{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: excess base64 data ignored after the first padded quad\n - debian/patches/CVE-2026-3446.patch: treat the pad character as\n non-alphabet data in binascii.a2b_base64() as permitted by RFC 4648\n section 3.3, so decoding continues to the end of the input instead of\n silently dropping everything that follows the first padded quad\n - CVE-2026-3446\n * SECURITY UPDATE: symlink escape via the tarfile hardlink-extraction\n fallback\n - debian/patches/CVE-2026-11940.patch: revalidate the link with the\n hardlink's own shallower name in makelink_with_filter() so a crafted\n archive whose hardlink references a symlink stored at a deeper path\n cannot recreate a relative target that escapes the destination\n directory (incomplete fix of CVE-2025-4330), and pass the extraction\n filter from extract() down to _extract_one() so the revalidation runs\n for single-member extraction as well and not only for extractall()\n - CVE-2026-11940\n * SECURITY UPDATE: script-element breakout in http.cookies\n Morsel.js_output()\n - debian/patches/CVE-2026-6019.patch: percent-encode the cookie value\n with urllib.parse.quote() and wrap it in decodeURIComponent() in the\n generated inline or other HTML parser-sensitive sequences cannot\n escape the script element, while non-latin-1 values still reach the\n browser as UTF-8\n - CVE-2026-6019", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613", "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_python/debian11/advisories/2026/clsa-2026_1785427613.json" } ], "tracking": { "current_release_date": "2026-07-30T19:07:19Z", "generator": { "date": "2026-07-30T19:07:19Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1785427613", "initial_release_date": "2026-07-30T16:08:25Z", "revision_history": [ { "date": "2026-07-30T16:08:25Z", "number": "1", "summary": "Initial version" }, { "date": "2026-07-30T19:07:19Z", "number": "2", "summary": "Update document" } ], "status": "final", "version": "2" }, "title": "Fix of 9 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 11", "product": { "name": "Debian 11", "product_id": "Debian-11", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-python310-devel-0:3.10.20-10.amd64", "product": { "name": "alt-python310-devel-0:3.10.20-10.amd64", "product_id": "alt-python310-devel-0:3.10.20-10.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-devel@3.10.20-10?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-idle-0:3.10.20-10.amd64", "product": { "name": "alt-python310-idle-0:3.10.20-10.amd64", "product_id": "alt-python310-idle-0:3.10.20-10.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-idle@3.10.20-10?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-libs-0:3.10.20-10.amd64", "product": { "name": "alt-python310-libs-0:3.10.20-10.amd64", "product_id": "alt-python310-libs-0:3.10.20-10.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-libs@3.10.20-10?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-0:3.10.20-10.amd64", "product": { "name": "alt-python310-0:3.10.20-10.amd64", "product_id": "alt-python310-0:3.10.20-10.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310@3.10.20-10?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-debug-0:3.10.20-10.amd64", "product": { "name": "alt-python310-debug-0:3.10.20-10.amd64", "product_id": "alt-python310-debug-0:3.10.20-10.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-debug@3.10.20-10?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-tkinter-0:3.10.20-10.amd64", "product": { "name": "alt-python310-tkinter-0:3.10.20-10.amd64", "product_id": "alt-python310-tkinter-0:3.10.20-10.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-tkinter@3.10.20-10?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-test-0:3.10.20-10.amd64", "product": { "name": "alt-python310-test-0:3.10.20-10.amd64", "product_id": "alt-python310-test-0:3.10.20-10.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-test@3.10.20-10?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-libs-0:3.10.20-5.amd64", "product": { "name": "alt-python310-libs-0:3.10.20-5.amd64", "product_id": "alt-python310-libs-0:3.10.20-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-libs@3.10.20-5?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-tkinter-0:3.10.20-5.amd64", "product": { "name": "alt-python310-tkinter-0:3.10.20-5.amd64", "product_id": "alt-python310-tkinter-0:3.10.20-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-tkinter@3.10.20-5?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-0:3.10.20-5.amd64", "product": { "name": "alt-python310-0:3.10.20-5.amd64", "product_id": "alt-python310-0:3.10.20-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310@3.10.20-5?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-devel-0:3.10.20-5.amd64", "product": { "name": "alt-python310-devel-0:3.10.20-5.amd64", "product_id": "alt-python310-devel-0:3.10.20-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-devel@3.10.20-5?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-idle-0:3.10.20-5.amd64", "product": { "name": "alt-python310-idle-0:3.10.20-5.amd64", "product_id": "alt-python310-idle-0:3.10.20-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-idle@3.10.20-5?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-debug-0:3.10.20-5.amd64", "product": { "name": "alt-python310-debug-0:3.10.20-5.amd64", "product_id": "alt-python310-debug-0:3.10.20-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-debug@3.10.20-5?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-test-0:3.10.20-5.amd64", "product": { "name": "alt-python310-test-0:3.10.20-5.amd64", "product_id": "alt-python310-test-0:3.10.20-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-test@3.10.20-5?