Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-0865: User-controlled header names and values containing newlines can allow injecting HTTP headers. CVE-2026-0672: When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters. CVE-2025-6075: If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. CVE-2025-15282: User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype. CVE-2025-11468: When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python | 0:2.7.18-1.amzn2.0.16 |
| Amazon Linux · 2 | python-debug | 0:2.7.18-1.amzn2.0.16 |
| Amazon Linux · 2 | python-debuginfo | 0:2.7.18-1.amzn2.0.16 |
| Amazon Linux · 2 | python-devel | 0:2.7.18-1.amzn2.0.16 |
| Amazon Linux · 2 | python-libs | 0:2.7.18-1.amzn2.0.16 |
| Amazon Linux · 2 | python-test | 0:2.7.18-1.amzn2.0.16 |
| Amazon Linux · 2 | python-tools | 0:2.7.18-1.amzn2.0.16 |
| Amazon Linux · 2 | tkinter | 0:2.7.18-1.amzn2.0.16 |
Vulnerabilities 5
-
Medium 6.0
Header injection via newlines in data URL mediatype
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
-
Medium 6.0
Header injection in http.cookies.Morsel
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
-
Medium 5.9
wsgiref.headers.Headers allows header newline injection
User-controlled header names and values containing newlines can allow injecting HTTP headers.
-
Medium 5.7
Folding email comments of unfoldable characters doesn't preserve parenthesis
When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.
-
Low 1.8
Quadratic complexity in os.path.expandvars() with user-controlled template
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-11468.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-15282.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-6075.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-0672.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-0865.html