Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 16

Vulnerabilities 5

• High 8.4
  CVE-2026-82049

  tarfile extraction filters allow file modification and content disclosure via hard link to symlink

  In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside…

  Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine Wolfi
  Sep 14, 2026
• Medium 6.3
  CVE-2026-19672

  tarfile extraction filter bypass allows creation of directories outside the destination

  The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate …

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Aug 19, 2026
• Medium 6.0
  CVE-2026-15806

  `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

  The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials …

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Aug 18, 2026
• Medium 6.0
  CVE-2026-17084

  stringprep.map_table_b2() deviates from RFC 3454 Table B.2

  The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Aug 18, 2026
• Low 2.1
  CVE-2026-15310

  zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

  When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.

  Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine Wolfi
  Aug 25, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-15310
• report
  https://access.redhat.com/security/cve/CVE-2026-15806
• report
  https://access.redhat.com/security/cve/CVE-2026-17084
• report
  https://access.redhat.com/security/cve/CVE-2026-19672
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-82049
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65505.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2523543
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-15310
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-15310
• article
  https://github.com/python/cpython/issues/156002
• article
  https://github.com/python/cpython/pull/156003
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517978
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-15806
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-15806
• article
  https://github.com/python/cpython/issues/155694
• article
  https://github.com/python/cpython/pull/155696
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517897
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-17084
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-17084
• article
  https://github.com/python/cpython/issues/155292
• article
  https://github.com/python/cpython/pull/155293
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2519726
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-19672
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-19672
• article
  https://github.com/python/cpython/pull/156000
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2533296
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-82049
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-82049
• article
  https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca
• article
  https://github.com/python/cpython/issues/157190
• article
  https://github.com/python/cpython/pull/157191
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/