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-idle-0:3.10.20-4.amd64", "product": { "name": "alt-python310-idle-0:3.10.20-4.amd64", "product_id": "alt-python310-idle-0:3.10.20-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-idle@3.10.20-4?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-0:3.10.20-4.amd64", "product": { "name": "alt-python310-0:3.10.20-4.amd64", "product_id": "alt-python310-0:3.10.20-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310@3.10.20-4?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-tkinter-0:3.10.20-4.amd64", "product": { "name": "alt-python310-tkinter-0:3.10.20-4.amd64", "product_id": "alt-python310-tkinter-0:3.10.20-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-tkinter@3.10.20-4?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-test-0:3.10.20-4.amd64", "product": { "name": "alt-python310-test-0:3.10.20-4.amd64", "product_id": "alt-python310-test-0:3.10.20-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-test@3.10.20-4?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-devel-0:3.10.20-4.amd64", "product": { "name": "alt-python310-devel-0:3.10.20-4.amd64", "product_id": "alt-python310-devel-0:3.10.20-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-devel@3.10.20-4?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-libs-0:3.10.20-4.amd64", "product": { "name": "alt-python310-libs-0:3.10.20-4.amd64", "product_id": "alt-python310-libs-0:3.10.20-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-libs@3.10.20-4?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-debug-0:3.10.20-4.amd64", "product": { "name": "alt-python310-debug-0:3.10.20-4.amd64", "product_id": "alt-python310-debug-0:3.10.20-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-debug@3.10.20-4?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-tkinter-0:3.10.20-3.amd64", "product": { "name": "alt-python310-tkinter-0:3.10.20-3.amd64", "product_id": "alt-python310-tkinter-0:3.10.20-3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-tkinter@3.10.20-3?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-libs-0:3.10.20-3.amd64", "product": { "name": "alt-python310-libs-0:3.10.20-3.amd64", "product_id": "alt-python310-libs-0:3.10.20-3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-libs@3.10.20-3?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-test-0:3.10.20-3.amd64", "product": { "name": "alt-python310-test-0:3.10.20-3.amd64", "product_id": "alt-python310-test-0:3.10.20-3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-test@3.10.20-3?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-devel-0:3.10.20-3.amd64", "product": { "name": "alt-python310-devel-0:3.10.20-3.amd64", "product_id": "alt-python310-devel-0:3.10.20-3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-devel@3.10.20-3?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-idle-0:3.10.20-3.amd64", "product": { "name": "alt-python310-idle-0:3.10.20-3.amd64", "product_id": "alt-python310-idle-0:3.10.20-3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-idle@3.10.20-3?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-0:3.10.20-3.amd64", "product": { "name": "alt-python310-0:3.10.20-3.amd64", "product_id": "alt-python310-0:3.10.20-3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310@3.10.20-3?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-debug-0:3.10.20-3.amd64", "product": { "name": "alt-python310-debug-0:3.10.20-3.amd64", "product_id": "alt-python310-debug-0:3.10.20-3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-debug@3.10.20-3?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-libs-0:3.10.20-1.amd64", "product": { "name": "alt-python310-libs-0:3.10.20-1.amd64", "product_id": "alt-python310-libs-0:3.10.20-1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-libs@3.10.20-1?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-debug-0:3.10.20-1.amd64", "product": { "name": "alt-python310-debug-0:3.10.20-1.amd64", "product_id": "alt-python310-debug-0:3.10.20-1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-debug@3.10.20-1?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-devel-0:3.10.20-1.amd64", "product": { "name": "alt-python310-devel-0:3.10.20-1.amd64", "product_id": "alt-python310-devel-0:3.10.20-1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-devel@3.10.20-1?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-test-0:3.10.20-1.amd64", "product": { "name": "alt-python310-test-0:3.10.20-1.amd64", "product_id": "alt-python310-test-0:3.10.20-1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-test@3.10.20-1?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-0:3.10.20-1.amd64", "product": { "name": "alt-python310-0:3.10.20-1.amd64", "product_id": "alt-python310-0:3.10.20-1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310@3.10.20-1?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-idle-0:3.10.20-1.amd64", "product": { "name": "alt-python310-idle-0:3.10.20-1.amd64", "product_id": "alt-python310-idle-0:3.10.20-1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-idle@3.10.20-1?arch=amd64&os_name=debian&os_version=11" } } }, { "category": "product_version", "name": "alt-python310-tkinter-0:3.10.20-1.amd64", "product": { "name": "alt-python310-tkinter-0:3.10.20-1.amd64", "product_id": "alt-python310-tkinter-0:3.10.20-1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-python310-tkinter@3.10.20-1?arch=amd64&os_name=debian&os_version=11" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-python310-devel-0:3.10.20-10.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-devel-0:3.10.20-10.amd64" }, "product_reference": "alt-python310-devel-0:3.10.20-10.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-idle-0:3.10.20-10.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-idle-0:3.10.20-10.amd64" }, "product_reference": "alt-python310-idle-0:3.10.20-10.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-libs-0:3.10.20-10.