{"id":"CVE-2026-82049","aliases":["ALPINE-CVE-2026-82049","AZL-101784","AZL-101832","BELL-CVE-2026-82049","BIT-libpython-2026-82049","BIT-python-2026-82049","BIT-python-min-2026-82049","CLSA-2026-1789662396","CLSA-2026-1789719542","CLSA-2026-1789719876","CLSA-2026-1789736914","CLSA-2026-1789749056","CLSA-2026-1790238098","CLSA-2026-1791485785","CLSA-2026-1791486047","CLSA-2026-1791486224","CLSA-2026-1791896121","CLSA-2026-1791897081","CLSA-2026-1791897945","CLSA-2026-1792411096","DEBIAN-CVE-2026-82049","EUVD-2026-77772","GHSA-ghff-gcpf-9r9p","OESA-2026-4009","OESA-2026-4010","OESA-2026-4011","OESA-2026-4012","PSF-0000-CVE-2026-82049","PSF-2026-41","RHSA-2026:65505","RHSA-2026:68132","RHSA-2026:68135","RHSA-2026:68154","RHSA-2026:68309","ROOT-OS-DEBIAN-13-CVE-2026-82049","SUSE-SU-2026:24280-1","SUSE-SU-2026:24325-1","SUSE-SU-2026:4630-1","SUSE-SU-2026:4659-1","SUSE-SU-2026:4738-1","SUSE-SU-2026:4743-1","SUSE-SU-2026:4744-1","SUSE-SU-2026:4754-1","SUSE-SU-2026:4809-1","SUSE-SU-2026:4904-1","SUSE-SU-2026:4941-1","SUSE-SU-2026:4946-1","UBUNTU-CVE-2026-82049","openSUSE-SU-2026:12069-1","openSUSE-SU-2026:12087-1","openSUSE-SU-2026:12121-1","openSUSE-SU-2026:12122-1","openSUSE-SU-2026:12123-1"],"status":"published","title":"tarfile extraction filters allow file modification and content disclosure via hard link to symlink","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","severity":{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00188,"percentile":0.08419,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-09-09T10:20:31Z","modified":"2026-11-04T07:13:55Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"python3","fixed_in":["3.12.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"python3","fixed_in":["3.12.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"python3","fixed_in":["3.12.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"python3","fixed_in":["3.14.8-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python3","fixed_in":["3.12.15-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"python3","fixed_in":["3.11.17-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"python3","fixed_in":["3.12.15-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"python3","fixed_in":["3.14.3-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"python3","fixed_in":["3.11.17-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"python3","fixed_in":["3.12.15-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"python3","fixed_in":["3.14.3-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"libpython","fixed_in":["3.10.22","3.11.17","3.12.15","3.13.16"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python","fixed_in":["3.10.22","3.11.17","3.12.15","3.13.16"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python-min","fixed_in":["3.10.22","3.11.17","3.12.15","3.13.16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python-unversioned-command","fixed_in":["3.9.16-1.el9_2.2.tuxcare.els35"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3","fixed_in":["3.9.16-1.el9_2.2.tuxcare.els35"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-debug","fixed_in":["3.9.16-1.el9_2.2.tuxcare.els35"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-devel","fixed_in":["3.9.16-1.el9_2.2.tuxcare.els35"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-idle","fixed_in":["3.9.16-1.el9_2.2.tuxcare.els35"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-libs","fixed_in":["3.9.16-1.el9_2.2.tuxcare.els35"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-test","fixed_in":["3.9.16-1.el9_2.2.tuxcare.els35"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-tkinter","fixed_in":["3.9.16-1.el9_2.2.tuxcare.els35"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"platform-python","fixed_in":["3.6.8-62.el8.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"platform-python-debug","fixed_in":["3.6.8-62.el8.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"platform-python-devel","fixed_in":["3.6.8-62.el8.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-devel","fixed_in":["3.6.8-62.el8.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-idle","fixed_in":["3.6.8-62.el8.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-libs","fixed_in":["3.6.8-62.el8.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-test","fixed_in":["3.6.8-62.el8.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-tkinter","fixed_in":["3.6.8-62.el8.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"platform-python","fixed_in":["3.6.8-42.el8.tuxcare.els26"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"platform-python-debug","fixed_in":["3.6.8-42.el8.tuxcare.els26"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"platform-python-devel","fixed_in":["3.6.8-42.el8.tuxcare.els26"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"python3-devel","fixed_in":["3.6.8-42.el8.tuxcare.els26"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"python3-idle","fixed_in":["3.6.8-42.el8.tuxcare.els26"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"python3-libs","fixed_in":["3.6.8-42.el8.tuxcare.els26"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"python3-test","fixed_in":["3.6.8-42.el8.tuxcare.els26"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"python3-tkinter","fixed_in":["3.6.8-42.el8.tuxcare.els26"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"platform-python","fixed_in":["3.6.8-40.el8_4.tuxcare.els27"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"platform-python-debug","fixed_in":["3.6.8-40.el8_4.tuxcare.els27"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"platform-python-devel","fixed_in":["3.6.8-40.el8_4.tuxcare.els27"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python3-devel","fixed_in":["3.6.8-40.el8_4.tuxcare.els27"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python3-idle","fixed_in":["3.6.8-40.el8_4.tuxcare.els27"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python3-libs","fixed_in":["3.6.8-40.el8_4.tuxcare.els27"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python3-test","fixed_in":["3.6.8-40.el8_4.tuxcare.els27"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python3-tkinter","fixed_in":["3.6.8-40.el8_4.tuxcare.els27"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python-unversioned-command","fixed_in":["3.9.21-2.el9_6.2.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3","fixed_in":["3.9.21-2.el9_6.2.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-debug","fixed_in":["3.9.21-2.el9_6.2.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-devel","fixed_in":["3.9.21-2.el9_6.2.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-idle","fixed_in":["3.9.21-2.el9_6.2.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-libs","fixed_in":["3.9.21-2.el9_6.2.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-test","fixed_in":["3.9.21-2.el9_6.2.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-tkinter","fixed_in":["3.9.21-2.el9_6.2.tuxcare.els20"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11","fixed_in":["3.11.11-2.el9_6.2.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-debug","fixed_in":["3.11.11-2.el9_6.2.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-devel","fixed_in":["3.11.11-2.el9_6.2.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-idle","fixed_in":["3.11.11-2.el9_6.2.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-libs","fixed_in":["3.11.11-2.el9_6.2.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-test","fixed_in":["3.11.11-2.el9_6.2.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-tkinter","fixed_in":["3.11.11-2.el9_6.2.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pypy3","fixed_in":["8.0.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"python3.13","fixed_in":["3.13.5-2+deb13u5.aikido.28","3.13.5-2+deb13u5.aikido.26","3.13.5-2+deb13u5.aikido.27"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-python3.13","fixed_in":["3.13.5-2+deb13u5.aikido.28","3.13.5-2+deb13u5.aikido.26","3.13.5-2+deb13u5.aikido.27"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python","fixed_in":["2.7.18-150000.136.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-base","fixed_in":["2.7.18-150000.136.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python","fixed_in":["2.7.18-33.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python-base","fixed_in":["2.7.18-33.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python-doc","fixed_in":["2.7.18-33.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python","fixed_in":["2.7.18-33.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python-base","fixed_in":["2.7.18-33.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python-doc","fixed_in":["2.7.18-33.93.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.8-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tensorflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.1-11"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.3-r0"},{"fixed":"3.11.17-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.10-r1"},{"fixed":"3.12.15-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.4-r0"},{"fixed":"3.14.3-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.3-r0"},{"fixed":"3.11.17-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.10-r1"},{"fixed":"3.12.15-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.4-r0"},{"fixed":"3.14.3-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"libpython","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python-unversioned-command","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-1.el9_2.2.tuxcare.els35"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-1.el9_2.2.tuxcare.els35"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-1.el9_2.2.tuxcare.els35"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-1.el9_2.2.tuxcare.els35"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-1.el9_2.2.tuxcare.els35"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-1.el9_2.2.tuxcare.els35"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-1.el9_2.2.tuxcare.els35"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-1.el9_2.2.tuxcare.els35"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"platform-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"platform-python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"platform-python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"platform-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els26"