{"id":"CLSA-2026-1772631219","summary":"python3: Fix of 5 CVEs","details":"- CVE-2024-12718: extractall: re-apply the filter at directory-attribute\n  fixup, skip fixup if the entry is no longer a directory\n- CVE-2025-4138: data_filter: strip .. components from symlink targets in\n  data_filter to prevent traversal via symlinks in the link target\n- CVE-2025-4330: re-apply filter when a hard/symlink extraction falls back\n  to copying another archive member\n- CVE-2025-4435: extract/extractall: don't extract rejected members when\n  errorlevel=0\n- CVE-2025-4517: raise exceptions on OS errors in realpath to prevent\n  overly-long symlink chains from evading destination bounds checking","modified":"2026-05-27T11:18:18.175190162Z","published":"2026-03-04T13:33:44Z","upstream":["CVE-2024-12718","CVE-2025-4138","CVE-2025-4330","CVE-2025-4435","CVE-2025-4517"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1772631219.html"}],"affected":[{"package":{"name":"platform-python","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/platform-python?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1772631219.json"}},{"package":{"name":"platform-python-debug","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/platform-python-debug?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1772631219.json"}},{"package":{"name":"platform-python-devel","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/platform-python-devel?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1772631219.json"}},{"package":{"name":"python3-devel","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/python3-devel?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1772631219.json"}},{"package":{"name":"python3-idle","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/python3-idle?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1772631219.json"}},{"package":{"name":"python3-libs","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/python3-libs?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1772631219.json"}},{"package":{"name":"python3-test","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/python3-test?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1772631219.json"}},{"package":{"name":"python3-tkinter","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/python3-tkinter?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-62.el8.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1772631219.json"}}],"schema_version":"1.7.5"}