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-libs-0:3.10.20-10.amd64" }, "product_reference": "alt-python310-libs-0:3.10.20-10.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-0:3.10.20-10.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-0:3.10.20-10.amd64" }, "product_reference": "alt-python310-0:3.10.20-10.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-debug-0:3.10.20-10.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-debug-0:3.10.20-10.amd64" }, "product_reference": "alt-python310-debug-0:3.10.20-10.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-tkinter-0:3.10.20-10.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" }, "product_reference": "alt-python310-tkinter-0:3.10.20-10.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-test-0:3.10.20-10.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-test-0:3.10.20-10.amd64" }, "product_reference": "alt-python310-test-0:3.10.20-10.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-libs-0:3.10.20-5.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-libs-0:3.10.20-5.amd64" }, "product_reference": "alt-python310-libs-0:3.10.20-5.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-tkinter-0:3.10.20-5.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" }, "product_reference": "alt-python310-tkinter-0:3.10.20-5.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-0:3.10.20-5.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-0:3.10.20-5.amd64" }, "product_reference": "alt-python310-0:3.10.20-5.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-devel-0:3.10.20-5.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-devel-0:3.10.20-5.amd64" }, "product_reference": "alt-python310-devel-0:3.10.20-5.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-idle-0:3.10.20-5.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-idle-0:3.10.20-5.amd64" }, "product_reference": "alt-python310-idle-0:3.10.20-5.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-debug-0:3.10.20-5.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-debug-0:3.10.20-5.amd64" }, "product_reference": "alt-python310-debug-0:3.10.20-5.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-test-0:3.10.20-5.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-test-0:3.10.20-5.amd64" }, "product_reference": "alt-python310-test-0:3.10.20-5.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-idle-0:3.10.20-4.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-idle-0:3.10.20-4.amd64" }, "product_reference": "alt-python310-idle-0:3.10.20-4.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-0:3.10.20-4.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-0:3.10.20-4.amd64" }, "product_reference": "alt-python310-0:3.10.20-4.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-tkinter-0:3.10.20-4.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64" }, "product_reference": "alt-python310-tkinter-0:3.10.20-4.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-test-0:3.10.20-4.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-test-0:3.10.20-4.amd64" }, "product_reference": "alt-python310-test-0:3.10.20-4.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-devel-0:3.10.20-4.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-devel-0:3.10.20-4.amd64" }, "product_reference": "alt-python310-devel-0:3.10.20-4.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-libs-0:3.10.20-4.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-libs-0:3.10.20-4.amd64" }, "product_reference": "alt-python310-libs-0:3.10.20-4.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-debug-0:3.10.20-4.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-debug-0:3.10.20-4.amd64" }, "product_reference": "alt-python310-debug-0:3.10.20-4.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-tkinter-0:3.10.20-3.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64" }, "product_reference": "alt-python310-tkinter-0:3.10.20-3.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-libs-0:3.10.20-3.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-libs-0:3.10.20-3.amd64" }, "product_reference": "alt-python310-libs-0:3.10.20-3.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-test-0:3.10.20-3.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-test-0:3.10.20-3.amd64" }, "product_reference": "alt-python310-test-0:3.10.20-3.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-devel-0:3.10.20-3.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-devel-0:3.10.20-3.amd64" }, "product_reference": "alt-python310-devel-0:3.10.20-3.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-idle-0:3.10.20-3.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-idle-0:3.10.20-3.amd64" }, "product_reference": "alt-python310-idle-0:3.10.20-3.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-0:3.10.20-3.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-0:3.10.20-3.amd64" }, "product_reference": "alt-python310-0:3.10.20-3.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-debug-0:3.10.20-3.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-debug-0:3.10.20-3.amd64" }, "product_reference": "alt-python310-debug-0:3.10.20-3.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-libs-0:3.10.20-1.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-libs-0:3.10.20-1.amd64" }, "product_reference": "alt-python310-libs-0:3.10.20-1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-debug-0:3.10.20-1.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-debug-0:3.10.20-1.amd64" }, "product_reference": "alt-python310-debug-0:3.10.20-1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-devel-0:3.10.20-1.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-devel-0:3.10.20-1.amd64" }, "product_reference": "alt-python310-devel-0:3.10.20-1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-test-0:3.10.20-1.