Description
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.
Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.
Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Python Software Foundation | CPython | < 3.9.23, 3.10.0 – < 3.10.18, 3.11.0 – < 3.11.13, 3.12.0 – < 3.12.11, 3.13.0 – < 3.13.4, 3.14.0a1 – < 3.14.0b3 | 3.9.23 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pypy3 | 7.3.20+dfsg-2 | — |
| Debian 13 | pypy3 | No fix yet | — |
| Debian 13 | python3.13 | 3.13.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | python3.14 | 3.14.0-1 | — |
| Ubuntu 24.04 LTS | python3.12 | 3.12.3-1ubuntu0.7 | USN-7583-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | python3 +8 | 3.12.9-2.el10_0.2 | RHSA-2025:10140 |
| RHEL 9 | python3 +8 | 3.9.21-2.el9_6.1 | RHSA-2025:10136 |
| RHEL 9 | python3.11 +6 | 3.11.11-2.el9_6.1 | RHSA-2025:10148 |
| RHEL 9 | python3.12 +6 | 3.12.9-1.el9_6.1 | RHSA-2025:10189 |
| RHEL 8 | Cython +1 | 0.29.21-5.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | PyYAML +1 | 5.4.1-1.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | mod_wsgi +1 | 4.7.1-7.module+el8.10.0+23075+0aa18782.1 | RHSA-2025:23530 |
| RHEL 8 | numpy +3 | 1.19.4-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | pybind11 +2 | 2.7.1-1.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | pytest +1 | 6.0.2-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-PyMySQL +1 | 0.10.1-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-attrs +1 | 20.3.0-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-cffi +1 | 1.14.3-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-chardet +1 | 3.0.4-19.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-cryptography +1 | 3.3.1-3.module+el8.10.0+21271+eccd1d86 | RHSA-2025:23530 |
| RHEL 8 | python-idna +1 | 2.10-4.module+el8.10.0+21815+bb024982 | RHSA-2025:23530 |
| RHEL 8 | python-iniconfig +1 | 1.1.1-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-lxml +1 | 4.6.5-1.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-more-itertools +1 | 8.5.0-2.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-packaging +1 | 20.4-4.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-pluggy +1 | 0.13.1-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-ply +1 | 3.11-10.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-psutil +1 | 5.8.0-4.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-psycopg2 +3 | 2.8.6-3.module+el8.10.0+21142+453d2b75 | RHSA-2025:23530 |
| RHEL 8 | python-py +1 | 1.10.0-1.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-pycparser +1 | 2.20-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-pysocks +1 | 1.7.1-4.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-requests +1 | 2.25.0-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-toml +1 | 0.10.1-5.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-urllib3 +1 | 1.25.10-5.module+el8.10.0+20443+f0a692fe | RHSA-2025:23530 |
| RHEL 8 | python-wcwidth +1 | 0.2.5-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python-wheel +2 | 1:0.35.1-4.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python3 +7 | 3.6.8-70.el8_10 | RHSA-2025:10128 |
| RHEL 8 | python3.11 +7 | 3.11.13-1.el8_10 | RHSA-2025:10026 |
| RHEL 8 | python3.12 +7 | 3.12.11-1.el8_10 | RHSA-2025:10031 |
| RHEL 8 | python39 +7 | 3.9.25-2.module+el8.10.0+23718+1842ae33 | RHSA-2025:23530 |
| RHEL 8 | python39-pip +2 | 20.2.4-9.module+el8.10.0+21329+8d76b841 | RHSA-2025:23530 |
| RHEL 8 | python39-pyparsing +1 | 2.4.7-5.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | python39-setuptools +2 | 50.3.2-7.module+el8.10.0+23406+03055bfb | RHSA-2025:23530 |
| RHEL 8 | python39-six +1 | 1.15.0-3.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
| RHEL 8 | scipy +1 | 1.5.4-5.module+el8.9.0+19644+d68f775d | RHSA-2025:23530 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | python3 +8 | 3.9.18-3.el9_4.8 | RHSA-2025:10399 |
| RHEL 9.4 EUS | python3.11 +6 | 3.11.7-1.el9_4.8 | RHSA-2025:9918 |
| RHEL 9.4 EUS | python3.12 +6 | 3.12.1-4.el9_4.6 | RHSA-2025:10028 |
| RHEL 8.8 TUS | python3 +7 | 3.6.8-51.el8_8.10 | RHSA-2025:10602 |
| RHEL 8.8 EUS Long Life | python3 +7 | 3.6.8-51.el8_8.10 | RHSA-2025:10602 |
| RHEL 8.8 E4S | python3 +7 | 3.6.8-51.el8_8.10 | RHSA-2025:10602 |
| RHEL 8.6 TUS | python3 +7 | 3.6.8-47.el8_6.8 | RHSA-2025:10484 |
