Release date:
2026-11-10 10:05:31 UTC
Description:
* SECURITY UPDATE: reject a link member that names the destination
directory itself in the tarfile extraction filters
- debian/patches/CVE-2026-114583.patch: move the destination-replacement
check out of the 'data' filter branch in Lib/tarfile.py so both the
'tar' and 'data' filters raise OutsideDestinationError, and extend
Lib/test/test_tarfile.py to cover both filters
- CVE-2026-114583
* SECURITY UPDATE: reject embedded null characters in the host and port
arguments of socket.getaddrinfo()
- debian/patches/CVE-2026-116566.patch: track the byte length of the host
and port arguments in Modules/socketmodule.c and raise ValueError when
a NUL byte truncates them
- CVE-2026-116566
Updated packages:
-
alt-python36_3.6.15-53_amd64.deb
sha:464aac70fc432eb8f228f5c98bc573d67e9b9318
-
alt-python36-debug_3.6.15-53_amd64.deb
sha:01ab0d458d13d463fea4479cd9da91e5c5cfacf2
-
alt-python36-devel_3.6.15-53_amd64.deb
sha:33a0fae9e4ab4034ca7626d16daf62b18942c4a2
-
alt-python36-libs_3.6.15-53_amd64.deb
sha:c652dca63467800ec2b9936ba510ebd0870f0906
-
alt-python36-test_3.6.15-53_amd64.deb
sha:62e97fa4896020bee78a8aab470915e8608a012a
-
alt-python36-tkinter_3.6.15-53_amd64.deb
sha:6f6efda965cb4d7f1025637ec41625c85b241faf
-
alt-python36-tools_3.6.15-53_amd64.deb
sha:41273ae8c2961564941829fa09f8822d8f5ea87f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
