_amd64.deb
sha:17f0721635edf5aa6cc537a9b6f19bd7d0e72c37
-
alt-python36-debug_3.6.15-53_amd64.deb
sha:f364f83de76c1a12c472cbd2933d1d5b2955ba94
-
alt-python36-devel_3.6.15-53_amd64.deb
sha:f0072abdf6e503a91e3fa7046374aef89948238d
-
alt-python36-libs_3.6.15-53_amd64.deb
sha:ec3d0459f47842671feef9dd06ecd00709e40959
-
alt-python36-test_3.6.15-53_amd64.deb
sha:452e53e759677ac1799a70659b54edd5175ce9d3
-
alt-python36-tkinter_3.6.15-53_amd64.deb
sha:f52bd484f1c5b3f23dbf4cce77f4cd820f8b7df9
-
alt-python36-tools_3.6.15-53_amd64.deb
sha:9be8e791d0b8d7e3aafc5b88b766e23cecf0fe2d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