| RHEL 8.6 EUS Long Life | python3 +7 | 3.6.8-47.el8_6.8 | RHSA-2025:10484 |
| RHEL 8.6 E4S | python3 +7 | 3.6.8-47.el8_6.8 | RHSA-2025:10484 |
| RHEL 8.6 AUS | python3 +7 | 3.6.8-47.el8_6.8 | RHSA-2025:10484 |
| Red Hat Hardened Images 1 | python3.12 +6 | 3.12.13-3.5.hum1 | RHSA-2026:38017 |
| Red Hat Hardened Images 1 | python3.13 +8 | 3.13.14-1.4.hum1 | RHSA-2026:38090 |
| Red Hat Hardened Images 1 | python3.14 +13 | 3.14.6-1.4.hum1 | RHSA-2026:38091 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | python-unversioned-command | 3.12.9-2.el10_0.2 | ALSA-2025:10140 |
| AlmaLinux 9 | python3 +7 | 3.9.21-2.el9_6.1 | ALSA-2025:10136 |
| AlmaLinux 9 | python3.11 +6 | 3.11.11-2.el9_6.1 | ALSA-2025:10148 |
| AlmaLinux 9 | python3.12 +6 | 3.12.9-1.el9_6.1 | ALSA-2025:10189 |
| AlmaLinux 8 | python3-idle +6 | 3.6.8-70.el8_10.alma.1 | ALSA-2025:10128 |
| AlmaLinux 8 | python3.11 +7 | 3.11.13-1.el8_10 | ALSA-2025:10026 |
| AlmaLinux 8 | python3.12 +7 | 3.12.11-1.el8_10 | ALSA-2025:10031 |
| AlmaLinux 8 | python39 +7 | 3.9.25-2.module_el8.10.0+4083+53cad1fb | ALSA-2025:23530 |
| AlmaLinux 8 | python39-Cython | 0.29.21-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-PyMySQL | 0.10.1-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-attrs | 20.3.0-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-cffi | 1.14.3-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-chardet | 3.0.4-19.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-cryptography | 3.3.1-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux 8 | python39-idna | 2.10-4.module_el8.10.0+3849+a48d89aa | ALSA-2025:23530 |
| AlmaLinux 8 | python39-iniconfig | 1.1.1-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-lxml | 4.6.5-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-mod_wsgi | 4.7.1-7.module_el8.10.0+3989+a618fe15.1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-more-itertools | 8.5.0-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-numpy +2 | 1.19.4-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-packaging | 20.4-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pip +1 | 20.2.4-9.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pluggy | 0.13.1-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-ply | 3.11-10.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-psutil | 5.8.0-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-psycopg2 +2 | 2.8.6-3.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux 8 | python39-py | 1.10.0-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pybind11 +1 | 2.7.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pycparser | 2.20-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pyparsing | 2.4.7-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pysocks | 1.7.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pytest | 6.0.2-2.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-pyyaml | 5.4.1-1.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-requests | 2.25.0-3.module_el8.9.0+3634+fb2a896c | ALSA-2025:23530 |
| AlmaLinux 8 | python39-scipy | 1.5.4-5.module_el8.9.0+3634+fb2a896c | ALSA-2025:23530 |
| AlmaLinux 8 | python39-setuptools +1 | 50.3.2-7.module_el8.10.0+4040+9207bbc0 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-six | 1.15.0-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-toml | 0.10.1-5.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-urllib3 | 1.25.10-5.module_el8.10.0+3765+2f9a457d | ALSA-2025:23530 |
| AlmaLinux 8 | python39-wcwidth | 0.2.5-3.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
| AlmaLinux 8 | python39-wheel +1 | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 | ALSA-2025:23530 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | python3.12 | 3.12.9-2.el10_0.2 | RLSA-2025:10140 |
| Rocky Linux 9 | python3.11 | 3.11.11-2.el9_6.1 | RLSA-2025:10148 |
| Rocky Linux 9 | python3.12 | 3.12.9-1.el9_6.1 | RLSA-2025:10189 |
| Rocky Linux 9 | python3.9 | 3.9.21-2.el9_6.1 | RLSA-2025:10136 |
| Rocky Linux 8 | Cython | 0.29.21-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | PyYAML | 5.4.1-1.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux 8 | mod_wsgi | 4.7.1-7.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | numpy | 1.19.4-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | pybind11 | 2.7.1-1.module+el8.9.0+1357+a3b80af7 | RLSA-2025:23530 |
