[CLSA-2026:1794311555] Fix CVE(s): CVE-2026-114583, CVE-2026-116566
Type:
security
Severity:
Moderate
Release date:
2026-11-10 11:52:47 UTC
Description:
* SECURITY UPDATE: reject a link member that names the destination directory itself in the tarfile extraction filters - debian/patches/CVE-2026-114583.patch: move the destination-replacement check out of the 'data' filter branch in Lib/tarfile.py so both the 'tar' and 'data' filters raise OutsideDestinationError, and extend Lib/test/test_tarfile.py to cover both filters - CVE-2026-114583 * SECURITY UPDATE: reject embedded null characters in the host and port arguments of socket.getaddrinfo() - debian/patches/CVE-2026-116566.patch: track the byte length of the host and port arguments in Modules/socketmodule.c and raise ValueError when a NUL byte truncates them - CVE-2026-116566
CVEs fixed:
Updated packages:
  • alt-python37_3.7.17-38_amd64.deb
    sha:ab6a7df64db5dcec95d2a00f41b07ea664fe15b2
  • alt-python37-debug_3.7.17-38_amd64.deb
    sha:375dcc1fd3deeedc840978a1549e0a2213fac882
  • alt-python37-devel_3.7.17-38_amd64.deb
    sha:5d94d0bc8b6b6a21eca1e1ac8f5b6576ff96e22b
  • alt-python37-libs_3.7.17-38_amd64.deb
    sha:ca0bef4abac9f6b69f121d5156530a68d4b53999
  • alt-python37-test_3.7.17-38_amd64.deb
    sha:124b47c9a9fce47707a513a1c4010e2990120d42
  • alt-python37-tkinter_3.7.17-38_amd64.deb
    sha:fb8444297af84e80ecc813c9a0d9c056ebf0c40d
  • alt-python37-tools_3.7.17-38_amd64.deb
    sha:1468f4d52ac6dc6c39c046585c9ded669179d519
  • alt-python37_3.7.17-38_arm64.deb
    sha:0d7fb899788f6edccc93c9168e0891d4e2275df7
  • alt-python37-debug_3.7.17-38_arm64.deb
    sha:1b95c8187bebb96bc41d7261c90e3c1e763fd950
  • alt-python37-devel_3.7.17-38_arm64.deb
    sha:48408212f63886c46280ac33602502ccb2dd5d87
  • alt-python37-libs_3.7.17-38_arm64.deb
    sha:181c4c2143449785369cb8a7de03cdd79cc37b25
  • alt-python37-test_3.7.17-38_arm64.deb
    sha:88ac0f8474fcc23fc3c8cf0f77ce4601ea7285ce
  • alt-python37-tkinter_3.7.17-38_arm64.deb
    sha:e215812b59e4e64eaaa637ec72976c878e6a501a
  • alt-python37-tools_3.7.17-38_arm64.deb
    sha:8f3b95c1f2104ff2f0d4148c86b2c687957330ca
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.