Summary
[3.14.7-2]
- On RHEL 9, also supports reparse deferral in expat
Related: RHEL-227190
[3.14.7-1]
- Update to Python 3.14.7, security fix for CVE-2026-11940
Resolves: RHEL-227190
[3.14.6-1]
- Update to Python 3.14.6
Related: RHEL-227190
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | python3.14 | 0:3.14.7-2.el10_2 |
| Oracle Linux · 10 | python3.14-debug | 0:3.14.7-2.el10_2 |
| Oracle Linux · 10 | python3.14-devel | 0:3.14.7-2.el10_2 |
| Oracle Linux · 10 | python3.14-freethreading | 0:3.14.7-2.el10_2 |
| Oracle Linux · 10 | python3.14-freethreading-debug | 0:3.14.7-2.el10_2 |
| Oracle Linux · 10 | python3.14-freethreading-devel | 0:3.14.7-2.el10_2 |
| Oracle Linux · 10 | python3.14-freethreading-idle | 0:3.14.7-2.el10_2 |
| Oracle Linux · 10 | python3.14-freethreading-libs | 0:3.14.7-2.el10_2 |
| Oracle Linux · 10 | python3.14-freethreading-test | 0:3.14.7-2.el10_2 |
| Oracle Linux · 10 | python3.14-freethreading-tkinter | 0:3.14.7-2.el10_2 |
| Oracle Linux · 10 | python3.14-idle | 0:3.14.7-2.el10_2 |
| Oracle Linux · 10 | python3.14-libs | 0:3.14.7-2.el10_2 |
| Oracle Linux · 10 | python3.14-test | 0:3.14.7-2.el10_2 |
| Oracle Linux · 10 | python3.14-tkinter | 0:3.14.7-2.el10_2 |
Vulnerabilities 1
-
High 7.8
tarfile extraction filter bypass allows escaping the destination directory
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but re…