CPython: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Summary

Product

Vulnerabilities 1

• Medium 5.7
  CVE-2026-87910

  tarfile hardlink fallback ignores custom extraction filter rejection via None

  When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For …

  Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Sep 11, 2026

Revision history

1. 2026-10-25 #5

   Neue Updates von openSUSE aufgenommen

2. 2026-10-20 #4

   Neue Updates von IBM aufgenommen

3. 2026-10-08 #3

   Neue Updates von Oracle Linux aufgenommen

4. 2026-10-07 #2

   Neue Updates von Oracle Linux aufgenommen

5. 2026-09-13 #1

   Initiale Fassung

References

• OSS Security Mailing List vom 2026-09-13
  https://seclists.org/oss-sec/2026/q3/720
• NIST Vulnerability Database vom 2026-09-13
  https://nvd.nist.gov/vuln/detail/cve-2026-87910
• Python GitHub vom 2026-09-13
  https://github.com/python/cpython/issues/157265
• Oracle Linux Security Advisory ELSA-2026-77028 vom 2026-10-08
  https://linux.oracle.com/errata/ELSA-2026-77028.html
• Oracle Linux Security Advisory ELSA-2026-77020 vom 2026-10-09
  https://linux.oracle.com/errata/ELSA-2026-77020.html
• Oracle Linux Security Advisory ELSA-2026-77017 vom 2026-10-08
  https://linux.oracle.com/errata/ELSA-2026-77017.html
• IBM Security Bulletin 7293240 vom 2026-10-21
  https://aix.software.ibm.com/aix/efixes/security/python_advisory22.asc
• openSUSE Security Update OPENSUSE-SU-2026:12125-1 vom 2026-10-25
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JBVXUSB7JB7W6JK46B2Q5HK2BDZ3J6WQ/