CLSA-2026-1789900651
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1789900651.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789900651
- Upstream
CVE (2)
- Published
- 2026-09-20T10:37:43Z
- Modified
- 2026-10-26T09:31:53Z
- Summary
- Fix CVE(s): CVE-2026-11972, CVE-2026-9669
- Details
-
- SECURITY UPDATE: CPU denial-of-service in tarfile streaming mode via a
crafted archive that declares more blocks than it contains
- debian/patches/CVE-2026-11972.patch: in Lib/tarfile.py, break out of the block loop in _Stream.seek() once read() returns no data, so an archive opened in streaming mode (mode='r|') can no longer make parsing take exponentially longer by declaring a block count past end of file. Backport of upstream commit 3f031d431f80 (gh-151981 / GH-151982), taken unchanged from this package's amazonlinux2els branch where it was adapted for 3.7 by Qiantong Zhong zedzhong@amazon.com. Bundles the upstream regression test test_getmembers_big_size (test_tarfile.py).
- CVE-2026-11972
- SECURITY UPDATE: out-of-bounds stack write when a bz2 decompressor is
reused after a decompression error
- debian/patches/CVE-2026-9669.patch: in Modules/_bz2module.c, record
the libbz2 error code on BZ2Decompressor and raise ValueError on any
further decompress() call, so an application that catches the OSError
and retries with the same decompressor can no longer make it resume
from an invalid internal state and write out of bounds to a stack
buffer. Backport of upstream commit 938ec030e90c (gh-150599 /
GH-150600) via the 3.10 backport;
self->bzerror = 0;is placed by hand in _bz2_BZ2Decompressor___init___impl(), whose lock-allocation prologue differs in this version. Bundles the upstream regression test test_decompress_after_data_error (test_bz2.py). - CVE-2026-9669
- debian/patches/CVE-2026-9669.patch: in Modules/_bz2module.c, record
the libbz2 error code on BZ2Decompressor and raise ValueError on any
further decompress() call, so an application that catches the OSError
and retries with the same decompressor can no longer make it resume
from an invalid internal state and write out of bounds to a stack
buffer. Backport of upstream commit 938ec030e90c (gh-150599 /
GH-150600) via the 3.10 backport;
- SECURITY UPDATE: CPU denial-of-service in tarfile streaming mode via a
crafted archive that declares more blocks than it contains
- References