| Rocky Linux 8 | pytest | 6.0.2-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-PyMySQL | 0.10.1-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-attrs | 20.3.0-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-cffi | 1.14.3-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-chardet | 3.0.4-19.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux 8 | python-cryptography | 3.3.1-3.module+el8.10.0+1697+7e517775 | RLSA-2025:23530 |
| Rocky Linux 8 | python-idna | 2.10-4.module+el8.10.0+1809+41195054 | RLSA-2025:23530 |
| Rocky Linux 8 | python-iniconfig | 1.1.1-2.module+el8.9.0+1332+dd574197 | RLSA-2025:23530 |
| Rocky Linux 8 | python-lxml | 4.6.5-1.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-more-itertools | 8.5.0-2.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-packaging | 20.4-4.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-pluggy | 0.13.1-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-ply | 3.11-10.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux 8 | python-psutil | 5.8.0-4.module+el8.9.0+1357+a3b80af7 | RLSA-2025:23530 |
| Rocky Linux 8 | python-psycopg2 | 2.8.6-3.module+el8.10.0+1660+b5b6f004 | RLSA-2025:23530 |
| Rocky Linux 8 | python-py | 1.10.0-1.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-pycparser | 2.20-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-pysocks | 1.7.1-4.module+el8.9.0+1418+f0d66789 | RLSA-2025:23530 |
| Rocky Linux 8 | python-requests | 2.25.0-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-toml | 0.10.1-5.module+el8.9.0+1332+dd574197 | RLSA-2025:23530 |
| Rocky Linux 8 | python-urllib3 | 1.25.10-5.module+el8.10.0+1545+03246da9 | RLSA-2025:23530 |
| Rocky Linux 8 | python-wcwidth | 0.2.5-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python-wheel | 1:0.35.1-4.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python3 | 3.6.8-70.el8_10.rocky.0 | RLSA-2025:10128 |
| Rocky Linux 8 | python3.11 | 3.11.13-1.el8_10 | RLSA-2025:10026 |
| Rocky Linux 8 | python3.12 | 3.12.11-1.el8_10 | RLSA-2025:10031 |
| Rocky Linux 8 | python3x-pip | 20.2.4-9.module+el8.10.0+1721+e52d6351 | RLSA-2025:23530 |
| Rocky Linux 8 | python3x-pyparsing | 2.4.7-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | python3x-setuptools | 50.3.2-7.module+el8.10.0+2057+30213a2b | RLSA-2025:23530 |
| Rocky Linux 8 | python3x-six | 1.15.0-3.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
| Rocky Linux 8 | scipy | 1.5.4-5.module+el8.10.0+1582+bc278001 | RLSA-2025:23530 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLES 15 SP7 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLES 15 SP7 | python311-core | 3.11.13-150600.3.30.1 | SUSE-SU-2025:02057-1 |
| SLES 15 SP6 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLES 15 SP6 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLES 15 SP6 | python311-core | 3.11.13-150600.3.30.1 | SUSE-SU-2025:02057-1 |
| SLES 15 SP6 | python312 +1 | 3.12.14-150600.3.68.1 | SUSE-SU-2026:4534-1 |
| SLES 15 SP5 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLES 15 SP5 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLES 15 SP5 | python311 +2 | 3.11.13-150400.9.60.1 | SUSE-SU-2025:02049-1 |
| SLES 15 SP5 | python39 +1 | 3.9.23-150300.4.75.1 | SUSE-SU-2025:02050-1 |
| SLES 15 SP4 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLES 15 SP4 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLES 15 SP4 | python310 +1 | 3.10.18-150400.4.82.1 | SUSE-SU-2025:02047-1 |
| SLES 15 SP4 | python311 +2 | 3.11.13-150400.9.60.1 | SUSE-SU-2025:02049-1 |
| SLES 15 SP3 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLES 15 SP3 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLES 15 SP3 | python39 +1 | 3.9.23-150300.4.75.1 | SUSE-SU-2025:02050-1 |
Show 19 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | python3 +1 | 3.4.10-25.169.1 | SUSE-SU-2026:0210-1 |
| SLES 12 SP5 | python36 +1 | 3.6.15-84.1 | SUSE-SU-2025:02297-1 |
| SLES 3 | python311 +1 | 3.11.13-150600.3.30.1 | SUSE-SU-2025:02057-1 |
| SLES 3 | python312 +1 | 3.12.11-150600.3.30.1 | SUSE-SU-2025:02048-1 |
| SLES 3 | python313 +1 | 3.13.5-150700.4.11.1 | SUSE-SU-2025:02074-1 |
| SLES for SAP 15 SP6 | python312 +1 | 3.12.14-150600.3.68.1 | SUSE-SU-2026:4534-1 |
| SLES for SAP 15 SP5 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLES for SAP 15 SP5 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLES for SAP 15 SP5 | python311 +2 | 3.11.13-150400.9.60.1 | SUSE-SU-2025:02049-1 |
