CLSA-2026-1791486224
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1791486224.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1791486224
- Upstream
- Published
- 2026-10-19T14:29:35Z
- Modified
- 2026-10-26T09:43:42Z
- Summary
- python: Fix of 3 CVEs
- Details
-
- CVE-2026-82049: resolve a hard link's target with os.path.realpath() before creating the link, so extracting a hard link to a symlink stored deeper in the archive cannot relocate that symlink to a shallower path where its relative target escapes the destination directory
- CVE-2026-11940: re-filter the fallback member when hard link extraction falls back to extracting from the archive, and filter it under the link's own name, so a hard link to a deeper symlink cannot recreate that symlink at a shallower path outside the destination. Carries the CVE-2025-4330 fallback-filtering prerequisite (LinkFallbackError and makelink_with_filter), which this package did not have
- CVE-2025-4435: skip a member the extraction filter rejects instead of extracting it unfiltered when TarFile.errorlevel is 0
- References