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-test-0:3.10.20-1.amd64" }, "product_reference": "alt-python310-test-0:3.10.20-1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-0:3.10.20-1.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-0:3.10.20-1.amd64" }, "product_reference": "alt-python310-0:3.10.20-1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-idle-0:3.10.20-1.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-idle-0:3.10.20-1.amd64" }, "product_reference": "alt-python310-idle-0:3.10.20-1.amd64", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "alt-python310-tkinter-0:3.10.20-1.amd64 as a component of Debian 11", "product_id": "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64" }, "product_reference": "alt-python310-tkinter-0:3.10.20-1.amd64", "relates_to_product_reference": "Debian-11" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-12781", "cwe": { "id": "CWE-704", "name": "Incorrect Type Conversion or Cast" }, "notes": [ { "category": "description", "text": "When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "known_affected": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2025-12781" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b", "url": "https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947", "url": "https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5", "url": "https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76", "url": "https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5", "url": "https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5" }, { "category": "external", "summary": "https://github.com/python/cpython/issues/125346", "url": "https://github.com/python/cpython/issues/125346" }, { "category": "external", "summary": "https://github.com/python/cpython/pull/141128", "url": "https://github.com/python/cpython/pull/141128" }, { "category": "external", "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/" } ], "release_date": "2026-01-21T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-30T16:06:56.070284Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613" }, { "category": "none_available", "date": "2026-01-21T20:16:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2025-13462", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "The \"tarfile\" module would still apply normalization of AREGTYPE (\\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "known_affected": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2025-13462" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab", "url": "https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114", "url": "https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017", "url": "https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406", "url": "https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7", "url": "https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084", "url": "https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084" }, { "category": "external", "summary": "https://github.com/python/cpython/issues/141707", "url": "https://github.com/python/cpython/issues/141707" }, { "category": "external", "summary": "https://github.com/python/cpython/pull/143934", "url": "https://github.com/python/cpython/pull/143934" }, { "category": "external", "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/" } ], "release_date": "2026-03-12T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-30T16:06:56.070284Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613" }, { "category": "none_available", "date": "2026-03-12T18:16:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ] }, { "cve": "CVE-2026-1502", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences ('CRLF Injection')" }, "notes": [ { "category": "description", "text": "CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "known_affected": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-1502" } ], "release_date": "2026-04-10T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-30T16:06:56.070284Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613" }, { "category": "none_available", "date": "2026-04-10T18:16:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-0864", "notes": [ { "category": "description", "text": "When using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the written value.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "known_affected": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-0864" } ], "release_date": "2026-06-23T18:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-30T16:06:56.070284Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613" }, { "category": "none_available", "date": "2026-06-23T18:17:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-11972", "notes": [ { "category": "description", "text": "When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "known_affected": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-11972" } ], "release_date": "2026-06-23T23:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-30T16:06:56.070284Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613" }, { "category": "none_available", "date": "2026-06-23T23:16:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-3276", "notes": [ { "category": "description", "text": "unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "known_affected": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-3276" } ], "release_date": "2026-06-03T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-30T16:06:56.070284Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613" }, { "category": "none_available", "date": "2026-06-03T16:16:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-8328", "notes": [ { "category": "description", "text": "The ftpcp() function in Lib/ftplib.py was not updated when \nCVE-2021-4189 was fixed. While makepasv() was patched to replace \nserver-supplied PASV host addresses with the actual peer address \n(getpeername()[0]), ftpcp() still calls parse227() directly and passes \nthe raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "known_affected": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-8328" } ], "release_date": "2026-05-13T21:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-30T16:06:56.070284Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613" }, { "category": "none_available", "date": "2026-05-13T21:16:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-3446", "cwe": { "id": "CWE-1286", "name": "Improper Validation of Syntactic Correctness of Input" }, "notes": [ { "category": "description", "text": "When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use \"validate=True\" to enable stricter processing of base64 data.