Skip to content
OpenAdvisories
High ALAS2-2026-3228 3 CVEs

Important: python3 security update (Amazon Linux 2)

Published Mar 30, 2026 · Updated Apr 13, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open(). CVE-2026-3479: pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals. CVE-2025-13462: The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 python3 0:3.7.16-1.amzn2.0.25
Amazon Linux · 2 python3-debug 0:3.7.16-1.amzn2.0.25
Amazon Linux · 2 python3-debuginfo 0:3.7.16-1.amzn2.0.25
Amazon Linux · 2 python3-devel 0:3.7.16-1.amzn2.0.25
Amazon Linux · 2 python3-libs 0:3.7.16-1.amzn2.0.25
Amazon Linux · 2 python3-test 0:3.7.16-1.amzn2.0.25
Amazon Linux · 2 python3-tkinter 0:3.7.16-1.amzn2.0.25
Amazon Linux · 2 python3-tools 0:3.7.16-1.amzn2.0.25

Vulnerabilities 3

  • High 7.0
    CVE-2026-4519

    webbrowser.open() allows leading dashes in URLs

    The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 2.0
    CVE-2025-13462

    tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

    The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile …

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Wolfi
  • None 0.0
    CVE-2026-3479

    pkgutil.get_data() does not enforce documented restrictions

    DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the i…

    Python Software Foundation CPython pypy3 python3.11 Debian Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-13462.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-3479.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-4519.html