Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 7

Vulnerabilities 4

• High 8.4
  CVE-2026-82049

  tarfile extraction filters allow file modification and content disclosure via hard link to symlink

  In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside…

  Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine Wolfi
  Sep 14, 2026
• High 8.2
  CVE-2026-9669

  bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow

  bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 8, 2026
• Medium 6.3
  CVE-2026-3276

  Potential DoS via quadratic complexity in unicodedata.normalize()

  unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 3, 2026
• Medium 5.9
  CVE-2026-8328

  FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

  The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  May 13, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-82049
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-9669
• report
  https://access.redhat.com/security/cve/CVE-2026-3276
• report
  https://access.redhat.com/security/cve/CVE-2026-8328
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68132.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484424
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-3276
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-3276
• article
  https://github.com/python/cpython/issues/149079
• article
  https://github.com/python/cpython/pull/149080
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477300
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-8328
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-8328
• article
  https://github.com/python/cpython/issues/87451
• article
  https://github.com/python/cpython/pull/149648
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486590
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-9669
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-9669
• article
  https://github.com/python/cpython/issues/150599
• article
  https://github.com/python/cpython/pull/150600
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2533296
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-82049
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-82049
• article
  https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca
• article
  https://github.com/python/cpython/issues/157190
• article
  https://github.com/python/cpython/pull/157191
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/