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"platform-python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els26"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"platform-python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els26"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els26"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els26"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els26"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els26"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-42.el8.tuxcare.els26"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"platform-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-40.el8_4.tuxcare.els27"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"platform-python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-40.el8_4.tuxcare.els27"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"platform-python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-40.el8_4.tuxcare.els27"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-40.el8_4.tuxcare.els27"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-40.el8_4.tuxcare.els27"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-40.el8_4.tuxcare.els27"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-40.el8_4.tuxcare.els27"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-40.el8_4.tuxcare.els27"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python-unversioned-command","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.21-2.el9_6.2.tuxcare.els20"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els35"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els35"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els35"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els35"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els35"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els35"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3.11-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-2.el9_2.2.tuxcare.els35"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-94.0.9.el7_9.tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python3-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python3-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python3-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-21.0.13.el7_9.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3.11-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-2.el9_6.2.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pypy3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.19+dfsg-2","7.3.20+dfsg-1","7.3.20+dfsg-2","7.3.20+dfsg-3","7.3.20+dfsg-4","7.3.21+dfsg-1","7.3.21+dfsg-2","7.3.21+dfsg-3","7.3.21+dfsg-4","7.3.22+dfsg-1","7.3.23+dfsg-1","7.3.23+dfsg-2","8.0.0+dfsg-1","8.0.1+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"pypy3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1+dfsg-1"}]}],"versions":["7.3.19+dfsg-2","7.3.20+dfsg-1","7.3.20+dfsg-2","7.3.20+dfsg-3","7.3.20+dfsg-4","7.3.21+dfsg-1","7.3.21+dfsg-2","7.3.21+dfsg-3","7.3.21+dfsg-4","7.3.22+dfsg-1","7.3.23+dfsg-1","7.3.23+dfsg-2","8.0.0+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python3.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.13.11-1","3.13.12-1","3.13.14-1","3.13.15-1","3.13.18-1","3.13.5-2","3.13.5-2+deb13u1","3.13.5-2+deb13u2","3.13.5-2+deb13u3","3.13.5-2+deb13u4","3.13.5-2+deb13u5","3.13.6-1","3.13.7-1","3.13.8-1","3.13.9-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.6-43.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.6-43.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.6-45.oe2403sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.9-61.oe2203sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python-unversioned-command","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.7-1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.3.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.3.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.3.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.3.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.3.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.3.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.10-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.21-1.3.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.4.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.4.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.4.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.4.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.4.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.4.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.16-1.4.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.14-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-freethreading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-freethreading-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.15-1.3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Root:Debian:13","package":"python3.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.5-2+deb13u5.aikido.28"},{"fixed":"3.13.5-2+deb13u5.aikido.26"},{"fixed":"3.13.5-2+deb13u5.aikido.27"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-python3.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.5-2+deb13u5.aikido.28"},{"fixed":"3.13.5-2+deb13u5.aikido.26"},{"fixed":"3.13.5-2+deb13u5.aikido.27"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-159998.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-159998.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python310-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python310-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python310-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python310-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python312","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-150600.3.71.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python312-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-150600.3.71.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python312","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-150600.3.71.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python312-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-150600.3.71.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.136.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.136.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python36","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-125.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python36-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-125.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python36","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-125.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python36-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-125.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-25.199.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-25.199.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-25.199.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-25.199.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python311-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150400.9.105.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-33.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-33.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-33.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-33.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-33.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-33.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python313","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16-150700.4.61.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python313-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16-150700.4.61.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python311-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-150600.3.74.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.5-8ubuntu3","2.7.5-8ubuntu4","2.7.6-2","2.7.6-2ubuntu1","2.7.6-3","2.7.6-3ubuntu1","2.7.6-4","2.7.6-4ubuntu1","2.7.6-5","2.7.6-7","2.7.6-8","2.7.6-8ubuntu0.2","2.7.6-8ubuntu0.3","2.7.6-8ubuntu0.4","2.7.6-8ubuntu0.5","2.7.6-8ubuntu0.6+esm2","2.7.6-8ubuntu0.6+esm3","2.7.6-8ubuntu0.6+esm5","2.7.6-8ubuntu0.6+esm6","2.7.6-8ubuntu0.6+esm7","2.7.6-8ubuntu0.6+esm8","2.7.6-8ubuntu0.6+esm9","2.7.6-8ubuntu0.6+esm10","2.7.6-8ubuntu0.6+esm11","2.7.6-8ubuntu0.6+esm12","2.7.6-8ubuntu0.6+esm13","2.7.6-8ubuntu0.6+esm14","2.7.6-8ubuntu0.6+esm15","2.7.6-8ubuntu0.6+esm16","2.7.6-8ubuntu0.6+esm17","2.7.6-8ubuntu0.6+esm18","2.7.6-8ubuntu0.6+esm20","2.7.6-8ubuntu0.6+esm21","2.7.6-8ubuntu0.6+esm22","2.7.6-8ubuntu0.6+esm24","2.7.6-8ubuntu0.6+esm25","2.7.6-8ubuntu0.6+esm26","2.7.6-8ubuntu0.6+esm28","2.7.6-8ubuntu0.6+esm29","2.7.6-8ubuntu0.6+esm30"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python3.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4~b1-0ubuntu3","3.4~b1-4ubuntu4","3.4~b1-4ubuntu6","3.4~b1-5ubuntu2","3.4~b2-1","3.4~b3-1ubuntu1","3.4~rc1-1build1","3.4~rc2-1","3.4~rc3-0ubuntu1","3.4.0-1","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.3-1ubuntu1~14.04.1","3.4.3-1ubuntu1~14.04.3","3.4.3-1ubuntu1~14.04.4","3.4.3-1ubuntu1~14.04.5","3.4.3-1ubuntu1~14.04.6","3.4.3-1ubuntu1~14.04.7","3.4.3-1ubuntu1~14.04.7+esm2","3.4.3-1ubuntu1~14.04.7+esm4","3.4.3-1ubuntu1~14.04.7+esm6","3.4.3-1ubuntu1~14.04.7+esm7","3.4.3-1ubuntu1~14.04.7+esm8","3.4.3-1ubuntu1~14.04.7+esm10","3.4.3-1ubuntu1~14.04.7+esm11","3.4.3-1ubuntu1~14.04.7+esm12","3.4.3-1ubuntu1~14.04.7+esm13","3.4.3-1ubuntu1~14.04.7+esm14","3.4.3-1ubuntu1~14.04.7+esm15","3.4.3-1ubuntu1~14.04.7+esm16","3.4.3-1ubuntu1~14.04.7+esm17","3.4.3-1ubuntu1~14.04.7+esm19","3.4.3-1ubuntu1~14.04.7+esm20","3.4.3-1ubuntu1~14.04.7+esm21"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python3.