Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 16

Vulnerabilities 6

• High 8.2
  CVE-2026-9669

  bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow

  bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 8, 2026
• Medium 6.3
  CVE-2026-3276

  Potential DoS via quadratic complexity in unicodedata.normalize()

  unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 3, 2026
• Medium 6.3
  CVE-2026-7210

  The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

  `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or l…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  May 11, 2026
• Medium 5.9
  CVE-2026-8328

  FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

  The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  May 13, 2026
• Medium 5.7
  CVE-2026-87910

  tarfile hardlink fallback ignores custom extraction filter rejection via None

  When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For …

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Sep 11, 2026
• Medium 5.3
  CVE-2026-12003

  CPython >3.11 Insecure Input Validation resulting in privilege escalation

  To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VP…

  Python Software Foundation CPython python3 python3.11 Debian Ubuntu Azure Linux
  Jun 16, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-87910
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-12003
• report
  https://access.redhat.com/security/cve/CVE-2026-9669
• report
  https://access.redhat.com/security/cve/CVE-2026-3276
• report
  https://access.redhat.com/security/cve/CVE-2026-7210
• report
  https://access.redhat.com/security/cve/CVE-2026-8328
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67572.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484424
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-3276
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-3276
• article
  https://github.com/python/cpython/issues/149079
• article
  https://github.com/python/cpython/pull/149080
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2469216
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-7210
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-7210
• article
  https://github.com/python/cpython/issues/149018
• article
  https://github.com/python/cpython/pull/149023
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477300
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-8328
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-8328
• article
  https://github.com/python/cpython/issues/87451
• article
  https://github.com/python/cpython/pull/149648
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486590
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-9669
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-9669
• article
  https://github.com/python/cpython/issues/150599
• article
  https://github.com/python/cpython/pull/150600
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2489322
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-12003
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-12003
• article
  https://github.com/python/cpython/issues/151544
• article
  https://github.com/python/cpython/pull/151545
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2531985