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "known_affected": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-3446" } ], "release_date": "2026-04-10T18:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-30T16:06:56.070284Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613" }, { "category": "none_available", "date": "2026-04-10T18:17:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-11940", "notes": [ { "category": "description", "text": "tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "known_affected": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-11940" } ], "release_date": "2026-06-23T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-30T16:06:56.070284Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613" }, { "category": "none_available", "date": "2026-06-23T17:16:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-1795", "cwe": { "id": "CWE-168", "name": "Improper Handling of Inconsistent Special Elements" }, "notes": [ { "category": "description", "text": "During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "known_affected": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2025-1795" } ], "release_date": "2025-02-28T18:59:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-30T16:06:56.070284Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613" }, { "category": "none_available", "date": "2025-02-28T18:59:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ] }, { "cve": "CVE-2026-6019", "cwe": { "id": "CWE-150", "name": "Improper Neutralization of Escape, Meta, or Control Sequences" }, "notes": [ { "category": "description", "text": "http.cookies.Morsel.js_output() returns an inline inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "known_affected": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-6019" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c", "url": "https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104", "url": "https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8", "url": "https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8" }, { "category": "external", "summary": "https://github.com/python/cpython/issues/90309", "url": "https://github.com/python/cpython/issues/90309" }, { "category": "external", "summary": "https://github.com/python/cpython/pull/148848", "url": "https://github.com/python/cpython/pull/148848" }, { "category": "external", "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/" } ], "release_date": "2026-04-22T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-30T16:06:56.070284Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613" }, { "category": "none_available", "date": "2026-04-22T20:16:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-7774", "notes": [ { "category": "description", "text": "tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "known_affected": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-7774" } ], "release_date": "2026-06-04T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-30T16:06:56.070284Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-10.amd64", "Debian-11:alt-python310-debug-0:3.10.20-10.amd64", "Debian-11:alt-python310-devel-0:3.10.20-10.amd64", "Debian-11:alt-python310-idle-0:3.10.20-10.amd64", "Debian-11:alt-python310-libs-0:3.10.20-10.amd64", "Debian-11:alt-python310-test-0:3.10.20-10.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-10.amd64" ], "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1785427613" }, { "category": "none_available", "date": "2026-06-04T16:16:00Z", "details": "Affected", "product_ids": [ "Debian-11:alt-python310-0:3.10.20-1.amd64", "Debian-11:alt-python310-0:3.10.20-3.amd64", "Debian-11:alt-python310-0:3.10.20-4.amd64", "Debian-11:alt-python310-0:3.10.20-5.amd64", "Debian-11:alt-python310-debug-0:3.10.20-1.amd64", "Debian-11:alt-python310-debug-0:3.10.20-3.amd64", "Debian-11:alt-python310-debug-0:3.10.20-4.amd64", "Debian-11:alt-python310-debug-0:3.10.20-5.amd64", "Debian-11:alt-python310-devel-0:3.10.20-1.amd64", "Debian-11:alt-python310-devel-0:3.10.20-3.amd64", "Debian-11:alt-python310-devel-0:3.10.20-4.amd64", "Debian-11:alt-python310-devel-0:3.10.20-5.amd64", "Debian-11:alt-python310-idle-0:3.10.20-1.amd64", "Debian-11:alt-python310-idle-0:3.10.20-3.amd64", "Debian-11:alt-python310-idle-0:3.10.20-4.amd64", "Debian-11:alt-python310-idle-0:3.10.20-5.amd64", "Debian-11:alt-python310-libs-0:3.10.20-1.amd64", "Debian-11:alt-python310-libs-0:3.10.20-3.amd64", "Debian-11:alt-python310-libs-0:3.10.20-4.amd64", "Debian-11:alt-python310-libs-0:3.10.20-5.amd64", "Debian-11:alt-python310-test-0:3.10.20-1.amd64", "Debian-11:alt-python310-test-0:3.10.20-3.amd64", "Debian-11:alt-python310-test-0:3.10.20-4.amd64", "Debian-11:alt-python310-test-0:3.10.20-5.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-1.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-3.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-4.amd64", "Debian-11:alt-python310-tkinter-0:3.10.20-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }