Release date:
2026-11-10 08:56:41 UTC
Description:
* SECURITY UPDATE: reject a link member that names the destination
directory itself in the tarfile extraction filters
- debian/patches/CVE-2026-114583.patch: move the destination-replacement
check out of the 'data' filter branch in Lib/tarfile.py so both the
'tar' and 'data' filters raise OutsideDestinationError, and extend
Lib/test/test_tarfile.py to cover both filters
- CVE-2026-114583
* SECURITY UPDATE: reject embedded null characters in the host and port
arguments of socket.getaddrinfo()
- debian/patches/CVE-2026-116566.patch: track the byte length of the host
and port arguments in Modules/socketmodule.c and raise ValueError when
a NUL byte truncates them
- CVE-2026-116566
Updated packages:
-
alt-python37_3.7.17-38_amd64.deb
sha:a21399653c53589c3a7a19ef8109def6acd88dcf
-
alt-python37-debug_3.7.17-38_amd64.deb
sha:a49671f0452e16433304d7045998e6f4fdf1edd2
-
alt-python37-devel_3.7.17-38_amd64.deb
sha:3237ff3c67159b118a52459e23dcadb2a34c6ac0
-
alt-python37-libs_3.7.17-38_amd64.deb
sha:2cdfb4afb973b4415dda5cc002d9c47b0df8c2e7
-
alt-python37-test_3.7.17-38_amd64.deb
sha:ed782d0d02913de86b80cad936f34e0e39637b5f
-
alt-python37-tkinter_3.7.17-38_amd64.deb
sha:48dca54f752903d42c4dc6f70eefef1ae99a878c
-
alt-python37-tools_3.7.17-38_amd64.deb
sha:f9f0cc8921d923147db93d36523a9d46b130e468
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
