OESA-2026-4774: python3 security update
Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):
tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process.
This is the tarfile.tarfilter counterpart of CVE-2026-7774, which covered tarfile.datafilter.(CVE-2026-114583)
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.(CVE-2026-115557)
socket.getaddrinfo() previously accepted null bytes within host and port parameters which can cause the values to be silently truncated.(CVE-2026-116566)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/python3to a version that resolves this vulnerability.Fixed in 3.11.6-45.oe2403sp3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Python applications are exposed to the tar archive issue?
Applications are exposed if they extract attacker-controlled tar archives with tarfile.extractall() using filter="tar". A crafted archive can use link entries to redirect later extracted files outside the intended destination directory, limited by the extracting process's permissions.
Does exploitation require authentication or direct access to the target system?
The supplied severity vector indicates network attack vector, low attack complexity, no privileges required, and user interaction required. The described attack depends on a malicious tar archive being extracted by the affected application.
What configuration makes the tar extraction vulnerability relevant?
The issue specifically affects tarfile.extractall() calls using filter="tar". The provided information does not establish that other extraction filters or default extraction behavior are affected.
What security change was made to Python's SSL module?
Python added a denylist for known compromised certificates in the ssl module. This is intended to protect users even when certificate revocation checking is not configured.