RHSA-2026:99691: Moderate: python3 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.Security Fix(es): python: python: Arbitrary file write via tarfile extraction filter bypass (CVE-2026-114583) python: python: Misinterpretation of HTTP responses via invalid chunk parsing (CVE-2026-103995) python: python: Security bypass via null byte truncation in socket.getaddrinfo() (CVE-2026-116566) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/python3to a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10 - Upgrade
Upgrade
redhat/platform-pythonto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10 - Upgrade
Upgrade
redhat/platform-python-debugto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10 - Upgrade
Upgrade
redhat/platform-python-develto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10 - Upgrade
Upgrade
redhat/python3-debuginfoto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10 - Upgrade
Upgrade
redhat/python3-debugsourceto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10 - Upgrade
Upgrade
redhat/python3-idleto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10 - Upgrade
Upgrade
redhat/python3-libsto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10 - Upgrade
Upgrade
redhat/python3-testto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10 - Upgrade
Upgrade
redhat/python3-tkinterto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10 - Upgrade
Upgrade
redhat/platform-pythonto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10.aa - Upgrade
Upgrade
redhat/platform-python-debugto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10.aa - Upgrade
Upgrade
redhat/platform-python-develto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10.aa - Upgrade
Upgrade
redhat/python3-debuginfoto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10.aa - Upgrade
Upgrade
redhat/python3-debugsourceto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10.aa - Upgrade
Upgrade
redhat/python3-idleto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10.aa - Upgrade
Upgrade
redhat/python3-libsto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10.aa - Upgrade
Upgrade
redhat/python3-testto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10.aa - Upgrade
Upgrade
redhat/python3-tkinterto a version that resolves this vulnerability.Fixed in 3.6.8-80.el8_10.aa
Event History
Frequently Asked Questions
Which installed components are covered by this update?
The update covers redhat/platform-python, redhat/platform-python-debug, redhat/platform-python-devel, redhat/python3-debuginfo, redhat/python3-debugsource, redhat/python3-idle, redhat/python3-libs, and redhat/python3-test.
Which vulnerability types are addressed?
The fixes address an arbitrary file-write issue involving tarfile extraction filter bypass, HTTP response misinterpretation caused by invalid chunk parsing, and a security bypass involving null-byte truncation in socket.getaddrinfo().
Does the advisory provide affected versions, default-configuration exposure, or temporary mitigations?
No. The provided advisory data does not specify affected or fixed version numbers, whether default configurations are exposed, or mitigations for systems that cannot be patched immediately.