CVE-2026-4360

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.(CVE-2026-15308)

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding. Fully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.(CVE-2026-15308)

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.(CVE-2026-15308)

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.(CVE-2026-4360)

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding. Fully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

These are all security issues fixed in the python310-3.10.20-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.15-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.13-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~b4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.14-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python314-3.14.7-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python313 fixes the following issues:

• CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
• CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

Root has patched CVE-2026-4360 in the python3.11 package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-4360 in the python3.13 package for Root:Debian:13. Multiple fixed versions available.

This update for python313 fixes the following issues:

• CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
• CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

This update for python311 fixes the following issues:

Security issues fixed:

• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters (bsc#1262654).
• CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

Non security issues fixed:

• Regression in http.cookies (bsc#1263083).
• udplite was removed -> python fails in tests (bsc#1268375).
• Conflicts between different versions of Python (bsc#1258364).

This update for python311 fixes the following issues:

Security issues fixed:

• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters (bsc#1262654).
• CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

Non security issues fixed:

• Regression in http.cookies (bsc#1263083).
• udplite was removed -> python fails in tests (bsc#1268375).
• Conflicts between different versions of Python (bsc#1258364).

This update for python313 fixes the following issues:

• CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
• CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

This update for python311 fixes the following issues:

• CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).
• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
• CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-4519: leading dashes in URLs are accepted by the webbrowser.open() API and allow for web browser command line option injection (bsc#1260026).
• CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319).
• CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).
• CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
• CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).

Changes for python311:

• Update to 3.11.16:
• Build
• gh-153438: Update Windows build and installer tooling and documentation to use the current download URL for nuget.exe.
• Library
• gh-109638: Fix exponential time in csv.Sniffer.sniff() for a sample which contains many quote characters. A doubled quote character is now also detected in a field which contains the delimiter or a line break.
• gh-98820: Fix quadratic time in csv.Sniffer.sniff() for a sample which contains quoted fields, in particular for a single column of quoted fields.
• gh-149231: In tomllib, the number of parts in TOML keys is now limited.
• gh-146083: Update bundled libexpat to version 2.7.5.
• gh-141707: Don't change tarfile.TarInfo type from AREGTYPE to DIRTYPE when parsing GNU long name or link headers (bsc#1259611, CVE-2025-13462).
• gh-90949: Add SetBillionLaughsAttackProtectionActivationThreshold() and SetBillionLaughsAttackProtectionMaximumAmplification() to xmlparser objects to tune protections against billion laughs attacks. Patch by B�n�dikt Tran.
• gh-100372: ssl.SSLContext.load_verify_locations() no longer incorrectly accepts some cases of trailing data when parsing DER.
• Security
• gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE-2026-72522.
• gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in…

This update for python310 fixes the following issues:

Security issues fixed:

• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

Non security issues fixed:

• [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).
• crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel, openssh, libssh and more packages (bsc#1211301).

This update for python311 fixes the following issues:

Security issues fixed:

• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

Non security issue fixed:

• Improve testing for the support of IPPROTO_UDPLITE, which could be not present although header files are (bsc#1268375).

This update for python311 fixes the following issues:

Security issues fixed:

• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

Non security issue fixed:

• [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).

This update for python312 fixes the following issues:

Security issues fixed:

• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

Non security issues fixed:

• [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).
• crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel, openssh, libssh and more packages (bsc#1211301).

This update for python3 fixes the following issues:

• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599).
• CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262467).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442, bsc#1263443).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (bsc#1266669).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).
• Fix for CVE-2026-6019 does not handle non-ascii chars correctly. Regression in http.cookies (bsc#1263083).

This update for python313 fixes the following issues:

• CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
• CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262429).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).
• Regression in http.cookies (bsc#1263083).

Changes for python313:

• Update to 3.13.14:
• Security
• gh-151159: Bumps the OpenSSL version to 3.0.21 on Android.
• gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
• gh-149835: shutil.move() now resolves symlinks via os.path.realpath() when checking whether the destination is inside the source directory, preventing a symlink-based bypass of that guard.
• gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE 2026-45186.
• gh-87451: The ftplib module's undocumented ftpcp function no longer trusts the IPv4 address value returned from the source server in response to the PASV command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape AI for the report (bsc#1265268, CVE-2026-8328)
• gh-149486: tarfile.data_filter() now validates link targets using the same normalised value that is written to disk, strips trailing separators from the member name when resolving a symlink's directory, and rejects link members that would replace the destination directory itself. This closes several path-traversal bypasses of the data extraction filter (bsc#1267821, CVE-2026-7774).
• gh-149079: Fix a potential denial of service in unicodedata.normalize(). The canonical ordering step of Unicode normalization used a quadratic-time insertion sort for reordering combining characters, which could be exploited with crafted input containing many combining characters in non-canonical order. Replaced with a linear-time counting sort for long runs (bsc#1267581, CVE-2026-3276).
• gh-149018: Improved protection against XML hash-flooding attacks in xml.parsers.expat and xml.etree.ElementTree when Python is compiled with libExpat 2.8.0 or later (CVE-2026-7210, bsc#1264962).
• gh-149017: Update bundled libexpat to version 2.8.0.
• gh-90309: Base64-encode values when embedding cookies to JavaScript using the…

This update for python36 fixes the following issues:

• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF bytes (bsc#1261969).
• CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599).
• CVE-2026-3219: pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file (bsc#1262467).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-4786: URLs prefixed with %action can pass the dash-prefix safety check and allow for command injection (bsc#1262319).
• CVE-2026-6019: BaseCookie.js_output() does not neutralize characters in cookie values embedded in JS (bsc#1262654).
• CVE-2026-6100: use-after-free in decompression modules when a memory allocation fails with MemoryError and the decompression instance is re-used (bsc#1262098).
• CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442, bsc#1263443).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-8643: path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (bsc#1266669).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).
• Regression in http.cookies due to CVE-2026-6019 fix not handling non-ASCII characters correctly (bsc#1263083).

This update for python39.SUSE_SLE-15-SP3_Update fixes the following issues:

Security issues fixed:

• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1274743).
• CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

Non security issues fixed:

• crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel, openssh, libssh and more packages (bsc#1211301).
• Update bundled pip wheels to pip-20.0.2-py2.py3-none-any.whl

This update for python312 fixes the following issues:

• CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).
• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-4519: leading dashes in URLs are accepted by the webbrowser.open() API and allow for web browser command line option injection (bsc#1260026).
• CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).
• CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
• CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
• CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
• CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and retu (bsc#1276227).

Changes for python312:

• Update to 3.12.14:
• Core and Builtins
• gh-139808: Add branch protections for AArch64 (BTI/PAC) in assembly code used by -X perf_jit (Linux perf profiler integration).
• Documentation
• gh-136155: We are now checking for fatal errors in EPUB builds in CI.
• Library
• gh-109638: Fix exponential time in csv.Sniffer.sniff() for a sample which contains many quote characters. A doubled quote character is now also detected in a field which contains the delimiter or a line break.
• gh-98820: Fix quadratic time in csv.Sniffer.sniff() for a sample which contains quoted fields, in particular for a single column of quoted fields.
• gh-149231: In tomllib, the number of parts in TOML keys is now limited.
• gh-146083: Update bundled libexpat to version 2.7.5.
• gh-141707: Don't change tarfile.TarInfo type from AREGTYPE to DIRTYPE when parsing GNU long name or link headers (bsc#1259611, CVE-2025-13462).
• gh-90949: Add SetBillionLaughsAttackProtectionActivationThreshold() and SetBillionLaughsAttackProtectionMaximumAmplification() to xmlparser objects to tune protections against billion laughs attacks. Patch by B�n�dikt Tran.
• Security
• gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE 2026-72522.
• gh-153030: Fixed quadratic complexity in incremental parsing of long…

This update fixes the following issues:

scap-security-guide was updated to version 0.1.79:

• Version 0.1.79 (jsc#ECO-3319)
  • Added SLE16 profiles to the build
  • Create SLE16 HIPAA profile
  • Create SLE16 PCI DSS 4 profile
  • Use Sequoia in RHEL 10 instead of GPG
  • New Profile for RHEL10: BSI
  • Move RHEL Control files to product files
  • Update RHEL 9 CCN profile
  • Various updates for SLE 12/15

spacecmd was updated to version 5.2.10:

• Version 5.2.10:
  • Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Version 5.2.9:
  • Updated translation strings

uyuni-tools was updated to version 5.2.17:

Security issues fixed:

• CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0

Bug fixes and changes:

• Version 5.2.17-0:

  • Bump the default image tag to 5.2.1
  • Reload systemd daemon before restarting services (bsc#1270033)
  • Check all supported locations for CA file in rotation check script
  • Detect and fix legacy service file (bsc#1268755)
  • Use healthcheck cmd from the image (bsc#1273144)

• Version 5.2.16-0:

  • Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)

• Version 5.2.15-0:

  • Added requirement for at least Podman v4.7.2
  • Send READY notification to systemd only once healthy (bsc#1263823)

• Version 5.2.14-0:

  • Include the server environment file in the backup (bsc#1268649)
  • Added mgradm commands for SSL CA and certificate rotation

• Version 5.2.13-0:

  • Check and warn if CA certificate isn't marked as critical
  • Disable SSL on database during split (bsc#1267980)
  • Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)
  • Check backup status only after database is started (bsc#1262492)

venv-salt-minion:

• Security issues:

  • CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)
  • CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)
  • CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)
  • CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)
  • CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)
  • CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)
  • CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)
  • CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)
  • CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)
  • CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)
  • CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)
  • CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)
  • CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)
  • CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)
  • CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)
  • CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)
  • CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)
  • CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)
  • CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)
  • CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)
  • CVE-2026-44431: Fixed data leaks…

This update fixes the following issues:

scap-security-guide was updated to version 0.1.79:

• Version 0.1.79 (jsc#ECO-3319)
  • Added SLE16 profiles to the build
  • Create SLE16 HIPAA profile
  • Create SLE16 PCI DSS 4 profile
  • Use Sequoia in RHEL 10 instead of GPG
  • New Profile for RHEL10: BSI
  • Move RHEL Control files to product files
  • Update RHEL 9 CCN profile
  • Various updates for SLE 12/15

spacecmd was updated to version 5.2.10:

• Version 5.2.10:
  • Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Version 5.2.9:
  • Updated translation strings

uyuni-tools was updated to version 5.2.17:

Security issues fixed:

• CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0

Bug fixes and changes:

• Version 5.2.17-0:

  • Bump the default image tag to 5.2.1
  • Reload systemd daemon before restarting services (bsc#1270033)
  • Check all supported locations for CA file in rotation check script
  • Detect and fix legacy service file (bsc#1268755)
  • Use healthcheck cmd from the image (bsc#1273144)

• Version 5.2.16-0:

  • Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)

• Version 5.2.15-0:

  • Added requirement for at least Podman v4.7.2
  • Send READY notification to systemd only once healthy (bsc#1263823)

• Version 5.2.14-0:

  • Include the server environment file in the backup (bsc#1268649)
  • Added mgradm commands for SSL CA and certificate rotation

• Version 5.2.13-0:

  • Check and warn if CA certificate isn't marked as critical
  • Disable SSL on database during split (bsc#1267980)
  • Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)
  • Check backup status only after database is started (bsc#1262492)

venv-salt-minion:

• Security issues:

  • CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)
  • CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)
  • CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)
  • CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)
  • CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)
  • CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)
  • CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)
  • CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)
  • CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)
  • CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)
  • CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)
  • CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)
  • CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)
  • CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)
  • CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)
  • CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)
  • CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)
  • CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)
  • CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)
  • CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)
  • CVE-2026-44431: Fixed data leaks…

This update fixes the following issues:

scap-security-guide was updated to version 0.1.79:

• Version 0.1.79 (jsc#ECO-3319)
  • Added SLE16 profiles to the build
  • Create SLE16 HIPAA profile
  • Create SLE16 PCI DSS 4 profile
  • Use Sequoia in RHEL 10 instead of GPG
  • New Profile for RHEL10: BSI
  • Move RHEL Control files to product files
  • Update RHEL 9 CCN profile
  • Various updates for SLE 12/15

spacecmd was updated to version 5.2.10:

• Version 5.2.10:
  • Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Version 5.2.9:
  • Updated translation strings

uyuni-tools was updated to version 5.2.17:

Security issues fixed:

• CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0

Bug fixes and changes:

• Version 5.2.17-0:

  • Bump the default image tag to 5.2.1
  • Reload systemd daemon before restarting services (bsc#1270033)
  • Check all supported locations for CA file in rotation check script
  • Detect and fix legacy service file (bsc#1268755)
  • Use healthcheck cmd from the image (bsc#1273144)

• Version 5.2.16-0:

  • Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)

• Version 5.2.15-0:

  • Added requirement for at least Podman v4.7.2
  • Send READY notification to systemd only once healthy (bsc#1263823)

• Version 5.2.14-0:

  • Include the server environment file in the backup (bsc#1268649)
  • Added mgradm commands for SSL CA and certificate rotation

• Version 5.2.13-0:

  • Check and warn if CA certificate isn't marked as critical
  • Disable SSL on database during split (bsc#1267980)
  • Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)
  • Check backup status only after database is started (bsc#1262492)

venv-salt-minion:

• Security issues:

  • CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)
  • CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)
  • CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)
  • CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)
  • CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)
  • CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)
  • CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)
  • CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)
  • CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)
  • CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)
  • CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)
  • CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)
  • CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)
  • CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)
  • CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)
  • CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)
  • CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)
  • CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)
  • CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)
  • CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)
  • CVE-2026-44431: Fixed data leaks…

This update fixes the following issues:

mgr-push:

• Version 5.2.5-0
  • Remove token based authentication mechanism for package_push (bsc#1230949)

spacecmd:

• Version 5.2.10-0
  • Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Version 5.2.9-0
  • Update translation strings

spacewalk-client-tools:

• Version 5.2.7-0
  • Update translation strings

venv-salt-minion:

• CVE-2026-13346: Arbitrary file installation via malicious package indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
• CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in configparser (bsc#1269066, gh#python/cpython#143927)
• CVE-2026-1502: reject CR/LF in HTTP tunnel request headers (bsc#1261969, gh#python/cpython#146211)
• CVE-2026-3276: Fix O(n^2) canonical ordering in unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
• CVE-2026-4360: Pass filter_function to TarFile._extract_one() during .extract() (bsc#1269959, gh#python/cpython#151987)
• CVE-2026-4786: fix webbrowser %action substitution bypass of dash-prefix check (bsc#1262319, gh#python/cpython#148169)
• CVE-2026-6019: protect against HTML injection by Base64-encoding cookie values embedded in JS (bsc#1262654, gh#python/cpython#90309)
• CVE-2026-6100: prevent dangling pointer, which can end in the use-after-free error (bsc#1262098, gh#python/cpython#148395)
• CVE-2026-7210: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (bsc#1264962, gh#python/cpython#149018)
• CVE-2026-7774: tarfile.data_filter: validate written link target (bsc#1267821, gh#149486)
• CVE-2026-8328: Make ftplib not trust the PASV response (bsc#1265268)
• CVE-2026-11940: fix the symlink escape via tarfile hardlink-extraction fallback (bsc#1268977)
• CVE-2026-11972: Make tarfile._Stream.seek break at EOF (bsc#1269788, gh#python/cpython#151981)
• CVE-2026-15308: Fix quadratic complexity in incremental parsing in HTMLParser (bsc#1271192, gh#python/cpython#153030)
• CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (bsc#1266669)
• CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442)
• CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
• CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599, gh#pypa/pip#13777)
• CVE-2024-22195: Fix compiler error when checking if required blocks in parent templates are xmlattr filter does not allow keys with spaces. (bsc#1218722)
• CVE-2026-45409: Specially crafted inputs to idna.encode() can bypass earlier security fix (bsc#1265413)
• CVE-2026-44431: sensitive information disclosure due to sensitive headers being forwarded across origins in proxied low-level redirects (bsc#1265267)
• CVE-2026-49825: The known link attributes in lxml.html.defs.link_attrs were missing xlink:href, which can be used for URL bypass attributes in embedded SVG/MathML/etc. content. (bsc#1270285) https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f
• CVE-2026-41066: This release fixes a possible external entity injection (XXE) vulnerability in iterparse() and the ETCompatXMLParser. (bsc#1263254)
• CVE-2026-3446: Preventing ignoring excess Base64 data after the first padded quad in non-strict (default) mode. (bsc#1261970, gh#python/cpython#145264)
• CVE-2026-3479: pkgutil.get_data() has the same security model as open(). The documented limitations ensure compatibility with non-filesystem loaders; Python doesn't check that. (bsc#1259989, gh#python/cpython#146121)
• CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1271428)
• CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
• CVE-2026-49854: out-of-bounds…

This update fixes the following issues:

mgr-push was updated to version 5.2.5:

• Removed token based authentication mechanism for package_push (bsc#1230949)

spacecmd was updated to version 5.2.10:

• Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)
• Updated translation strings

spacewalk-client-tools was updated to version 5.2.7::

• Updated translation strings

uyuni-tools was updated to version 5.2.17:

Security issues fixed:

• CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481)

Bug fixes and changes:

• Version 5.2.17-0:

  • Bump the default image tag to 5.2.1
  • Reload systemd daemon before restarting services (bsc#1270033)
  • Check all supported locations for CA file in rotation check script
  • Detect and fix legacy service file (bsc#1268755)
  • Use healthcheck cmd from the image (bsc#1273144)

• Version 5.2.16-0:

  • Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)

• Version 5.2.15-0:

  • Added requirement for at least Podman v4.7.2
  • Send READY notification to systemd only once healthy (bsc#1263823)

• Version 5.2.14-0:

  • Include the server environment file in the backup (bsc#1268649)
  • Added mgradm commands for SSL CA and certificate rotation

• Version 5.2.13-0:

  • Check and warn if CA certificate isn't marked as critical
  • Disable SSL on database during split (bsc#1267980)
  • Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)
  • Check backup status only after database is started (bsc#1262492)

venv-salt-minion:

• Security issues:

  • CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)
  • CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)
  • CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)
  • CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)
  • CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)
  • CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)
  • CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)
  • CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)
  • CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)
  • CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)
  • CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)
  • CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)
  • CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)
  • CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)
  • CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)
  • CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)
  • CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)
  • CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)
  • CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)
  • CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)
  • CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)
  • CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)
  • CVE-2026-41066: Fixed leakage of private system data via…

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

• Security issues:

  • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
  • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
  • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
  • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
  • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
  • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
  • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
  • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
  • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
  • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
  • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
  • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
  • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

• Bug fixes and changes:

  • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
  • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
  • Native Histograms are no longer experimental. They are fully supported for production workloads.
  • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
  • TSDB compaction speed optimized by improving the block merging algorithm.
  • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
  • Added new metrics to monitor the health of the rule evaluation engine.
  • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
  • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
  • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
  • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
  • Support exporting TSDB blocks directly to cloud storage via the admin API.
  • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
  • Significant query performance boost for high-cardinality regex matchers.
  • Introduce a new UI interface for safely deleting specific time series data directly.
  • Added dynamic relabeling actions to extract substrings using regex capture groups.
  • Fixed UI displaying incorrect time ranges after a timezone change.
  • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

grafana was updated to version 12.4.10:

• Security issues:

  • CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
  • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)
  • CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)
  • CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973) *…