CLSA-2026-1783705997

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1783705997.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1783705997
Upstream
CVE (4)
Published
2026-07-11T16:58:40Z
Modified
2026-10-26T09:43:16Z
Summary
python: Fix of 3 CVEs
Details
  • CVE-2026-0672: reject control characters in the Cookie module - add the _has_control_character() helper and validate in Morsel.setitem, Morsel.setdefault(), Morsel.set() and BaseCookie.output(). Applied as the prerequisite for CVE-2026-3644; Python 2.7.5 shipped neither fix.
  • CVE-2026-3644: reject control characters in Morsel.update(), the unpickling path (Morsel.setstate) and Morsel.js_output().
  • CVE-2026-4224: guard conv_content_model() in pyexpat with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() to avoid a C stack overflow when parsing a deeply nested content model in an inline DTD with a registered ElementDeclHandler.
  • CVE-2025-13462: skip the old-v7 AREGTYPE -> DIRTYPE normalization in tarfile when reading a follow-up header (GNU long name/link or PAX extended header), so crafted multi-block members are no longer misinterpreted.
References

Affected packages

TuxCare:CentOS:7
python

Package

Name
python
Purl
pkg:rpm/tuxcare/python?distro=centos-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els11

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1783705997.json"
python-debug

Package

Name
python-debug
Purl
pkg:rpm/tuxcare/python-debug?distro=centos-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els11

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1783705997.json"
python-devel

Package

Name
python-devel
Purl
pkg:rpm/tuxcare/python-devel?distro=centos-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els11

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1783705997.json"
python-libs

Package

Name
python-libs
Purl
pkg:rpm/tuxcare/python-libs?distro=centos-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els11

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1783705997.json"
python-test

Package

Name
python-test
Purl
pkg:rpm/tuxcare/python-test?distro=centos-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els11

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1783705997.json"
python-tools

Package

Name
python-tools
Purl
pkg:rpm/tuxcare/python-tools?distro=centos-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els11

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1783705997.json"
tkinter

Package

Name
tkinter
Purl
pkg:rpm/tuxcare/tkinter?distro=centos-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els11

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1783705997.json"