Skip to content
OpenAdvisories
Low RHSA-2026:11324 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Apr 28, 2026 · Updated Oct 6, 2026

Ecosystem: Red Hat

Fixed packages 7

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 python3.11 0:3.11.15-4.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.11-debug 0:3.11.15-4.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.11-devel 0:3.11.15-4.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.11-idle 0:3.11.15-4.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.11-libs 0:3.11.15-4.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.11-test 0:3.11.15-4.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 python3.11-tkinter 0:3.11.15-4.2.hum1

Vulnerabilities 2

  • Low 2.0
    CVE-2025-13462

    tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

    The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile …

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Wolfi
  • None 0.0
    CVE-2026-3479

    pkgutil.get_data() does not enforce documented restrictions

    DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the i…

    Python Software Foundation CPython pypy3 python3.11 Debian Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-13462
  • report
    https://access.redhat.com/security/cve/CVE-2026-3479
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11324.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447082
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-13462
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-13462
  • article
    https://github.com/python/cpython/issues/141707
  • article
    https://github.com/python/cpython/pull/143934
  • article
    https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2448746
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-3479
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-3479
  • article
    https://github.com/python/cpython/issues/146121
  • article
    https://github.com/python/cpython/pull/146122
  • article
    https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/