| SLES for SAP 15 SP5 | python39 +1 | 3.9.23-150300.4.75.1 | SUSE-SU-2025:02050-1 |
| SLES for SAP 15 SP4 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLES for SAP 15 SP4 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLES for SAP 15 SP4 | python310 +1 | 3.10.18-150400.4.82.1 | SUSE-SU-2025:02047-1 |
| SLES for SAP 15 SP4 | python311 +2 | 3.11.13-150400.9.60.1 | SUSE-SU-2025:02049-1 |
| SLES for SAP 15 SP3 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLES for SAP 15 SP3 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLES for SAP 15 SP3 | python39 +1 | 3.9.23-150300.4.75.1 | SUSE-SU-2025:02050-1 |
| SLE Micro 6.1 | python311 +1 | 3.11.13-slfo.1.1_1.1 | SUSE-SU-2026:23743-1, SUSE-SU-2025:20539-1 |
| SLE Micro 6.0 | python311 +1 | 3.11.13-1.1 | SUSE-SU-2025:20492-1 |
| SLE Micro 5.5 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLE Micro 5.5 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLE Micro 5.4 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLE Micro 5.4 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLE Micro 5.3 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLE Micro 5.3 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLE Micro 5.2 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLE Micro 5.2 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLE Micro 5.1 | python3 +1 | 3.6.15-150000.3.182.1 | SUSE-SU-2025:02427-1 |
| SLE HPC 15 SP5 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLE HPC 15 SP5 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLE HPC 15 SP5 | python311 +2 | 3.11.13-150400.9.60.1 | SUSE-SU-2025:02049-1 |
| SLE HPC 15 SP4 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLE HPC 15 SP4 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLE HPC 15 SP4 | python310 +1 | 3.10.18-150400.4.82.1 | SUSE-SU-2025:02047-1 |
| SLE HPC 15 SP4 | python311 +2 | 3.11.13-150400.9.60.1 | SUSE-SU-2025:02049-1 |
| SLE HPC 15 SP3 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SLE HPC 15 SP3 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SLE HPC 15 SP3 | python39 +1 | 3.9.23-150300.4.75.1 | SUSE-SU-2025:02050-1 |
| SUSE Manager Server 4.3 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SUSE Manager Server 4.3 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SUSE Manager Proxy 4.3 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SUSE Manager Proxy 4.3 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SUSE Enterprise Storage 7.1 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| SUSE Enterprise Storage 7.1 | python3-core | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| SUSE Enterprise Storage 7.1 | python39 +1 | 3.9.23-150300.4.75.1 | SUSE-SU-2025:02050-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python310 | 3.10.18-3.1 | openSUSE-SU-2025:15285-1 |
| openSUSE Tumbleweed | python311 | 3.11.13-2.1 | openSUSE-SU-2025:15286-1 |
| openSUSE Tumbleweed | python312 | 3.12.11-2.1 | openSUSE-SU-2025:15287-1 |
| openSUSE Tumbleweed | python313 | 3.13.5-2.1 | openSUSE-SU-2025:15288-1 |
| openSUSE Tumbleweed | python39 | 3.9.23-3.1 | openSUSE-SU-2025:15290-1 |
| openSUSE Leap 15.6 | python3 | 3.6.15-150300.10.97.2 | SUSE-SU-2025:02778-1 |
| openSUSE Leap 15.6 | python3-core +1 | 3.6.15-150300.10.97.1 | SUSE-SU-2025:02778-1 |
| openSUSE Leap 15.6 | python310 +2 | 3.10.18-150400.4.82.1 | SUSE-SU-2025:02047-1 |
| openSUSE Leap 15.6 | python311 +2 | 3.11.13-150600.3.30.1 | SUSE-SU-2025:02057-1 |
| openSUSE Leap 15.6 | python312 +2 | 3.12.11-150600.3.30.1 | SUSE-SU-2025:02048-1 |
| openSUSE Leap 15.6 | python39 +2 | 3.9.23-150300.4.75.1 | SUSE-SU-2025:02050-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | python3 +1 | 3.12.11-r0 | — |
| Alpine v3.23 | python3 +1 | 3.12.11-r0 | — |
| Alpine v3.22 | python3 +1 | 3.12.11-r0 | — |
| Alpine v3.21 | python3 +1 | 3.12.11-r0 | — |
| Alpine v3.20 | python3 +1 | 3.12.11-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | python3 | 3.11.13-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3 +7 | 3.9.23-1.amzn2023.0.1 | ALAS2023-2025-1046 |
| Amazon Linux 2023 | python3.11 +6 | 3.11.13-1.amzn2023.0.1 | ALAS2023-2025-1045 |
