Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-9669: bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data. CVE-2026-7774: tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process. CVE-2026-3276: unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms. CVE-2026-1502: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-11972: When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. CVE-2026-0864: When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | python3.12 | 0:3.12.13-2.amzn2023.0.4 |
| Amazon Linux · 2023 | python3.12-debug | 0:3.12.13-2.amzn2023.0.4 |
| Amazon Linux · 2023 | python3.12-debuginfo | 0:3.12.13-2.amzn2023.0.4 |
| Amazon Linux · 2023 | python3.12-debugsource | 0:3.12.13-2.amzn2023.0.4 |
| Amazon Linux · 2023 | python3.12-devel | 0:3.12.13-2.amzn2023.0.4 |
| Amazon Linux · 2023 | python3.12-idle | 0:3.12.13-2.amzn2023.0.4 |
| Amazon Linux · 2023 | python3.12-libs | 0:3.12.13-2.amzn2023.0.4 |
| Amazon Linux · 2023 | python3.12-test | 0:3.12.13-2.amzn2023.0.4 |
| Amazon Linux · 2023 | python3.12-tkinter | 0:3.12.13-2.amzn2023.0.4 |
Vulnerabilities 6
-
High 8.2
tarfile opened in streaming mode mishandles EOF
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
-
High 8.2
bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out…
-
Medium 6.9
tarfile.data_filter path traversal bypass allows writing outside the extraction directory
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extract…
-
Medium 6.3
Potential DoS via quadratic complexity in unicodedata.normalize()
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
-
Medium 5.7
HTTP client proxy tunnel headers not validated for CR/LF
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.
-
Medium 4.1
Configuration Injection via Carriage Return (\r) in write() method
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-0864.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-11972.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-1502.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-3276.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-7774.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-9669.html