Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · Hardened Images 1 hummingbird:1 | python3.13 | 0:3.13.14-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | python3.13-debug | 0:3.13.14-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | python3.13-devel | 0:3.13.14-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | python3.13-freethreading | 0:3.13.14-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | python3.13-freethreading-debug | 0:3.13.14-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | python3.13-idle | 0:3.13.14-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | python3.13-libs | 0:3.13.14-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | python3.13-test | 0:3.13.14-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | python3.13-tkinter | 0:3.13.14-1.4.hum1 |
Vulnerabilities 2
-
High 7.8
tarfile extraction filter bypass allows escaping the destination directory
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but re…
-
High 7.5
Extraction filter bypass for linking outside extraction directory
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives u…
References
-
report
https://access.redhat.com/security/cve/CVE-2025-4330
-
report
https://access.redhat.com/security/cve/CVE-2026-11940
-
article
https://access.redhat.com/security/updates/classification/
-
article
https://images.redhat.com/
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38090.json
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2370014
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-4330
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-4330
-
article
https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f
-
article
https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a
-
article
https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a
-
article
https://github.com/python/cpython/issues/135034
-
article
https://github.com/python/cpython/pull/135037
-
article
https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2491848
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-11940
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-11940
-
article
https://github.com/python/cpython/issues/151558
-
article
https://github.com/python/cpython/pull/151559
-
article
https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/