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.2-2ubuntu0~16.04.4~14.04.1","3.5.2-2ubuntu0~16.04.4~14.04.1+esm1","3.5.2-2ubuntu0~16.04.4~14.04.1+esm3","3.5.2-2ubuntu0~16.04.4~14.04.1+esm4","3.5.2-2ubuntu0~16.04.4~14.04.1+esm5","3.5.2-2ubuntu0~16.04.4~14.04.1+esm6","3.5.2-2ubuntu0~16.04.4~14.04.1+esm7","3.5.2-2ubuntu0~16.04.4~14.04.1+esm8","3.5.2-2ubuntu0~16.04.4~14.04.1+esm9","3.5.2-2ubuntu0~16.04.4~14.04.1+esm10","3.5.2-2ubuntu0~16.04.4~14.04.1+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.10-4ubuntu1","2.7.10-4ubuntu2","2.7.11-2","2.7.11-3","2.7.11-4","2.7.11-6","2.7.11-7","2.7.11-7ubuntu1","2.7.12-1~16.04","2.7.12-1ubuntu0~16.04.1","2.7.12-1ubuntu0~16.04.2","2.7.12-1ubuntu0~16.04.3","2.7.12-1ubuntu0~16.04.4","2.7.12-1ubuntu0~16.04.8","2.7.12-1ubuntu0~16.04.9","2.7.12-1ubuntu0~16.04.11","2.7.12-1ubuntu0~16.04.12","2.7.12-1ubuntu0~16.04.13","2.7.12-1ubuntu0~16.04.14","2.7.12-1ubuntu0~16.04.16","2.7.12-1ubuntu0~16.04.18","2.7.12-1ubuntu0~16.04.18+esm1","2.7.12-1ubuntu0~16.04.18+esm2","2.7.12-1ubuntu0~16.04.18+esm3","2.7.12-1ubuntu0~16.04.18+esm4","2.7.12-1ubuntu0~16.04.18+esm5","2.7.12-1ubuntu0~16.04.18+esm6","2.7.12-1ubuntu0~16.04.18+esm7","2.7.12-1ubuntu0~16.04.18+esm8","2.7.12-1ubuntu0~16.04.18+esm9","2.7.12-1ubuntu0~16.04.18+esm10","2.7.12-1ubuntu0~16.04.18+esm11","2.7.12-1ubuntu0~16.04.18+esm12","2.7.12-1ubuntu0~16.04.18+esm13","2.7.12-1ubuntu0~16.04.18+esm15","2.7.12-1ubuntu0~16.04.18+esm16","2.7.12-1ubuntu0~16.04.18+esm17","2.7.12-1ubuntu0~16.04.18+esm18","2.7.12-1ubuntu0~16.04.18+esm19","2.7.12-1ubuntu0~16.04.18+esm20","2.7.12-1ubuntu0~16.04.18+esm21","2.7.12-1ubuntu0~16.04.18+esm22"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python3.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.0-3","3.5.0-3ubuntu1","3.5.1~rc1-2ubuntu1","3.5.1-1","3.5.1-2","3.5.1-3","3.5.1-5","3.5.1-6ubuntu1","3.5.1-6ubuntu2","3.5.1-9ubuntu1","3.5.1-10","3.5.2-2~16.01","3.5.2-2~16.04","3.5.2-2ubuntu0~16.04.1","3.5.2-2ubuntu0~16.04.2","3.5.2-2ubuntu0~16.04.3","3.5.2-2ubuntu0~16.04.4","3.5.2-2ubuntu0~16.04.5","3.5.2-2ubuntu0~16.04.8","3.5.2-2ubuntu0~16.04.9","3.5.2-2ubuntu0~16.04.10","3.5.2-2ubuntu0~16.04.11","3.5.2-2ubuntu0~16.04.12","3.5.2-2ubuntu0~16.04.13","3.5.2-2ubuntu0~16.04.13+esm1","3.5.2-2ubuntu0~16.04.13+esm2","3.5.2-2ubuntu0~16.04.13+esm3","3.5.2-2ubuntu0~16.04.13+esm5","3.5.2-2ubuntu0~16.04.13+esm6","3.5.2-2ubuntu0~16.04.13+esm7","3.5.2-2ubuntu0~16.04.13+esm8","3.5.2-2ubuntu0~16.04.13+esm9","3.5.2-2ubuntu0~16.04.13+esm10","3.5.2-2ubuntu0~16.04.13+esm11","3.5.2-2ubuntu0~16.04.13+esm12","3.5.2-2ubuntu0~16.04.13+esm13","3.5.2-2ubuntu0~16.04.13+esm14","3.5.2-2ubuntu0~16.04.13+esm15","3.5.2-2ubuntu0~16.04.13+esm16","3.5.2-2ubuntu0~16.04.13+esm17","3.5.2-2ubuntu0~16.04.13+esm18","3.5.2-2ubuntu0~16.04.13+esm19","3.5.2-2ubuntu0~16.04.13+esm20","3.5.2-2ubuntu0~16.04.13+esm21","3.5.2-2ubuntu0~16.04.13+esm22","3.5.2-2ubuntu0~16.04.13+esm23","3.5.2-2ubuntu0~16.04.13+esm24","3.5.2-2ubuntu0~16.04.13+esm25"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.14-2ubuntu2","2.7.14-4","2.7.14-6","2.7.14-7","2.7.14-8","2.7.15~rc1-1","2.7.15~rc1-1ubuntu0.1","2.7.15-4ubuntu4~18.04","2.7.15-4ubuntu4~18.04.1","2.7.15-4ubuntu4~18.04.2","2.7.17-1~18.04","2.7.17-1~18.04ubuntu1","2.7.17-1~18.04ubuntu1.1","2.7.17-1~18.04ubuntu1.2","2.7.17-1~18.04ubuntu1.3","2.7.17-1~18.04ubuntu1.5","2.7.17-1~18.04ubuntu1.6","2.7.17-1~18.04ubuntu1.7","2.7.17-1~18.04ubuntu1.8","2.7.17-1~18.04ubuntu1.10","2.7.17-1~18.04ubuntu1.11","2.7.17-1~18.04ubuntu1.13","2.7.17-1~18.04ubuntu1.13+esm1","2.7.17-1~18.04ubuntu1.13+esm2","2.7.17-1~18.04ubuntu1.13+esm3","2.7.17-1~18.04ubuntu1.13+esm4","2.7.17-1~18.04ubuntu1.13+esm5","2.7.17-1~18.04ubuntu1.13+esm6","2.7.17-1~18.04ubuntu1.13+esm7","2.7.17-1~18.04ubuntu1.13+esm8","2.7.17-1~18.04ubuntu1.13+esm10","2.7.17-1~18.04ubuntu1.13+esm11","2.7.17-1~18.04ubuntu1.13+esm12","2.7.17-1~18.04ubuntu1.13+esm13","2.7.17-1~18.04ubuntu1.13+esm14","2.7.17-1~18.04ubuntu1.13+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python3.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.3-1ubuntu1","3.6.4~rc1-1","3.6.4~rc1-2","3.6.4-1","3.6.4-2","3.6.4-3build1","3.6.4-4","3.6.5~rc1-1","3.6.5-3","3.6.6-1~18.04","3.6.7-1~18.04","3.6.8-1~18.04.1","3.6.8-1~18.04.2","3.6.8-1~18.04.3","3.6.9-1~18.04","3.6.9-1~18.04ubuntu1","3.6.9-1~18.04ubuntu1.1","3.6.9-1~18.04ubuntu1.3","3.6.9-1~18.04ubuntu1.4","3.6.9-1~18.04ubuntu1.6","3.6.9-1~18.04ubuntu1.7","3.6.9-1~18.04ubuntu1.8","3.6.9-1~18.04ubuntu1.9","3.6.9-1~18.04ubuntu1.10","3.6.9-1~18.04ubuntu1.12","3.6.9-1~18.04ubuntu1.13","3.6.9-1~18.04ubuntu1.13+esm1","3.6.9-1~18.04ubuntu1.13+esm2","3.6.9-1~18.04ubuntu1.13+esm3","3.6.9-1~18.04ubuntu1.13+esm4","3.6.9-1~18.04ubuntu1.13+esm5","3.6.9-1~18.04ubuntu1.13+esm6","3.6.9-1~18.04ubuntu1.13+esm7","3.6.9-1~18.04ubuntu1.13+esm8","3.6.9-1~18.04ubuntu1.13+esm9","3.6.9-1~18.04ubuntu1.13+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python3.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.0~a2-1","3.7.0~a3-1","3.7.0~a3-2","3.7.0~a3-3","3.7.0~a4-1","3.7.0~b1-1","3.7.0~b1-1build1","3.7.0~b2-1","3.7.0~b3-1","3.7.0-1~18.04","3.7.1-1~18.04","3.7.3-2~18.04.1","3.7.5-2~18.04","3.7.5-2~18.04.4","3.7.5-2ubuntu1~18.04.2","3.7.5-2ubuntu1~18.04.2+esm1","3.7.5-2ubuntu1~18.04.2+esm2","3.7.5-2ubuntu1~18.04.2+esm3","3.7.5-2ubuntu1~18.04.2+esm4","3.7.5-2ubuntu1~18.04.2+esm5","3.7.5-2ubuntu1~18.04.2+esm6","3.7.5-2ubuntu1~18.04.2+esm7","3.7.5-2ubuntu1~18.04.2+esm8","3.7.5-2ubuntu1~18.04.2+esm9","3.7.5-2ubuntu1~18.04.2+esm10","3.7.5-2ubuntu1~18.04.2+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python3.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-3~18.04","3.8.0-3~18.04.1","3.8.0-3ubuntu1~18.04.2","3.8.0-3ubuntu1~18.04.2+esm1","3.8.0-3ubuntu1~18.04.2+esm2","3.8.0-3ubuntu1~18.04.2+esm3","3.8.0-3ubuntu1~18.04.2+esm4","3.8.0-3ubuntu1~18.04.2+esm5","3.8.0-3ubuntu1~18.04.2+esm6","3.8.0-3ubuntu1~18.04.2+esm7","3.8.0-3ubuntu1~18.04.2+esm8","3.8.0-3ubuntu1~18.04.2+esm9","3.8.0-3ubuntu1~18.04.2+esm10","3.8.0-3ubuntu1~18.04.2+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python3.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-1","3.8.0-2","3.8.0-3","3.8.0-4","3.8.0-5","3.8.1-2ubuntu3","3.8.2~rc1-1ubuntu1","3.8.2-1","3.8.2-1ubuntu1","3.8.2-1ubuntu1.1","3.8.2-1ubuntu1.2","3.8.5-1~20.04","3.8.5-1~20.04.2","3.8.5-1~20.04.3","3.8.10-0ubuntu1~20.04","3.8.10-0ubuntu1~20.04.1","3.8.10-0ubuntu1~20.04.2","3.8.10-0ubuntu1~20.04.4","3.8.10-0ubuntu1~20.04.5","3.8.10-0ubuntu1~20.04.6","3.8.10-0ubuntu1~20.04.7","3.8.10-0ubuntu1~20.04.8","3.8.10-0ubuntu1~20.04.9","3.8.10-0ubuntu1~20.04.10","3.8.10-0ubuntu1~20.04.11","3.8.10-0ubuntu1~20.04.12","3.8.10-0ubuntu1~20.04.13","3.8.10-0ubuntu1~20.04.14","3.8.10-0ubuntu1~20.04.15","3.8.10-0ubuntu1~20.04.16","3.8.10-0ubuntu1~20.04.17","3.8.10-0ubuntu1~20.04.18","3.8.10-0ubuntu1~20.04.18+esm1","3.8.10-0ubuntu1~20.04.18+esm2","3.8.10-0ubuntu1~20.04.18+esm3","3.8.10-0ubuntu1~20.04.18+esm4","3.8.10-0ubuntu1~20.04.18+esm5","3.8.10-0ubuntu1~20.04.18+esm6","3.8.10-0ubuntu1~20.04.18+esm7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pypy3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.1+dfsg-1","7.2.0+dfsg-1","7.3.0+dfsg-1","7.3.0+dfsg-1ubuntu2","7.3.0+dfsg-1ubuntu3","7.3.1+dfsg-4","7.3.1+dfsg-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.17~rc1-1","2.7.17-1","2.7.17-1ubuntu5","2.7.17-1ubuntu6","2.7.18~rc1-2","2.7.18-1~20.04","2.7.18-1~20.04.1","2.7.18-1~20.04.1+esm1","2.7.18-1~20.04.3","2.7.18-1~20.04.3+esm1","2.7.18-1~20.04.4","2.7.18-1~20.04.4+esm1","2.7.18-1~20.04.4+esm2","2.7.18-1~20.04.4+esm3","2.7.18-1~20.04.5","2.7.18-1~20.04.5+esm1","2.7.18-1~20.04.5+esm2","2.7.18-1~20.04.6","2.7.18-1~20.04.6+esm1","2.7.18-1~20.04.7","2.7.18-1~20.04.7+esm3","2.7.18-1~20.04.7+esm4","2.7.18-1~20.04.7+esm6","2.7.18-1~20.04.7+esm7","2.7.18-1~20.04.7+esm8","2.7.18-1~20.04.7+esm9","2.7.18-1~20.04.7+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python3.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.0~rc1-1~20.04","3.9.0-5~20.04","3.9.5-3~20.04.1","3.9.5-3ubuntu0~20.04.1","3.9.5-3ubuntu0~20.04.1+esm1","3.9.5-3ubuntu0~20.04.1+esm2","3.9.5-3ubuntu0~20.04.1+esm3","3.9.5-3ubuntu0~20.04.1+esm4","3.9.5-3ubuntu0~20.04.1+esm5","3.9.5-3ubuntu0~20.04.1+esm6","3.9.5-3ubuntu0~20.04.1+esm7","3.9.5-3ubuntu0~20.04.1+esm8","3.9.5-3ubuntu0~20.04.1+esm9","3.9.5-3ubuntu0~20.04.1+esm10","3.9.5-3ubuntu0~20.04.1+esm11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pypy3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.5+dfsg-2","7.3.7+dfsg-1","7.3.7+dfsg-4","7.3.7+dfsg-5","7.3.8+dfsg-2","7.3.9+dfsg-1","7.3.9+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python3.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.0-2","3.10.0-3","3.10.0-4","3.10.0-5","3.10.0-5build1","3.10.1-1","3.10.1-2","3.10.2-1","3.10.2-5","3.10.2-7","3.10.3-1","3.10.4-3","3.10.4-3ubuntu0.1","3.10.6-1~22.04","3.10.6-1~22.04.1","3.10.6-1~22.04.2","3.10.6-1~22.04.2ubuntu1","3.10.6-1~22.04.2ubuntu1.1","3.10.12-1~22.04.2","3.10.12-1~22.04.3","3.10.12-1~22.04.4","3.10.12-1~22.04.5","3.10.12-1~22.04.6","3.10.12-1~22.04.7","3.10.12-1~22.04.8","3.10.12-1~22.04.9","3.10.12-1~22.04.10","3.10.12-1~22.04.11","3.10.12-1~22.04.12","3.10.12-1~22.04.13","3.10.12-1~22.04.14","3.10.12-1~22.04.15","3.10.12-1~22.04.16","3.10.12-1~22.04.17","3.10.12-1~22.04.18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.18-8build1","2.7.18-13","2.7.18-13ubuntu1","2.7.18-13ubuntu1.1","2.7.18-13ubuntu1.1+esm2","2.7.18-13ubuntu1.2","2.7.18-13ubuntu1.2+esm1","2.7.18-13ubuntu1.2+esm2","2.7.18-13ubuntu1.2+esm3","2.7.18-13ubuntu1.3","2.7.18-13ubuntu1.3+esm1","2.7.18-13ubuntu1.4","2.7.18-13ubuntu1.4+esm1","2.7.18-13ubuntu1.5","2.7.18-13ubuntu1.5+esm2","2.7.18-13ubuntu1.5+esm3","2.7.18-13ubuntu1.5+esm5","2.7.18-13ubuntu1.5+esm6","2.7.18-13ubuntu1.5+esm7","2.7.18-13ubuntu1.5+esm8","2.7.18-13ubuntu1.5+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python3.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.0~rc1-1~22.04","3.11.0~rc1-1~22.04.1~esm1","3.11.0~rc1-1~22.04.1~esm2","3.11.0~rc1-1~22.04.1~esm3","3.11.0~rc1-1~22.04.1~esm4","3.11.0~rc1-1~22.04.1~esm5","3.11.0~rc1-1~22.04.1~esm6","3.11.0~rc1-1~22.04.1~esm7","3.11.0~rc1-1~22.04.1~esm8","3.11.0~rc1-1~22.04.1~esm9","3.11.0~rc1-1~22.04.1","3.11.0~rc1-1~22.04.1+esm1","3.11.0~rc1-1~22.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pypy3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.12+dfsg-1","7.3.13+dfsg-1","7.3.14+dfsg-1","7.3.15+dfsg-1","7.3.15+dfsg-1build2","7.3.15+dfsg-1build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python3.