{"id":"SUSE-SU-2026:4630-1","summary":"Security update for python310","details":"This update for python310 fixes the following issues:\n\n- CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding\n  protection (bsc#1264962).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free\n  (bsc#1283969).\n- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses\n  (bsc#1283826).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nChanges for python310:\n\n- Update to 3.10.22 (final release, upstream EOS)\n - Security\n - gh-158446: Fix a crash or incorrect output that could occur\n when formatting a float or complex with a precision close\n to the platform's INT_MAX. PyOS_double_to_string() now\n raises ValueError for any precision of that magnitude,\n regardless of presentation type or value, as the format\n string parsers already did for precisions above INT_MAX.\n - gh-156793: asyncio: loop.start_tls() and\n loop.create_connection() now validate the server_hostname\n argument if an ssl.SSLContext is passed with check_hostname\n set to True, emitting DeprecationWarning if server_hostname\n is missing. (This will raise ValueError in Python 3.13 and\n later.) (bsc#1283826, CVE-2026-19553)\n - gh-156793: ssl.SSLContext.wrap_bio() now validates its\n server_side, server_hostname and session arguments similar\n to ssl.SSLContext.wrap_socket(), but for backward\n compatiblity reasons emits DeprecationWarning instead of\n ValueError.\n In particular, a context with check_hostname enabled and no\n server_hostname passed to wrap_bio() now emits\n DeprecationWarning to indicate the hostname wasn't\n checked. (In Python 3.13 and later, this raises\n ValueError.)\n - gh-157265: In tarfile, when extracting a link falls back to\n extracting a member of the archive, skip the member when\n the filter function returns None when called with the\n extracted member's name replaced with the link's.\n - gh-157190: Fixed a vulnerability in the tarfile data and\n tar extraction filters where a crafted archive using a hard\n link to a symbolic link could change the permissions and\n modification time of a file outside the destination\n directory, and expose its contents inside the extracted\n tree. This addresses CVE 2026-82049.(bsc#1280459,\n CVE-2026-82049)\n - gh-157953: Update bundled libexpat to version 2.8.5.\n - gh-156002: Bound the amount of data zipfile decompresses\n per read for members compressed with bzip2, LZMA, or\n Zstandard, matching the existing limit for deflate. A small\n archive member could previously expand into an unbounded\n allocation even when read in small chunks. (bsc#1277111,\n CVE-2026-15310)\n - gh-155999: Fix the tarfile tar and data extraction filters\n creating directories outside the destination for members\n whose name leaves the destination and returns to it, such\n as ../evil/../dest/sub/file. The containment check used the\n resolved path, but intermediate directories were created\n from the name as given. (bsc#1276227, CVE-2026-19672)\n - gh-156293: Fix a crash in ssl when an sni_callback switches\n a connection to another SSLContext and the context that\n carries the callback is no longer referenced by the\n application. Servers that keep their sni_callback context\n alive (the usual case when it wraps the listening socket or\n is stored on the server object) were not affected. This\n addresses CVE-2026-19445. (bsc#1283969, CVE-2026-19445)\n - gh-155292: Change the stringprep module and encodings.idna\n codec to not consider Unicode codepoint attributes beyond\n those defined in RFC 3454. (bsc#1276226, CVE-2026-17084)\n - gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr\n credentials to the URL scheme, preventing credentials\n stored for an HTTPS URL from being used for a matching HTTP\n URL, while URIs without a scheme continue to match any\n scheme. (bsc#1276223, CVE-2026-15806)\n - gh-149018: Improved protection against XML hash-flooding\n attacks in xml.parsers.expat and xml.etree.ElementTree when\n Python is compiled with libExpat 2.8.0 or later.\n (bsc#1264962, CVE-2026-7210)\n - Library\n - gh-156002: zipfile again reads members through a\n third-party decompressor installed by monkey-patching the\n private _get_decompressor() to return an object that only\n implements old BZ2Decompressor API from Python 3.3. Note\n that decompressors without needs_input and two-argument\n decompress() are vulnerable to CVE 2026-15310.\n - gh-156353: Fix configparser parsing when using whitespace\n in delimiters.\n","modified":"2026-10-13T10:30:04.528978820Z","published":"2026-10-12T15:25:09Z","related":["CVE-2026-15310","CVE-2026-15806","CVE-2026-17084","CVE-2026-19445","CVE-2026-19553","CVE-2026-19672","CVE-2026-7210","CVE-2026-82049"],"upstream":["CVE-2026-15310","CVE-2026-15806","CVE-2026-17084","CVE-2026-19445","CVE-2026-19553","CVE-2026-19672","CVE-2026-7210","CVE-2026-82049"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264630-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264962"},{"type":"REPORT","url":"https://bugzilla.suse.com/1276223"},{"type":"REPORT","url":"https://bugzilla.suse.com/1276226"},{"type":"REPORT","url":"https://bugzilla.suse.com/1276227"},{"type":"REPORT","url":"https://bugzilla.suse.com/1277111"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280459"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283826"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283969"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-15310"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-15806"