[CLSA-2026:1794315112] Fix CVE(s): CVE-2026-114583, CVE-2026-116566
Type:
security
Severity:
Moderate
Release date:
2026-11-10 12:52:06 UTC
Description:
* SECURITY UPDATE: reject a link member that names the destination directory itself in the tarfile extraction filters - debian/patches/CVE-2026-114583.patch: move the destination-replacement check out of the 'data' filter branch in Lib/tarfile.py so both the 'tar' and 'data' filters raise OutsideDestinationError, and extend Lib/test/test_tarfile.py to cover both filters - CVE-2026-114583 * SECURITY UPDATE: reject embedded null characters in the host and port arguments of socket.getaddrinfo() - debian/patches/CVE-2026-116566.patch: track the byte length of the host and port arguments in Modules/socketmodule.c and raise ValueError when a NUL byte truncates them - CVE-2026-116566
CVEs fixed:
Updated packages:
  • alt-python310_3.10.22-4_amd64.deb
    sha:0772ff155df3580335bb7e2505457ab65a208364
  • alt-python310-debug_3.10.22-4_amd64.deb
    sha:ea461b400bf27b2837fcc5af27403900316968a5
  • alt-python310-devel_3.10.22-4_amd64.deb
    sha:78c42571d4cfe9fefcc5025fa74293e026dcdb73
  • alt-python310-idle_3.10.22-4_amd64.deb
    sha:2bf26cac22e122dd38ce6afef264fd80f456a916
  • alt-python310-libs_3.10.22-4_amd64.deb
    sha:e8cbe891a8c21ae58393c51fe7ce614db46295ed
  • alt-python310-test_3.10.22-4_amd64.deb
    sha:8b0090d2478fb7278e9aafbb2cb1afeed3a7251d
  • alt-python310-tkinter_3.10.22-4_amd64.deb
    sha:72eb7a15a6d2787db9acbe0a5e2761311ed3cd7b
  • alt-python310_3.10.22-4_arm64.deb
    sha:9378fc75142a877b9fa6b381c3444799c3231575
  • alt-python310-debug_3.10.22-4_arm64.deb
    sha:22ecae9fc8344d11a4754d456430f520fb30fe49
  • alt-python310-devel_3.10.22-4_arm64.deb
    sha:088f1c016d21547cc204621fe44ebd4d815a27e8
  • alt-python310-idle_3.10.22-4_arm64.deb
    sha:eb344d97dc06a4475f4f2ebe179a80f558be010b
  • alt-python310-libs_3.10.22-4_arm64.deb
    sha:d3e5eb5e3edf968c1f548a7e16746bd9e6dad09b
  • alt-python310-test_3.10.22-4_arm64.deb
    sha:d4a4d6041972317ce5f4b64486dc859f4d1afc4d
  • alt-python310-tkinter_3.10.22-4_arm64.deb
    sha:6e372369259427b4ca56e81ef49bd62343dc9f4f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.