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.0-1","3.12.0-5","3.12.0-6","3.12.0-7","3.12.1-2","3.12.2-1","3.12.2-4build3","3.12.2-4build4","3.12.2-5ubuntu3","3.12.3-1","3.12.3-1ubuntu0.1","3.12.3-1ubuntu0.2","3.12.3-1ubuntu0.3","3.12.3-1ubuntu0.4","3.12.3-1ubuntu0.5","3.12.3-1ubuntu0.6","3.12.3-1ubuntu0.7","3.12.3-1ubuntu0.8","3.12.3-1ubuntu0.9","3.12.3-1ubuntu0.10","3.12.3-1ubuntu0.11","3.12.3-1ubuntu0.12","3.12.3-1ubuntu0.13","3.12.3-1ubuntu0.15","3.12.3-1ubuntu0.16","3.12.3-1ubuntu0.17"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pypy3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.20+dfsg-4","7.3.23+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.4-1","3.14.6-1","3.14.7-1ubuntu1","3.14.7-4ubuntu1","3.14.7-4ubuntu2","3.14.7-5ubuntu1","3.14.8-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pypy3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.20+dfsg-3","7.3.20+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.0-1","3.14.0-2","3.14.0-4","3.14.2-1","3.14.3-1","3.14.3-2","3.14.3-3","3.14.3-5","3.14.4-1","3.14.4-1ubuntu0.1","3.14.4-1ubuntu0.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python315","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0~rc3-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python311","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python312","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python313","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16-1.1"}]}],"bundled":4}],"products":[{"vendor":"python software foundation","product":"cpython"}],"references":[{"url":"https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca","tags":["patch","web","fix","article","report"]},{"url":"https://github.com/python/cpython/issues/157190","tags":["issue-tracking","web","report","article"]},{"url":"https://github.com/python/cpython/pull/157191","tags":["patch","web","fix","article","report"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/","tags":["vendor-advisory","web","advisory","article","report"]},{"url":"https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3","tags":["patch","web","fix","report"]},{"url":"https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d","tags":["patch","web","fix","report"]},{"url":"https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690c","tags":["patch","web","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/14/27","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82049","tags":["web","advisory"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH"},{"url":"https://github.com/advisories/GHSA-ghff-gcpf-9r9p"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-82049","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-82049","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1789662396.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1789719542.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1789719876.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1789736914.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9669","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1789749056.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1790238098.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8328","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1791485785.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4786","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1791486047.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1791486224.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1791896121.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1791897081.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4032","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1791897945.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6100","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792411096.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4519","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82049.json","tags":["advisory"]},{"url":"https://github.com/python/cpython","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-82049","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4009","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18503","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4010","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4011","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4012","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65505","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15310","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15806","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-17084","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19672","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82049","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65505.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523543","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15310","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/156002","tags":["article"]},{"url":"https://github.com/python/cpython/pull/156003","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/155694","tags":["article"]},{"url":"https://github.com/python/cpython/pull/155696","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517897","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/155292","tags":["article"]},{"url":"https://github.com/python/cpython/pull/155293","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519726","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19672","tags":["advisory"]},{"url":"https://github.com/python/cpython/pull/156000","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533296","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82049","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68132","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9669","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3276","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8328","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68132.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484424","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3276","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/149079","tags":["article"]},{"url":"https://github.com/python/cpython/pull/149080","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477300","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8328","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/87451","tags":["article"]},{"url":"https://github.com/python/cpython/pull/149648","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486590","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9669","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/150599","tags":["article"]},{"url":"https://github.com/python/cpython/pull/150600","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68135","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12003","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7210","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68135.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469216","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7210","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/149018","tags":["article"]},{"url":"https://github.com/python/cpython/pull/149023","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12003","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/151544","tags":["article"]},{"url":"https://github.com/python/cpython/pull/151545","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68154","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68154.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68309","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68309.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624280-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276223","tags":["report"]},{"url":"https://bugzilla.suse.com/1276226","tags":["report"]},{"url":"https://bugzilla.suse.com/1276227","tags":["report"]},{"url":"https://bugzilla.suse.com/1277111","tags":["report"]},{"url":"https://bugzilla.suse.com/1280459","tags":["report"]},{"url":"https://bugzilla.suse.com/1283826","tags":["report"]},{"url":"https://bugzilla.suse.com/1283969","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82049","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624325-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264630-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264962","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7210","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264659-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264738-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264743-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259735","tags":["report"]},{"url":"https://bugzilla.suse.com/1259989","tags":["report"]},{"url":"https://bugzilla.suse.com/1261970","tags":["report"]},{"url":"https://bugzilla.suse.com/1262429","tags":["report"]},{"url":"https://bugzilla.suse.com/1267974","tags":["report"]},{"url":"https://bugzilla.suse.com/1273091","tags":["report"]},{"url":"https://bugzilla.suse.com/1273148","tags":["report"]},{"url":"https://bugzilla.suse.com/1274683","tags":["report"]},{"url":"https://bugzilla.suse.com/1274743","tags":["report"]},{"url":"https://bugzilla.suse.com/1276903","tags":["report"]},{"url":"https://bugzilla.suse.com/1277271","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9669","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264744-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7774","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264754-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257599","tags":["report"]},{"url":"https://bugzilla.suse.com/1262467","tags":["report"]},{"url":"https://bugzilla.suse.com/1263083","tags":["report"]},{"url":"https://bugzilla.suse.com/1263443","tags":["report"]},{"url":"https://bugzilla.suse.com/1265268","tags":["report"]},{"url":"https://bugzilla.suse.com/1266669","tags":["report"]},{"url":"https://bugzilla.suse.com/1267581","tags":["report"]},{"url":"https://bugzilla.suse.com/1267821","tags":["report"]},{"url":"https://bugzilla.suse.com/1268977","tags":["report"]},{"url":"https://bugzilla.suse.com/1269066","tags":["report"]},{"url":"https://bugzilla.suse.com/1269788","tags":["report"]},{"url":"https://bugzilla.suse.com/1269959","tags":["report"]},{"url":"https://bugzilla.suse.com/1271192","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8643","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264809-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264904-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1285433","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264941-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264946-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-82049","tags":["report"]},{"url":"https://github.com/python/cpython/pull/157262","tags":["report"]},{"url":"https://github.com/python/cpython/pull/157261","tags":["report"]},{"url":"https://github.com/python/cpython/pull/157192","tags":["report"]},{"url":"https://github.com/python/cpython/pull/157454","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-82049","title":"tarfile