{"id":"CLSA-2026-1777946894","summary":"Fix CVE(s): CVE-2022-0391, CVE-2022-45061, CVE-2024-7592, CVE-2026-4519","details":"   * SECURITY UPDATE: URL parsing accepts ASCII tab/CR/LF (URL smuggling)\n     - debian/patches/CVE-2022-0391.patch: sanitise tab, CR, LF anywhere in\n       URL/scheme inside urlsplit() before cache lookup, plus regression\n       test in Lib/urlparse.py, Lib/test/test_urlparse.py.\n     - CVE-2022-0391\n   * SECURITY UPDATE: Quadratic complexity in IDNA decoding (DoS)\n     - debian/patches/CVE-2022-45061.patch: replace O(n) outer loop with a\n       single any() guard in nameprep(), plus regression test in\n       Lib/encodings/idna.py, Lib/test/test_codecs.py.\n     - CVE-2022-45061\n   * SECURITY UPDATE: ReDoS in Cookie._unquote (quadratic backslash parsing)\n     - debian/patches/CVE-2024-7592.patch: replace the quadratic _OctalPatt\n       / _QuotePatt loop with a single linear re.sub-based decoder, plus\n       regression tests in Lib/Cookie.py, Lib/test/test_cookie.py.\n     - CVE-2024-7592\n   * SECURITY UPDATE: webbrowser.open() argument injection via leading dash\n     - debian/patches/CVE-2026-4519.patch: add BaseBrowser._check_url() and\n       call it from every browser open() to reject URLs whose first\n       non-whitespace char is '-', plus regression test in Lib/webbrowser.py,\n       Lib/test/test_webbrowser.py.  Also backports upstream gh-148169\n       (commit d22922c8a7) to close the %action-substitution bypass: the\n       check is deferred until after %action substitution and the per-arg\n       replace() chain is reordered (%action before %s) so an attacker\n       cannot smuggle a leading dash via the URL.\n     - CVE-2026-4519\n   * BUILD: replace libdb-dev (\u003c\u003c 1:6.0) with libdb5.3-dev in\n     debian/control{,.in} so the build pulls the explicit Berkeley DB 5.3\n     development headers available on Ubuntu 20.04 ESM, instead of the\n     virtual libdb-dev package that is no longer satisfied in the ELS\n     build environment.","modified":"2026-06-04T09:47:36.248217889Z","published":"2026-05-05T02:08:23Z","upstream":["CVE-2022-0391","CVE-2022-45061","CVE-2024-7592","CVE-2026-4519"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1777946894.html"}],"affected":[{"package":{"name":"idle-python2.7","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/idle-python2.7?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.7+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777946894.json"}},{"package":{"name":"libpython2.7","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpython2.7?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.7+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777946894.json"}},{"package":{"name":"libpython2.7-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpython2.7-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.7+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777946894.json"}},{"package":{"name":"libpython2.7-minimal","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpython2.7-minimal?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.7+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777946894.json"}},{"package":{"name":"libpython2.7-stdlib","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpython2.7-stdlib?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.7+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777946894.json"}},{"package":{"name":"libpython2.7-testsuite","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpython2.7-testsuite?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.7+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777946894.json"}},{"package":{"name":"python2.7","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/python2.7?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.7+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777946894.json"}},{"package":{"name":"python2.7-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/python2.7-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.7+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777946894.json"}},{"package":{"name":"python2.7-doc","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/python2.7-doc?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.7+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777946894.json"}},{"package":{"name":"python2.7-examples","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/python2.7-examples?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.7+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777946894.json"}},{"package":{"name":"python2.7-minimal","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/python2.7-minimal?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.7+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777946894.json"}}],"schema_version":"1.7.5"}