SUSE-SU-2026:4174-1

This update for python39.SUSE_SLE-15-SP3_Update fixes the following issues:

Security issues fixed:

• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1274743).
• CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

Non security issues fixed:

• crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel, openssh, libssh and more packages (bsc#1211301).
• Update bundled pip wheels to pip-20.0.2-py2.py3-none-any.whl