extraction filters allow file modification and content disclosure via hard link to symlink","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-14T19:14:03.873Z","modified":"2026-10-11T00:39:42.376Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T13:40:46.161838Z"}],"euvd":[{"id":"EUVD-2026-77772","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-14T19:14:03Z","modified":"2026-10-11T00:39:42Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:23.685286Z"}],"ghsa":[{"id":"GHSA-ghff-gcpf-9r9p","title":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable...","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-14T21:31:42Z","modified":"2026-10-11T03:31:25Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:13:03.923045Z"}],"nvd":[{"id":"CVE-2026-82049","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-14T19:17:50.927Z","modified":"2026-10-11T01:16:25.82Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:12:46.980627Z"}],"osv":[{"id":"ALPINE-CVE-2026-82049","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-14T19:17:50.927Z","modified":"2026-10-01T15:30:03.577614478Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"CVE-2026-82049","title":"tarfile extraction filters allow file modification and content disclosure via hard link to symlink","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-14T19:14:03.873Z","modified":"2026-11-10T13:11:22.275591742Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"DEBIAN-CVE-2026-82049","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-14T19:17:50.927Z","modified":"2026-11-01T17:00:15.841579506Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"OESA-2026-4009","title":"python3 security update","description":"Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.\r\n\r\nSecurity Fix(es):\n\nThe HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.(CVE-2026-15806)\n\nThe \u0026quot;stringprep\u0026quot; module didn\u0026apos;t process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the \u0026quot;idna\u0026quot; codec) and the in_table_b2() function of the \u0026quot;stringprep\u0026quot; module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.(CVE-2026-17084)\n\nAttacker-controlled CSV samples can trigger super-linear \nregular-expression work during dialect sniffing and consume significant \nCPU when applications pass unbounded input to csv.Sniffer.sniff().(CVE-2026-18503)\n\nThe tarfile module\u0026apos;s tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member\u0026apos;s name must contain the destination directory\u0026apos;s own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.(CVE-2026-19672)\n\nIn CPython 3.13 and earlier, the tarfile module\u0026apos;s data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.(CVE-2026-82049)\n\nWhen tarfile extracts a link on a system that doesn\u0026apos;t support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.(CVE-2026-87910)","status":"published","published":"2026-09-25T01:27:10Z","modified":"2026-09-25T01:45:06.997808271Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4010","title":"python3 security update","description":"Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.\r\n\r\nSecurity Fix(es):\n\nThe HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.(CVE-2026-15806)\n\nThe \u0026quot;stringprep\u0026quot; module didn\u0026apos;t process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the \u0026quot;idna\u0026quot; codec) and the in_table_b2() function of the \u0026quot;stringprep\u0026quot; module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.(CVE-2026-17084)\n\nAttacker-controlled CSV samples can trigger super-linear \nregular-expression work during dialect sniffing and consume significant \nCPU when applications pass unbounded input to csv.Sniffer.sniff().(CVE-2026-18503)\n\nThe tarfile module\u0026apos;s tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member\u0026apos;s name must contain the destination directory\u0026apos;s own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.(CVE-2026-19672)\n\nIn CPython 3.13 and earlier, the tarfile module\u0026apos;s data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.(CVE-2026-82049)\n\nWhen tarfile extracts a link on a system that doesn\u0026apos;t support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.(CVE-2026-87910)","status":"published","published":"2026-09-25T01:27:11Z","modified":"2026-09-25T01:45:06.501964484Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4011","title":"python3 security update","description":"Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.\r\n\r\nSecurity Fix(es):\n\nThe HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.(CVE-2026-15806)\n\nThe \u0026quot;stringprep\u0026quot; module didn\u0026apos;t process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the \u0026quot;idna\u0026quot; codec) and the in_table_b2() function of the \u0026quot;stringprep\u0026quot; module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.(CVE-2026-17084)\n\nAttacker-controlled CSV samples can trigger super-linear \nregular-expression work during dialect sniffing and consume significant \nCPU when applications pass unbounded input to csv.Sniffer.sniff().(CVE-2026-18503)\n\nThe tarfile module\u0026apos;s tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member\u0026apos;s name must contain the destination directory\u0026apos;s own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.(CVE-2026-19672)\n\nIn CPython 3.13 and earlier, the tarfile module\u0026apos;s data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.(CVE-2026-82049)\n\nWhen tarfile extracts a link on a system that doesn\u0026apos;t support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.(CVE-2026-87910)","status":"published","published":"2026-09-25T01:27:12Z","modified":"2026-09-25T01:45:06.504077825Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4012","title":"python3 security update","description":"Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.\r\n\r\nSecurity Fix(es):\n\nThe HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.(CVE-2026-15806)\n\nThe \u0026quot;stringprep\u0026quot; module didn\u0026apos;t process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the \u0026quot;idna\u0026quot; codec) and the in_table_b2() function of the \u0026quot;stringprep\u0026quot; module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.(CVE-2026-17084)\n\nAttacker-controlled CSV samples can trigger super-linear \nregular-expression work during dialect sniffing and consume significant \nCPU when applications pass unbounded input to csv.Sniffer.sniff().(CVE-2026-18503)\n\nThe tarfile module\u0026apos;s tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member\u0026apos;s name must contain the destination directory\u0026apos;s own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.(CVE-2026-19672)\n\nIn CPython 3.13 and earlier, the tarfile module\u0026apos;s data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.(CVE-2026-82049)\n\nWhen tarfile extracts a link on a system that doesn\u0026apos;t support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.(CVE-2026-87910)","status":"published","published":"2026-09-25T01:27:12Z","modified":"2026-09-25T01:45:07.297132777Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:65505","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-09T10:20:31Z","modified":"2026-10-17T10:42:51.594643905Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:68132","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:02Z","modified":"2026-10-17T10:18:27Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68135","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:03Z","modified":"2026-10-17T10:18:28Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68154","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:04Z","modified":"2026-10-17T10:18:28Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68309","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:11Z","modified":"2026-10-17T10:18:31Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"UBUNTU-CVE-2026-82049","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-14T19:17:00Z","modified":"2026-10-17T13:01:11.26814093Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"AZL-101784","title":"CVE-2026-82049 affecting package python3 for versions less than 3.12.15-1","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-14T19:17:50Z","modified":"2026-11-02T14:15:35.279588581Z","updated_at":"2026-11-02T15:28:00.508704Z"},{"id":"AZL-101832","title":"CVE-2026-82049 affecting package tensorflow 2.16.1-11","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-14T19:17:50Z","modified":"2026-09-21T05:34:22Z","updated_at":"2026-11-02T15:28:00.508704Z"},{"id":"BELL-CVE-2026-82049","status":"published","published":"2026-09-18T06:05:44.450407Z","modified":"2026-10-03T07:15:02.278990724Z","updated_at":"2026-11-02T15:28:26.341144Z"},{"id":"BIT-libpython-2026-82049","title":"tarfile extraction filters allow file modification and content disclosure via hard link to symlink","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-21T09:00:11.991Z","modified":"2026-10-13T08:15:04.066688928Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-python-2026-82049","title":"tarfile extraction filters allow file modification and content disclosure via hard link to symlink","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-21T09:07:26.646Z","modified":"2026-10-13T08:15:03.072810453Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"BIT-python-min-2026-82049","title":"tarfile extraction filters allow file modification and content disclosure via hard link to symlink","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-21T09:07:26.945Z","modified":"2026-10-13T08:15:04.020826477Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"CLSA-2026-1789662396","title":"python3.9: Fix of CVE-2026-82049","description":"- CVE-2026-82049: fix tarfile data/tar filter bypass where a hard link to a\n  symlink was extracted as a copy of the symlink at a shallower path, letting\n  its relative target escape the destination directory; makelink_with_filter()\n  now resolves