[CLSA-2026:1794325739] Fix CVE(s): CVE-2026-114583, CVE-2026-116566
Type:
security
Severity:
Moderate
Release date:
2026-11-10 15:49:19 UTC
Description:
* SECURITY UPDATE: reject a link member that names the destination directory itself in the tarfile extraction filters - debian/patches/CVE-2026-114583.patch: move the destination-replacement check out of the 'data' filter branch in Lib/tarfile.py so both the 'tar' and 'data' filters raise OutsideDestinationError, and extend Lib/test/test_tarfile.py to cover both filters - CVE-2026-114583 * SECURITY UPDATE: reject embedded null characters in the host and port arguments of socket.getaddrinfo() - debian/patches/CVE-2026-116566.patch: track the byte length of the host and port arguments in Modules/socketmodule.c and raise ValueError when a NUL byte truncates them - CVE-2026-116566
CVEs fixed:
Updated packages:
  • alt-python39_3.9.23-36_amd64.deb
    sha:e6bedc46896622da8e9eac9b53357c7b99b6cac6
  • alt-python39-debug_3.9.23-36_amd64.deb
    sha:1fbacbb9c26750db7613f778bc6cb5cbe15fc1b1
  • alt-python39-devel_3.9.23-36_amd64.deb
    sha:66e196b48b1e50d657d900e151bd5ebbb94cd02e
  • alt-python39-idle_3.9.23-36_amd64.deb
    sha:369638236776172ae9f9bbc2e5e5b0025f6c72e0
  • alt-python39-libs_3.9.23-36_amd64.deb
    sha:9d743ac6a2bdc2fe095761929ec147d7dff22637
  • alt-python39-test_3.9.23-36_amd64.deb
    sha:da8833e6d6ca8ad5f48292e25251325f770e5d4c
  • alt-python39-tkinter_3.9.23-36_amd64.deb
    sha:ca2afc1d0ead46157cfef60c00006f8eb5a23ca8
  • alt-python39_3.9.23-36_arm64.deb
    sha:c0b11e5964a124604779c083550d2851e82eee16
  • alt-python39-debug_3.9.23-36_arm64.deb
    sha:e0b099a6134ce5c21986a14fcd42ad1cb4834c86
  • alt-python39-devel_3.9.23-36_arm64.deb
    sha:47d14cf22fe2c51d8812fdda900e7a94173f0384
  • alt-python39-idle_3.9.23-36_arm64.deb
    sha:7d3421b4c9676a975adeb02cb1783b9f4600605e
  • alt-python39-libs_3.9.23-36_arm64.deb
    sha:85614179982ab5b86fe149dd92ea609ef959ff5c
  • alt-python39-test_3.9.23-36_arm64.deb
    sha:96a62a7ba663dd9aa4972620db03ac961741d760
  • alt-python39-tkinter_3.9.23-36_arm64.deb
    sha:14e4b93a2f7531f534acb39287d82d406f7d65bc
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.