Skip to content
OpenAdvisories
Medium RHSA-2026:10118 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Apr 24, 2026 · Updated Oct 6, 2026

Ecosystem: Red Hat

Fixed packages 7

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 python3.12 0:3.12.13-3.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.12-debug 0:3.12.13-3.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.12-devel 0:3.12.13-3.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.12-idle 0:3.12.13-3.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.12-libs 0:3.12.13-3.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.12-test 0:3.12.13-3.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.12-tkinter 0:3.12.13-3.1.hum1

Vulnerabilities 3

  • Medium 6.0
    CVE-2026-3446

    Base64 decoding stops at first padded quad by default

    When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differe…

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Wolfi
  • Low 2.0
    CVE-2025-13462

    tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

    The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile …

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Wolfi
  • None 0.0
    CVE-2026-3479

    pkgutil.get_data() does not enforce documented restrictions

    DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the i…

    Python Software Foundation CPython pypy3 python3.11 Debian Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-13462
  • report
    https://access.redhat.com/security/cve/CVE-2026-3446
  • report
    https://access.redhat.com/security/cve/CVE-2026-3479
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10118.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447082
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-13462
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-13462
  • article
    https://github.com/python/cpython/issues/141707
  • article
    https://github.com/python/cpython/pull/143934
  • article
    https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2457410
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-3446
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-3446
  • article
    https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474
  • article
    https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0e
  • article
    https://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fa
  • article
    https://github.com/python/cpython/issues/145264
  • article
    https://github.com/python/cpython/pull/145267
  • article
    https://mail.python.org/archives/list/security-announce@python.org/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2448746
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-3479
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-3479
  • article
    https://github.com/python/cpython/issues/146121
  • article
    https://github.com/python/cpython/pull/146122
  • article
    https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/