the link target with os.path.realpath() before os.link()\n  (upstream gh-157190, commit b8f23e30)","status":"published","published":"2026-09-17T16:26:47Z","modified":"2026-10-26T09:30:47.403494262Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1789719542","title":"python3: Fix of CVE-2026-82049","description":"- CVE-2026-82049: resolve a hard link's target with os.path.realpath() in\n  makelink_with_filter() so extracting a hard link to a symlink cannot\n  recreate that symlink at a shallower path and reach files outside the\n  destination directory","status":"published","published":"2026-09-18T08:19:14Z","modified":"2026-10-26T09:30:54.90951282Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1789719876","title":"python3: Fix of CVE-2026-82049","description":"- CVE-2026-82049: resolve a hard link's target with os.path.realpath() in\n  tarfile.TarFile.makelink_with_filter() before calling os.link(), so a hard\n  link to an archived symlink is extracted as a copy of the file instead of a\n  duplicate symlink whose relative target escapes the destination directory","status":"published","published":"2026-09-18T08:24:49Z","modified":"2026-10-26T09:31:51.519934783Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1789736914","title":"python3: Fix of 5 CVEs","description":"- CVE-2026-82049: tarfile: resolve a hard link's target before recreating it so\n  a link to a symlink stored deeper in the archive can no longer be duplicated\n  at a shallower path, where its relative target escapes the destination","status":"published","published":"2026-09-18T13:08:48Z","modified":"2026-10-26T09:31:43.814029997Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1789749056","title":"python3.9: Fix of CVE-2026-82049","description":"- CVE-2026-82049: resolve the hard-link target with os.path.realpath() in\n  tarfile's makelink_with_filter(), so a crafted archive can no longer duplicate\n  a previously extracted symlink at a shallower path and expose files outside\n  the destination directory","status":"published","published":"2026-09-18T16:31:07Z","modified":"2026-10-26T09:30:49.013769011Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790238098","title":"python3.11: Fix of 5 CVEs","description":"- CVE-2026-3276: sort each combining-character run in unicodedata.normalize() with a\n  counting sort once the run exceeds a length threshold, instead of the quadratic\n  insertion sort, so crafted input with long runs of alternating canonical combining\n  classes can no longer burn CPU\n- CVE-2026-8328: apply the CVE-2021-4189 PASV fix to ftplib.ftpcp() as well, taking the\n  data connection address from the source socket's peer instead of the host the server\n  advertises, unless trust_server_pasv_ipv4_address opts back in\n- CVE-2026-15806: scope urllib.request HTTPPasswordMgr credentials by URL scheme, so\n  credentials registered for an https:// URL are no longer sent over http://; a bare\n  authority still matches any scheme, keeping proxy authentication working\n- CVE-2026-7774: validate the written link target in tarfile's data filter, rejecting a\n  link member that resolves to the destination directory itself and resolving symlink\n  targets against the stripped member name, so crafted link entries can no longer\n  redirect later members outside the destination\n- CVE-2026-82049: resolve the hard-link source with os.path.realpath() in tarfile's\n  makelink_with_filter, so an archive holding a hard link to a symlink can no longer\n  duplicate that symlink to a shallower path whose relative target escapes the\n  destination","status":"published","published":"2026-09-24T08:21:53Z","modified":"2026-10-26T09:43:20.584878624Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1791485785","title":"python: Fix of 3 CVEs","description":"- CVE-2026-82049: resolve a hard link's target with os.path.realpath() before\n  creating the link, so extracting a hard link to a symlink stored deeper in\n  the archive cannot relocate that symlink to a shallower path where its\n  relative target escapes the destination directory\n- CVE-2026-11940: re-filter the fallback member when hard link extraction\n  falls back to extracting from the archive, and filter it under the link's\n  own name, so a hard link to a deeper symlink cannot recreate that symlink\n  at a shallower path outside the destination. Carries the CVE-2025-4330\n  fallback-filtering prerequisite (LinkFallbackError and\n  makelink_with_filter), which this package did not have\n- CVE-2025-4435: skip a member the extraction filter rejects instead of\n  extracting it unfiltered when TarFile.errorlevel is 0","status":"published","published":"2026-10-19T14:24:19Z","modified":"2026-10-26T09:43:49.771534941Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791486047","title":"python: Fix of 3 CVEs","description":"- CVE-2026-82049: resolve a hard link's target with os.path.realpath() before\n  creating the link, so extracting a hard link to a symlink stored deeper in\n  the archive cannot relocate that symlink to a shallower path where its\n  relative target escapes the destination directory\n- CVE-2026-11940: re-filter the fallback member when hard link extraction\n  falls back to extracting from the archive, and filter it under the link's\n  own name, so a hard link to a deeper symlink cannot recreate that symlink\n  at a shallower path outside the destination. Carries the CVE-2025-4330\n  fallback-filtering prerequisite (LinkFallbackError and\n  makelink_with_filter), which this package did not have\n- CVE-2025-4435: skip a member the extraction filter rejects instead of\n  extracting it unfiltered when TarFile.errorlevel is 0","status":"published","published":"2026-10-19T14:27:10Z","modified":"2026-10-26T09:43:16.409299441Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791486224","title":"python: Fix of 3 CVEs","description":"- CVE-2026-82049: resolve a hard link's target with os.path.realpath() before\n  creating the link, so extracting a hard link to a symlink stored deeper in\n  the archive cannot relocate that symlink to a shallower path where its\n  relative target escapes the destination directory\n- CVE-2026-11940: re-filter the fallback member when hard link extraction\n  falls back to extracting from the archive, and filter it under the link's\n  own name, so a hard link to a deeper symlink cannot recreate that symlink\n  at a shallower path outside the destination. Carries the CVE-2025-4330\n  fallback-filtering prerequisite (LinkFallbackError and\n  makelink_with_filter), which this package did not have\n- CVE-2025-4435: skip a member the extraction filter rejects instead of\n  extracting it unfiltered when TarFile.errorlevel is 0","status":"published","published":"2026-10-19T14:29:35Z","modified":"2026-10-26T09:43:42.791353186Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791896121","title":"python3: Fix of 2 CVEs","description":"- CVE-2026-11940: pass filter_function through TarFile.extract() so the hardlink-extraction fallback is filtered (prerequisite)\n- CVE-2026-11940: filter the symlink at the hardlink's own path so a hardlink to a deeper symlink cannot recreate it at a shallower path and escape the destination directory\n- CVE-2026-82049: resolve a hardlink's target with os.path.realpath() so extracting a hard link to a symlink cannot relocate that symlink and expose or modify files outside the destination","status":"published","published":"2026-10-17T13:02:45Z","modified":"2026-10-26T09:31:43.802607207Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791897081","title":"python3: Fix of 4 CVEs","description":"- CVE-2026-11940: pass filter_function through TarFile.extract() so the hardlink-extraction fallback is filtered (prerequisite)\n- CVE-2026-11940: filter the symlink at the hardlink's own path so a hardlink to a deeper symlink cannot recreate it at a shallower path and escape the destination directory\n- CVE-2026-82049: resolve a hardlink's target with os.path.realpath() so extracting a hard link to a symlink cannot relocate that symlink and expose or modify files outside the destination","status":"published","published":"2026-10-20T07:34:59Z","modified":"2026-10-26T09:31:46.697249897Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791897945","title":"python3: Fix of 4 CVEs","description":"- CVE-2026-11940: pass filter_function through TarFile.extract() so the hardlink-extraction fallback is filtered (prerequisite)\n- CVE-2026-11940: filter the symlink at the hardlink's own path so a hardlink to a deeper symlink cannot recreate it at a shallower path and escape the destination directory\n- CVE-2026-82049: resolve a hardlink's target with os.path.realpath() so extracting a hard link to a symlink cannot relocate that symlink and expose or modify files outside the destination","status":"published","published":"2026-10-19T17:46:20Z","modified":"2026-10-26T09:31:57.115323159Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792411096","title":"python3.11: Fix of 2 CVEs","description":"- CVE-2026-82049: tarfile: resolve hard link targets through symlinks before\n  os.link(), so a crafted hardlink can no longer be relocated to a directory\n  where its relative target escapes the destination","status":"published","published":"2026-10-20T16:55:00Z","modified":"2026-10-26T09:31:20.360650361Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"openSUSE-SU-2026:12069-1","title":"python315-3.15.0~rc3-1.1 on GA media","description":"These are all security issues fixed in the python315-3.15.0~rc3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-07T17:23:11.423763485Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12087-1","title":"python310-3.10.22-1.1 on GA media","description":"These are all security issues fixed in the python310-3.10.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-09T17:23:13.920892638Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12121-1","title":"python311-3.11.17-1.1 on GA media","description":"These are all security issues fixed in the python311-3.11.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-14T17:23:09.315397456Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12122-1","title":"python312-3.12.15-1.1 on GA media","description":"These are all security issues fixed in the python312-3.12.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-14T17:23:09.348428363Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12123-1","title":"python313-3.13.16-1.1 on GA media","description":"These are all security issues fixed in the python313-3.13.