[CLSA-2026:1794315103] Fix CVE(s): CVE-2026-114583, CVE-2026-116566
Type:
security
Severity:
Moderate
Release date:
2026-11-10 12:51:56 UTC
Description:
* SECURITY UPDATE: reject a link member that names the destination directory itself in the tarfile extraction filters - debian/patches/CVE-2026-114583.patch: move the destination-replacement check out of the 'data' filter branch in Lib/tarfile.py so both the 'tar' and 'data' filters raise OutsideDestinationError, and extend Lib/test/test_tarfile.py to cover both filters - CVE-2026-114583 * SECURITY UPDATE: reject embedded null characters in the host and port arguments of socket.getaddrinfo() - debian/patches/CVE-2026-116566.patch: track the byte length of the host and port arguments in Modules/socketmodule.c and raise ValueError when a NUL byte truncates them - CVE-2026-116566
CVEs fixed:
Updated packages:
  • alt-python310_3.10.22-4_amd64.deb
    sha:f464f6ff0aa6c3d04b67a5d01293011fb4587580
  • alt-python310-debug_3.10.22-4_amd64.deb
    sha:ea461b400bf27b2837fcc5af27403900316968a5
  • alt-python310-devel_3.10.22-4_amd64.deb
    sha:c6974d2b5c9ac98bc41053ddd27d4bd9ba732e5b
  • alt-python310-idle_3.10.22-4_amd64.deb
    sha:1fd55fa3041c6d46fcee7b902394c77b4890ea5c
  • alt-python310-libs_3.10.22-4_amd64.deb
    sha:f001876e6d6693a3bd44c55db59396557bf7a320
  • alt-python310-test_3.10.22-4_amd64.deb
    sha:5ae9972cd0b798fe7bec25684050dbad933d5d4c
  • alt-python310-tkinter_3.10.22-4_amd64.deb
    sha:b015d15ddad9afb23e6ef76360ec96ed2374cad7
  • alt-python310_3.10.22-4_arm64.deb
    sha:4c04ff0418768ba03edd6d18f5fc434686f091ed
  • alt-python310-debug_3.10.22-4_arm64.deb
    sha:22ecae9fc8344d11a4754d456430f520fb30fe49
  • alt-python310-devel_3.10.22-4_arm64.deb
    sha:eb2355c89e42dcddbf99f96acd23df5fed9bc946
  • alt-python310-idle_3.10.22-4_arm64.deb
    sha:e07169cd61b8a07e69ae327aa1ae171a5ca07d74
  • alt-python310-libs_3.10.22-4_arm64.deb
    sha:e3dfe50e24993035c2eee2ed959d0aa910cda11b
  • alt-python310-test_3.10.22-4_arm64.deb
    sha:dbd4a11ce8c649fde6c33d1df7c5eb387a818ec5
  • alt-python310-tkinter_3.10.22-4_arm64.deb
    sha:0cd44efed2e5acdae896f683dedd30db7eb484b6
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.