{"id":"CLSA-2026-1778979189","summary":"Fix CVE(s): CVE-2024-6232, CVE-2024-7592, CVE-2024-9287","details":"   * SECURITY UPDATE: ReDoS in tarfile PAX header parsing\n     - debian/patches/CVE-2024-6232.patch: rewrite Lib/tarfile.py PAX-record parser to scan length-prefixed records via a bounded regex (_header_length_prefix_re) plus direct slicing, eliminating quadratic backtracking in three pre-existing regexes. Adapted from upstream commit 7d1f50cd (3.8 backport); walrus operator rewritten as assign-then-test for Python 3.7.\n     - CVE-2024-6232\n   * SECURITY UPDATE: quadratic complexity in http.cookies._unquote\n     - debian/patches/CVE-2024-7592.patch: replace the O(n^2) _OctalPatt/_QuotePatt while-loop in Lib/http/cookies.py with a single linear re.sub() driven by an alternation pattern and _unquote_replace callback. Verbatim from upstream commit 44e45835 / 3.8 backport a77ab244.\n     - CVE-2024-7592\n   * SECURITY UPDATE: shell injection via venv activation script substitutions\n     - debian/patches/CVE-2024-9287.patch: shell-quote __VENV_*__ placeholder substitutions in Lib/venv/__init__.py via shlex.quote (sh/csh/fish) and remove surrounding double-quotes from activate/activate.csh/activate.fish templates so the now-pre-quoted values splice safely. Adapted from upstream 3.9 backport 633555735a; Lib/venv/scripts/nt/Activate.ps1 deliberately untouched (matches upstream 3.9-3.12 backport scope).\n     - CVE-2024-9287","modified":"2026-06-04T09:45:29.838873689Z","published":"2026-05-17T00:53:13Z","upstream":["CVE-2024-6232","CVE-2024-7592","CVE-2024-9287"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1778979189.html"}],"affected":[{"package":{"name":"idle-python3.7","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/idle-python3.7?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1778979189.json"}},{"package":{"name":"libpython3.7","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython3.7?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1778979189.json"}},{"package":{"name":"libpython3.7-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython3.7-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1778979189.json"}},{"package":{"name":"libpython3.7-minimal","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython3.7-minimal?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1778979189.json"}},{"package":{"name":"libpython3.7-stdlib","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython3.7-stdlib?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1778979189.json"}},{"package":{"name":"libpython3.7-testsuite","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython3.7-testsuite?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1778979189.json"}},{"package":{"name":"python3.7","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python3.7?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1778979189.json"}},{"package":{"name":"python3.7-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python3.7-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1778979189.json"}},{"package":{"name":"python3.7-doc","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python3.7-doc?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1778979189.json"}},{"package":{"name":"python3.7-examples","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python3.7-examples?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1778979189.json"}},{"package":{"name":"python3.7-minimal","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python3.7-minimal?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1778979189.json"}},{"package":{"name":"python3.7-venv","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python3.7-venv?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2+deb10u7+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1778979189.json"}}],"schema_version":"1.7.5"}