Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 9

Vulnerabilities 6

• High 8.4
  CVE-2026-82049

  tarfile extraction filters allow file modification and content disclosure via hard link to symlink

  In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside…

  Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine Wolfi
  Sep 14, 2026
• High 8.2
  CVE-2026-9669

  bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow

  bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 8, 2026
• Medium 6.3
  CVE-2026-3276

  Potential DoS via quadratic complexity in unicodedata.normalize()

  unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 3, 2026
• Medium 6.3
  CVE-2026-7210

  The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

  `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or l…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  May 11, 2026
• Medium 5.9
  CVE-2026-8328

  FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

  The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes…

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  May 13, 2026
• Medium 5.3
  CVE-2026-12003

  CPython >3.11 Insecure Input Validation resulting in privilege escalation

  To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VP…

  Python Software Foundation CPython python3 python3.11 Debian Ubuntu Azure Linux
  Jun 16, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-82049
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-12003
• report
  https://access.redhat.com/security/cve/CVE-2026-9669
• report
  https://access.redhat.com/security/cve/CVE-2026-3276
• report
  https://access.redhat.com/security/cve/CVE-2026-7210
• report
  https://access.redhat.com/security/cve/CVE-2026-8328
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68309.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484424
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-3276
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-3276
• article
  https://github.com/python/cpython/issues/149079
• article
  https://github.com/python/cpython/pull/149080
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2469216
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-7210
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-7210
• article
  https://github.com/python/cpython/issues/149018
• article
  https://github.com/python/cpython/pull/149023
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477300
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-8328
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-8328
• article
  https://github.com/python/cpython/issues/87451
• article
  https://github.com/python/cpython/pull/149648
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486590
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-9669
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-9669
• article
  https://github.com/python/cpython/issues/150599
• article
  https://github.com/python/cpython/pull/150600
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2489322
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-12003
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-12003
• article
  https://github.com/python/cpython/issues/151544
• article
  https://github.com/python/cpython/pull/151545
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2533296