| Amazon Linux 2023 | python3.12 +6 | 3.12.10-2.amzn2023.0.2 | ALAS2023-2025-1044 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | python3 | 3.9.19-14 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | python3 +7 | 3.12.9-2.0.1.el10_0.2 | ELSA-2025-10140 |
| Oracle Linux 9 | python3 +7 | 3.9.21-2.el9_6.1 | ELSA-2025-10136 |
| Oracle Linux 9 | python3.11 +6 | 3.11.11-2.el9_6.1 | ELSA-2025-10148 |
| Oracle Linux 9 | python3.12 +6 | 3.12.9-1.el9_6.1 | ELSA-2025-10189 |
| Oracle Linux 8 | python3-idle +6 | 3.6.8-70.0.1.el8_10 | ELSA-2025-10128 |
| Oracle Linux 8 | python3.11 +7 | 3.11.13-1.0.1.el8_10 | ELSA-2025-10026 |
| Oracle Linux 8 | python3.12 +7 | 3.12.11-1.el8_10 | ELSA-2025-10031 |
| Oracle Linux 8 | python39 +7 | 3.9.25-2.module+el8.10.0+90733+27f37730 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-Cython | 0.29.21-5.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-PyMySQL | 0.10.1-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-attrs | 20.3.0-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-cffi | 1.14.3-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-chardet | 3.0.4-19.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-cryptography | 3.3.1-3.0.1.module+el8.10.0+90269+2fa22b99 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-idna | 2.10-4.module+el8.10.0+90341+71ca88f4 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-iniconfig | 1.1.1-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-lxml | 4.6.5-1.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-mod_wsgi | 4.7.1-7.module+el8.10.0+90647+49247197.1 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-more-itertools | 8.5.0-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-numpy +2 | 1.19.4-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-packaging | 20.4-4.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pip +1 | 20.2.4-9.module+el8.10.0+90269+2fa22b99 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pluggy | 0.13.1-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-ply | 3.11-10.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-psutil | 5.8.0-4.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-psycopg2 +2 | 2.8.6-3.module+el8.10.0+90269+2fa22b99 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-py | 1.10.0-1.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pybind11 +1 | 2.7.1-1.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pycparser | 2.20-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pyparsing | 2.4.7-5.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pysocks | 1.7.1-4.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pytest | 6.0.2-2.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-pyyaml | 5.4.1-1.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-requests | 2.25.0-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-scipy | 1.5.4-5.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-setuptools +1 | 50.3.2-7.module+el8.10.0+90647+49247197 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-six | 1.15.0-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-toml | 0.10.1-5.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-urllib3 | 1.25.10-5.module+el8.10.0+90269+2fa22b99 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-wcwidth | 0.2.5-3.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
| Oracle Linux 8 | python39-wheel +1 | 1:0.35.1-4.module+el8.9.0+90016+9c2d6573 | ELSA-2025-23530 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | python-3.13 | 3.13.4-r0 | — |
Advisories 50
- WID-SEC-2026-3595 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- ALSA-2025:10136 Important: python3.9 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:10189 Important: python3.12 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:10148 Important: python3.11 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:10140 Important: python3.12 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:23530 Important: python39:3.9 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:10026 Important: python3.11 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:10031 Important: python3.12 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:10128 Important: python3 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2025-1231 Python: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 19, 2026
