Skip to content
OpenAdvisories
Medium ALAS2023-2026-1933 5 CVEs

Moderate: python3.9 security update (Amazon Linux 2023)

Published Jul 6, 2026 · Updated Jul 7, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-8328: The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189. CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. CVE-2026-3479: pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals. CVE-2026-3446: When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data. CVE-2025-13462: The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 python-unversioned-command 0:3.9.25-1.amzn2023.0.7
Amazon Linux · 2023 python3 0:3.9.25-1.amzn2023.0.7
Amazon Linux · 2023 python3-debug 0:3.9.25-1.amzn2023.0.7
Amazon Linux · 2023 python3-devel 0:3.9.25-1.amzn2023.0.7
Amazon Linux · 2023 python3-idle 0:3.9.25-1.amzn2023.0.7
Amazon Linux · 2023 python3-libs 0:3.9.25-1.amzn2023.0.7
Amazon Linux · 2023 python3-test 0:3.9.25-1.amzn2023.0.7
Amazon Linux · 2023 python3-tkinter 0:3.9.25-1.amzn2023.0.7
Amazon Linux · 2023 python3.9-debuginfo 0:3.9.25-1.amzn2023.0.7
Amazon Linux · 2023 python3.9-debugsource 0:3.9.25-1.amzn2023.0.7

Vulnerabilities 5

  • Medium 6.3
    CVE-2026-7210

    The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or l…

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.0
    CVE-2026-3446

    Base64 decoding stops at first padded quad by default

    When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differe…

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Wolfi
  • Medium 5.9
    CVE-2026-8328

    FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

    The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes…

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 2.0
    CVE-2025-13462

    tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

    The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile …

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Wolfi
  • None 0.0
    CVE-2026-3479

    pkgutil.get_data() does not enforce documented restrictions

    DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the i…

    Python Software Foundation CPython pypy3 python3.11 Debian Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-13462.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-3446.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-3479.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-7210.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-8328.html