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-14T17:23:09.37808127Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"PSF-0000-CVE-2026-82049","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-14T19:14:03.873Z","modified":"2026-09-21T09:40:40.089756709Z","updated_at":"2026-11-02T15:52:50.263679Z"},{"id":"PSF-2026-41","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","status":"published","published":"2026-09-14T19:14:03.873Z","modified":"2026-10-12T19:00:50.818381314Z","updated_at":"2026-11-02T15:52:50.667197Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-82049","title":"CVE-2026-82049 in python3.13 - Patched by Root","description":"Root has patched CVE-2026-82049 in the python3.13 package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-10-09T12:06:34Z","modified":"2026-10-09T13:15:03.022346726Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:24280-1","title":"Security update for python311","description":"This update for python311 fixes the following issues:\n\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free\n  (bsc#1283969).\n- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses\n  (bsc#1283826).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python311:\n\n- Update to 3.11.17:\n - Security\n - gh-158446: Fix a crash or incorrect output that could occur\n when formatting a float or complex with a precision close\n to the platform's INT_MAX. PyOS_double_to_string() now\n raises ValueError for any precision of that magnitude,\n regardless of presentation type or value, as the format\n string parsers already did for precisions above INT_MAX.\n - gh-157190: Fixed a vulnerability in the tarfile data and\n tar extraction filters where a crafted archive using a hard\n link to a symbolic link could change the permissions and\n modification time of a file outside the destination\n directory, and expose its contents inside the extracted\n tree. This addresses CVE 2026-82049. (bsc#1280459,\n CVE-2026-82049)\n - gh-156793: asyncio: loop.start_tls() and\n loop.create_connection() now validate the server_hostname\n argument if an ssl.SSLContext is passed with check_hostname\n set to True, emitting DeprecationWarning if server_hostname\n is missing. (This will raise ValueError in Python 3.13 and\n later.) (bsc#1283826, CVE-2026-19553)\n - gh-156793: ssl.SSLContext.wrap_bio() now validates its\n server_side, server_hostname and session arguments similar\n to ssl.SSLContext.wrap_socket(), but for backward\n compatiblity reasons emits DeprecationWarning instead of\n ValueError.\n In particular, a context with check_hostname enabled and no\n server_hostname passed to wrap_bio() now emits\n DeprecationWarning to indicate the hostname wasn't\n checked. (In Python 3.13 and later, this raises\n ValueError.)\n - gh-157265: In tarfile, when extracting a link falls back to\n extracting a member of the archive, skip the member when\n the filter function returns None when called with the\n extracted member's name replaced with the link's.\n - gh-157953: Update bundled libexpat to version 2.8.5.\n - gh-156002: Bound the amount of data zipfile decompresses\n per read for members compressed with bzip2, LZMA, or\n Zstandard, matching the existing limit for deflate. A small\n archive member could previously expand into an unbounded\n allocation even when read in small chunks. (bsc#1277111,\n CVE-2026-15310)\n - gh-155999: Fix the tarfile tar and data extraction filters\n creating directories outside the destination for members\n whose name leaves the destination and returns to it, such\n as ../evil/../dest/sub/file. The containment check used the\n resolved path, but intermediate directories were created\n from the name as given. (bsc#1276227, CVE-2026-19672)\n - gh-156293: Fix a crash in ssl when an sni_callback switches\n a connection to another SSLContext and the context that\n carries the callback is no longer referenced by the\n application. Servers that keep their sni_callback context\n alive (the usual case when it wraps the listening socket or\n is stored on the server object) were not affected. This\n addresses CVE-2026-19445. (bsc#1283969, CVE-2026-19445)\n - gh-155292: Change the stringprep module and encodings.idna\n codec to not consider Unicode codepoint attributes beyond\n those defined in RFC 3454. (bsc#1276226, CVE-2026-17084)\n - gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr\n credentials to the URL scheme, preventing credentials\n stored for an HTTPS URL from being used for a matching HTTP\n URL, while URIs without a scheme continue to match any\n scheme. (bsc#1276223, CVE-2026-15806)\n - Library\n - gh-156002: zipfile again reads members through a\n third-party decompressor installed by monkey-patching the\n private _get_decompressor() to return an object that only\n implements old BZ2Decompressor API from Python 3.3. Note\n that decompressors without needs_input and two-argument\n decompress() are vulnerable to CVE 2026-15310.\n - gh-156353: Fix configparser parsing when using whitespace\n in delimiters.\n - Build\n - gh-155757: Set the --argv0 argument to wasmtime for WASI\n builds so the test suite passes. Otherwise the calculated\n paths to the stdlib for frozen modules is incorrect.\n- CVE-2026-15310: bound zipfile decompression for\n bzip2/LZMA (bsc#1277111, gh#python/cpython#156002)\n- CVE-2026-19672: in tarfile, handle a member that leaves the\n destination and comes back (bsc#1276227, gh#python/cpython#156000)\n","status":"published","published":"2026-10-19T10:15:52Z","modified":"2026-10-27T17:23:10.505232038Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24325-1","title":"Security update for python311","description":"This update for python311 fixes the following issues:\n\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free\n  (bsc#1283969).\n- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses\n  (bsc#1283826).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python311:\n\n- Update to 3.11.17:\n - Security\n - gh-158446: Fix a crash or incorrect output that could occur\n when formatting a float or complex with a precision close\n to the platform's INT_MAX. PyOS_double_to_string() now\n raises ValueError for any precision of that magnitude,\n regardless of presentation type or value, as the format\n string parsers already did for precisions above INT_MAX.\n - gh-157190: Fixed a vulnerability in the tarfile data and\n tar extraction filters where a crafted archive using a hard\n link to a symbolic link could change the permissions and\n modification time of a file outside the destination\n directory, and expose its contents inside the extracted\n tree. This addresses CVE 2026-82049. (bsc#1280459,\n CVE-2026-82049)\n - gh-156793: asyncio: loop.start_tls() and\n loop.create_connection() now validate the server_hostname\n argument if an ssl.SSLContext is passed with check_hostname\n set to True, emitting DeprecationWarning if server_hostname\n is missing. (This will raise ValueError in Python 3.13 and\n later.) (bsc#1283826, CVE-2026-19553)\n - gh-156793: ssl.SSLContext.wrap_bio() now validates its\n server_side, server_hostname and session arguments similar\n to ssl.SSLContext.wrap_socket(), but for backward\n compatiblity reasons emits DeprecationWarning instead of\n ValueError.\n In particular, a context with check_hostname enabled and no\n server_hostname passed to wrap_bio() now emits\n DeprecationWarning to indicate the hostname wasn't\n checked. (In Python 3.13 and later, this raises\n ValueError.)\n - gh-157265: In tarfile, when extracting a link falls back to\n extracting a member of the archive, skip the member when\n the filter function returns None when called with the\n extracted member's name replaced with the link's.\n - gh-157953: Update bundled libexpat to version 2.8.5.\n - gh-156002: Bound the amount of data zipfile decompresses\n per read for members compressed with bzip2, LZMA, or\n Zstandard, matching the existing limit for deflate. A small\n archive member could previously expand into an unbounded\n allocation even when read in small chunks. (bsc#1277111,\n CVE-2026-15310)\n - gh-155999: Fix the tarfile tar and data extraction filters\n creating directories outside the destination for members\n whose name leaves the destination and returns to it, such\n as ../evil/../dest/sub/file. The containment check used the\n resolved path, but intermediate directories were created\n from the name as given. (bsc#1276227, CVE-2026-19672)\n - gh-156293: Fix a crash in ssl when an sni_callback switches\n a connection to another SSLContext and the context that\n carries the callback is no longer referenced by the\n application. Servers that keep their sni_callback context\n alive (the usual case when it wraps the listening socket or\n is stored on the server object) were not affected. This\n addresses CVE-2026-19445. (bsc#1283969, CVE-2026-19445)\n - gh-155292: Change the stringprep module and encodings.idna\n codec to not consider Unicode codepoint attributes beyond\n those defined in RFC 3454. (bsc#1276226, CVE-2026-17084)\n - gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr\n credentials to the URL scheme, preventing credentials\n stored for an HTTPS URL from being used for a matching HTTP\n URL, while URIs without a scheme continue to match any\n scheme. (bsc#1276223, CVE-2026-15806)\n - Library\n - gh-156002: zipfile again reads members through a\n third-party decompressor installed by monkey-patching the\n private _get_decompressor() to return an object that only\n implements old BZ2Decompressor API from Python 3.3. Note\n that decompressors without needs_input and two-argument\n decompress() are vulnerable to CVE 2026-15310.\n - gh-156353: Fix configparser parsing when using whitespace\n in delimiters.\n - Build\n - gh-155757: Set the --argv0 argument to wasmtime for WASI\n builds so the test suite passes. Otherwise the calculated\n paths to the stdlib for frozen modules is incorrect.\n","status":"published","published":"2026-10-19T08:33:46Z","modified":"2026-10-27T17:23:13.818442651Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4630-1","title":"Security update for python310","description":"This update for python310 fixes the following issues:\n\n- CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding\n  protection (bsc#1264962).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free\n  (bsc#1283969).