[CLSA-2026:1794311283] Fix CVE(s): CVE-2026-114583, CVE-2026-116566
Type:
security
Severity:
Moderate
Release date:
2026-11-10 11:48:16 UTC
Description:
* SECURITY UPDATE: reject a link member that names the destination directory itself in the tarfile extraction filters - debian/patches/CVE-2026-114583.patch: move the destination-replacement check out of the 'data' filter branch in Lib/tarfile.py so both the 'tar' and 'data' filters raise OutsideDestinationError, and extend Lib/test/test_tarfile.py to cover both filters - CVE-2026-114583 * SECURITY UPDATE: reject embedded null characters in the host and port arguments of socket.getaddrinfo() - debian/patches/CVE-2026-116566.patch: track the byte length of the host and port arguments in Modules/socketmodule.c and raise ValueError when a NUL byte truncates them - CVE-2026-116566
CVEs fixed:
Updated packages:
  • alt-python36_3.6.15-53_amd64.deb
    sha:d8ea7fa49e54c135cf2cd0e03186eda3351cbbca
  • alt-python36-debug_3.6.15-53_amd64.deb
    sha:7634d00497d118e1ee7c0b3281270f6a187f4ea5
  • alt-python36-devel_3.6.15-53_amd64.deb
    sha:7bbba578d954df17c967c0422c18537fff0c8e51
  • alt-python36-libs_3.6.15-53_amd64.deb
    sha:ad2b8b0e22e9e18252b704b8e227eb19219f7cad
  • alt-python36-test_3.6.15-53_amd64.deb
    sha:b263f9598a6090c1cfb4e0b893d8dd33af3fe5d3
  • alt-python36-tkinter_3.6.15-53_amd64.deb
    sha:c5d381f225c0eeb4876f27a95344a07dd4ec4746
  • alt-python36-tools_3.6.15-53_amd64.deb
    sha:c6375c63635b972201217e54310addcf7296a74e
  • alt-python36_3.6.15-53_arm64.deb
    sha:3ff2d923a7260bef5a7ec9d4d34fad02ef01732a
  • alt-python36-debug_3.6.15-53_arm64.deb
    sha:307eb357d9c5a86a0ecd27d1ba643db28eaa555a
  • alt-python36-devel_3.6.15-53_arm64.deb
    sha:915587aee7608c2a405348ca9de0474ffe466ba7
  • alt-python36-libs_3.6.15-53_arm64.deb
    sha:ebb9f995e494e4c892dd368f08c53b2e2294375b
  • alt-python36-test_3.6.15-53_arm64.deb
    sha:336a7fdaaf2bb1485ea165f6f44a112060b4f847
  • alt-python36-tkinter_3.6.15-53_arm64.deb
    sha:6d1ff7f8522a09754cd8a59173185be1475baa55
  • alt-python36-tools_3.6.15-53_arm64.deb
    sha:4686f53d7ba81613e82983abf59627078720415c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.