- RHSA-2026:38091 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:38090 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:38017 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:9918 Red Hat Security Advisory: python3.11 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:23530 Red Hat Security Advisory: python39:3.9 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:10602 Red Hat Security Advisory: python3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:10399 Red Hat Security Advisory: python3.9 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:10484 Red Hat Security Advisory: python3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:10189 Red Hat Security Advisory: python3.12 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:10148 Red Hat Security Advisory: python3.11 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:10136 Red Hat Security Advisory: python3.9 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:10140 Red Hat Security Advisory: python3.12 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:10128 Red Hat Security Advisory: python3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:10028 Red Hat Security Advisory: python3.12 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:10031 Red Hat Security Advisory: python3.12 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:10026 Red Hat Security Advisory: python3.11 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SUSE-SU-2026:4534-1 Security update for python312 SUSE / openSUSE Security Updates · Oct 6, 2026
- SUSE-SU-2026:23743-1 Security update for python311 SUSE / openSUSE Security Updates · Sep 27, 2026
- RLSA-2025:10128 Important: python3 security update Rocky Linux Security Advisories · May 21, 2026
- USN-7583-1 python3.13, python3.12 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2025:15290-1 python39-3.9.23-3.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15285-1 python310-3.10.18-3.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15286-1 python311-3.11.13-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15287-1 python312-3.12.11-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15288-1 python313-3.13.5-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0210-1 Security update for python3 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02427-1 Security update for python3 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02057-1 Security update for python311 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20492-1 Security update for python311 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20539-1 Security update for python311 SUSE / openSUSE Security Updates · Mar 23, 2026
- ICSA-26-043-06 Siemens SINEC OS CISA ICS & IT advisories · Feb 25, 2026
- SSA-089022 SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3 Siemens ProductCERT · Feb 24, 2026
- SUSE-SU-2025:02778-1 Security update for python3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02050-1 Security update for python39 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02048-1 Security update for python312 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02297-1 Security update for python36 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02047-1 Security update for python310 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02074-1 Security update for python313 SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2025-23530 Important: python39:3.9 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Dec 23, 2025
- RLSA-2025:23530 Important: python39:3.9 security update Rocky Linux Security Advisories · Dec 18, 2025
References
- https://github.com/python/cpython/issues/135034 issue-tracking
- https://github.com/python/cpython/pull/135037 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/ vendor-advisory
- https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a patch
- https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a patch
- https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f mitigation
- https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da patch
- https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 patch
- https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9 patch
- https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e patch
- https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a patch
- https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1 patch