[CLSA-2026:1794319154] Fix CVE(s): CVE-2026-114583, CVE-2026-116566
Type:
security
Severity:
Moderate
Release date:
2026-11-10 13:59:28 UTC
Description:
* SECURITY UPDATE: reject a link member that names the destination directory itself in the tarfile extraction filters - debian/patches/CVE-2026-114583.patch: move the destination-replacement check out of the 'data' filter branch in Lib/tarfile.py so both the 'tar' and 'data' filters raise OutsideDestinationError, and extend Lib/test/test_tarfile.py to cover both filters - CVE-2026-114583 * SECURITY UPDATE: reject embedded null characters in the host and port arguments of socket.getaddrinfo() - debian/patches/CVE-2026-116566.patch: track the byte length of the host and port arguments in Modules/socketmodule.c and raise ValueError when a NUL byte truncates them - CVE-2026-116566
CVEs fixed:
Updated packages:
  • alt-python38_3.8.20-36_amd64.deb
    sha:eea58f4fe3bc61030fc2df8aafc883e634edb031
  • alt-python38-debug_3.8.20-36_amd64.deb
    sha:37d443bcabb30b27bb67494c50e0cc72ec1b17de
  • alt-python38-devel_3.8.20-36_amd64.deb
    sha:69fe965ab48e044ad77ac930ba533a0cf9709ee3
  • alt-python38-idle_3.8.20-36_amd64.deb
    sha:133167eca32b236df3b3f170898347e121163e37
  • alt-python38-libs_3.8.20-36_amd64.deb
    sha:e2123e4dd86ef4a6902244d21c0f58eb3d032e55
  • alt-python38-test_3.8.20-36_amd64.deb
    sha:dd30c443ee1dc4e9c3f7e9019fcf588a39804078
  • alt-python38-tkinter_3.8.20-36_amd64.deb
    sha:53144605ab4880df707e5acd5f1ad1ee040f116d
  • alt-python38_3.8.20-36_arm64.deb
    sha:23841716a3a05ff1a6b8801064da818598859c4c
  • alt-python38-debug_3.8.20-36_arm64.deb
    sha:587a184f36899a737a5547b936a3f74910502cb4
  • alt-python38-devel_3.8.20-36_arm64.deb
    sha:98901089959cf4a4119da95dbb7cc0e4a26d67f0
  • alt-python38-idle_3.8.20-36_arm64.deb
    sha:e5c3552c6a76da277306ad561b6f139265cc47ca
  • alt-python38-libs_3.8.20-36_arm64.deb
    sha:9c91c23ab2943e046a61c80788e8dde6b902130a
  • alt-python38-test_3.8.20-36_arm64.deb
    sha:85e9920635ada8504cf583215068285e48df3766
  • alt-python38-tkinter_3.8.20-36_arm64.deb
    sha:9ddbfce53683fed3c5a39f27efdf6918e20d3cc0
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.