\n- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses\n  (bsc#1283826).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python310:\n\n- Update to 3.10.22 (final release, upstream EOS)\n - Security\n - gh-158446: Fix a crash or incorrect output that could occur\n when formatting a float or complex with a precision close\n to the platform's INT_MAX. PyOS_double_to_string() now\n raises ValueError for any precision of that magnitude,\n regardless of presentation type or value, as the format\n string parsers already did for precisions above INT_MAX.\n - gh-156793: asyncio: loop.start_tls() and\n loop.create_connection() now validate the server_hostname\n argument if an ssl.SSLContext is passed with check_hostname\n set to True, emitting DeprecationWarning if server_hostname\n is missing. (This will raise ValueError in Python 3.13 and\n later.) (bsc#1283826, CVE-2026-19553)\n - gh-156793: ssl.SSLContext.wrap_bio() now validates its\n server_side, server_hostname and session arguments similar\n to ssl.SSLContext.wrap_socket(), but for backward\n compatiblity reasons emits DeprecationWarning instead of\n ValueError.\n In particular, a context with check_hostname enabled and no\n server_hostname passed to wrap_bio() now emits\n DeprecationWarning to indicate the hostname wasn't\n checked. (In Python 3.13 and later, this raises\n ValueError.)\n - gh-157265: In tarfile, when extracting a link falls back to\n extracting a member of the archive, skip the member when\n the filter function returns None when called with the\n extracted member's name replaced with the link's.\n - gh-157190: Fixed a vulnerability in the tarfile data and\n tar extraction filters where a crafted archive using a hard\n link to a symbolic link could change the permissions and\n modification time of a file outside the destination\n directory, and expose its contents inside the extracted\n tree. This addresses CVE 2026-82049.(bsc#1280459,\n CVE-2026-82049)\n - gh-157953: Update bundled libexpat to version 2.8.5.\n - gh-156002: Bound the amount of data zipfile decompresses\n per read for members compressed with bzip2, LZMA, or\n Zstandard, matching the existing limit for deflate. A small\n archive member could previously expand into an unbounded\n allocation even when read in small chunks. (bsc#1277111,\n CVE-2026-15310)\n - gh-155999: Fix the tarfile tar and data extraction filters\n creating directories outside the destination for members\n whose name leaves the destination and returns to it, such\n as ../evil/../dest/sub/file. The containment check used the\n resolved path, but intermediate directories were created\n from the name as given. (bsc#1276227, CVE-2026-19672)\n - gh-156293: Fix a crash in ssl when an sni_callback switches\n a connection to another SSLContext and the context that\n carries the callback is no longer referenced by the\n application. Servers that keep their sni_callback context\n alive (the usual case when it wraps the listening socket or\n is stored on the server object) were not affected. This\n addresses CVE-2026-19445. (bsc#1283969, CVE-2026-19445)\n - gh-155292: Change the stringprep module and encodings.idna\n codec to not consider Unicode codepoint attributes beyond\n those defined in RFC 3454. (bsc#1276226, CVE-2026-17084)\n - gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr\n credentials to the URL scheme, preventing credentials\n stored for an HTTPS URL from being used for a matching HTTP\n URL, while URIs without a scheme continue to match any\n scheme. (bsc#1276223, CVE-2026-15806)\n - gh-149018: Improved protection against XML hash-flooding\n attacks in xml.parsers.expat and xml.etree.ElementTree when\n Python is compiled with libExpat 2.8.0 or later.\n (bsc#1264962, CVE-2026-7210)\n - Library\n - gh-156002: zipfile again reads members through a\n third-party decompressor installed by monkey-patching the\n private _get_decompressor() to return an object that only\n implements old BZ2Decompressor API from Python 3.3. Note\n that decompressors without needs_input and two-argument\n decompress() are vulnerable to CVE 2026-15310.\n - gh-156353: Fix configparser parsing when using whitespace\n in delimiters.\n","status":"published","published":"2026-10-12T15:25:09Z","modified":"2026-10-13T10:30:06.861807744Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4659-1","title":"Security update for python312","description":"This update for python312 fixes the following issues:\n\n- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free\n  (bsc#1283969).\n- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses\n  (bsc#1283826).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python312:\n\n- Update to 3.12.15\n","status":"published","published":"2026-10-14T10:07:29Z","modified":"2026-10-14T17:30:07.606885722Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4738-1","title":"Security update for python","description":"This update for python fixes the following issue:\n\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n","status":"published","published":"2026-10-19T12:58:13Z","modified":"2026-10-20T10:45:04.184948863Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4743-1","title":"Security update for python36","description":"This update for python36 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously\n  crafted wheel archives (bsc#1274743).\n- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).\n- CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).\n- CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).\n- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).\n- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high\n  CPU usage (bsc#1273148).\n- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).\n- CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect\n  sniffing and consume significant CPU (bsc#1274683).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nNon security issue fixed:\n\n- Update bundled setuptools wheels to\n setuptools-44.1.1-py2.py3-none-any.whl (bsc#1277271)\n","status":"published","published":"2026-10-19T15:00:47Z","modified":"2026-10-20T10:45:04.35999946Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4744-1","title":"Security update for python3, python3-base, python3-doc","description":"This update for python3, python3-base, python3-doc fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high\n  CPU usage (bsc#1273148).\n- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect\n  sniffing and consume significant CPU (bsc#1274683).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python3:\n\n- Update bundled setuptools wheels to setuptools-40.6.2 (bsc#1276903).\n","status":"published","published":"2026-10-19T15:01:31Z","modified":"2026-10-20T10:45:04.356081161Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4754-1","title":"Security update for python3","description":"This update for python3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the\n  `configparser` module is used (bsc#1269066).\n- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously\n  crafted wheel archives (bsc#1257599 bsc#1274743).\n- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429 bsc#1262467).\n- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted\n  Unicode input (bsc#1267581).\n- CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).\n- CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).\n- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).\n- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting\n  hardlinks (bsc#1269959).\n- CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442\n  bsc#1263443).\n- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high\n  CPU usage (bsc#1273148).\n- CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding\n  protection (bsc#1264962).\n- CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction directory\n  (bsc#1267821).\n- CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).\n- CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite\n  (bsc#1266669).\n- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).\n- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and\n  enables arbitrary file reads and writes (bsc#1268977).\n- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS\n  (bsc#1269788).\n- CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).\n- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations\n  (bsc#1271192).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect\n  sniffing and consume significant CPU (bsc#1274683).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nNon security issue fixed:\n\n- Fix an error that returned non-zero exit status 1 (bsc#1277271).\n- Fix regression in `http.cookies` (bsc#1263083).  \n- Update bundled pip wheels to pip-20.0.2-py2.py3-none-any.whl.\n","status":"published","published":"2026-10-20T10:52:18Z","modified":"2026-10-21T13:00:04.220561742Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4809-1","title":"Security update for python311","description":"This update for python311 fixes the following issues:\n\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free\n  (bsc#1283969).\n- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses\n  (bsc#1283826).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python311:\n\n- Update to 3.11.17:\n - Library\n - gh-156002: zipfile again reads members through a\n third-party decompressor installed by monkey-patching the\n private _get_decompressor() to return an object that only\n implements old BZ2Decompressor API from Python 3.3. Note\n that decompressors without needs_input and two-argument\n decompress() are vulnerable to CVE 2026-15310.\n - gh-156353: Fix configparser parsing when using whitespace\n in delimiters.\n - Build\n - gh-155757: Set the --argv0 argument to wasmtime for WASI\n builds so the test suite passes. Otherwise the calculated\n paths to the stdlib for frozen modules is incorrect.\n","status":"published","published":"2026-10-21T08:04:20Z","modified":"2026-10-21T20:02:16.071878701Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4904-1","title":"Security update for python, python-base, python-doc","description":"This update for python, python-base, python-doc fixes the following issue:\n\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n","status":"published","published":"2026-10-26T07:20:15Z","modified":"2026-10-26T20:15:05.607498578Z","updated_at":"2026-11-02T15:54:05.838224Z"}]},"sources_more":{"osv":2}}