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-17084"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-19445"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-19553"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-19672"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-7210"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-82049"}],"affected":[{"package":{"name":"python310","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","purl":"pkg:rpm/suse/python310&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"ecosystem_specific":{"binaries":[{"python310-base":"3.10.22-150400.4.129.1","python310-dbm":"3.10.22-150400.4.129.1","python310-devel":"3.10.22-150400.4.129.1","python310-tools":"3.10.22-150400.4.129.1","python310-curses":"3.10.22-150400.4.129.1","python310-idle":"3.10.22-150400.4.129.1","python310":"3.10.22-150400.4.129.1","libpython3_10-1_0":"3.10.22-150400.4.129.1","python310-tk":"3.10.22-150400.4.129.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"}},{"package":{"name":"python310-core","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","purl":"pkg:rpm/suse/python310-core&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"ecosystem_specific":{"binaries":[{"python310-curses":"3.10.22-150400.4.129.1","python310-base":"3.10.22-150400.4.129.1","python310-tk":"3.10.22-150400.4.129.1","python310-devel":"3.10.22-150400.4.129.1","libpython3_10-1_0":"3.10.22-150400.4.129.1","python310":"3.10.22-150400.4.129.1","python310-tools":"3.10.22-150400.4.129.1","python310-dbm":"3.10.22-150400.4.129.1","python310-idle":"3.10.22-150400.4.129.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"}},{"package":{"name":"python310","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","purl":"pkg:rpm/suse/python310&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"ecosystem_specific":{"binaries":[{"python310-curses":"3.10.22-150400.4.129.1","python310-idle":"3.10.22-150400.4.129.1","libpython3_10-1_0":"3.10.22-150400.4.129.1","python310-tk":"3.10.22-150400.4.129.1","python310-tools":"3.10.22-150400.4.129.1","python310-dbm":"3.10.22-150400.4.129.1","python310":"3.10.22-150400.4.129.1","python310-devel":"3.10.22-150400.4.129.1","python310-base":"3.10.22-150400.4.129.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"}},{"package":{"name":"python310-core","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","purl":"pkg:rpm/suse/python310-core&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"ecosystem_specific":{"binaries":[{"python310-curses":"3.10.22-150400.4.129.1","python310-idle":"3.10.22-150400.4.129.1","libpython3_10-1_0":"3.10.22-150400.4.129.1","python310":"3.10.22-150400.4.129.1","python310-devel":"3.10.22-150400.4.129.1","python310-base":"3.10.22-150400.4.129.1","python310-tk":"3.10.22-150400.4.129.1","python310-dbm":"3.10.22-150400.4.129.1","python310-tools":"3.10.22-150400.4.129.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"}},{"package":{"name":"python310","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","purl":"pkg:rpm/suse/python310&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"ecosystem_specific":{"binaries":[{"python310-tools":"3.10.22-150400.4.129.1","libpython3_10-1_0":"3.10.22-150400.4.129.1","python310-dbm":"3.10.22-150400.4.129.1","python310":"3.10.22-150400.4.129.1","python310-base":"3.10.22-150400.4.129.1","python310-devel":"3.10.22-150400.4.129.1","python310-idle":"3.10.22-150400.4.129.1","python310-curses":"3.10.22-150400.4.129.1","python310-tk":"3.10.22-150400.4.129.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"}},{"package":{"name":"python310-core","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","purl":"pkg:rpm/suse/python310-core&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"ecosystem_specific":{"binaries":[{"python310-tools":"3.10.22-150400.4.129.1","python310-curses":"3.10.22-150400.4.129.1","python310-idle":"3.10.22-150400.4.129.1","libpython3_10-1_0":"3.10.22-150400.4.129.1","python310-tk":"3.10.22-150400.4.129.1","python310":"3.10.22-150400.4.129.1","python310-base":"3.10.22-150400.4.129.1","python310-dbm":"3.10.22-150400.4.129.1","python310-devel":"3.10.22-150400.4.129.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"}},{"package":{"name":"python310","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","purl":"pkg:rpm/suse/python310&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"ecosystem_specific":{"binaries":[{"python310-tools":"3.10.22-150400.4.129.1","libpython3_10-1_0":"3.10.22-150400.4.129.1","python310-dbm":"3.10.22-150400.4.129.1","python310-devel":"3.10.22-150400.4.129.1","python310-curses":"3.10.22-150400.4.129.1","python310-base":"3.10.22-150400.4.129.1","python310":"3.10.22-150400.4.129.1","python310-idle":"3.10.22-150400.4.129.1","python310-tk":"3.10.22-150400.4.129.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"}},{"package":{"name":"python310-core","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","purl":"pkg:rpm/suse/python310-core&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-150400.4.129.1"}]}],"ecosystem_specific":{"binaries":[{"python310-tk":"3.10.22-150400.4.129.1","python310-devel":"3.10.22-150400.4.129.1","python310-base":"3.10.22-150400.4.129.1","python310-dbm":"3.10.22-150400.4.129.1","python310-tools":"3.10.22-150400.4.129.1","libpython3_10-1_0":"3.10.22-150400.4.129.1","python310-idle":"3.10.22-150400.4.129.1","python310":"3.10.22-150400.4.129.1","python310-curses":"3.10.22-150400.4.129.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"}}],"schema_version":"1.9.0"}