USN-7979-1

It was discovered that jaraco.context incorrectly handled certain zip file paths. An attacker could possibly use this issue to extract arbitrary files outside of the intented extraction directory.

References

Affected packages

Ubuntu:25.10 / jaraco.context

Package

Name: jaraco.context
Purl: pkg:deb/ubuntu/jaraco.context@6.0.1-1ubuntu0.1?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.0.1-1ubuntu0.1

Affected versions

6.*

6.0.1-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "6.0.1-1ubuntu0.1",
            "binary_name": "python3-jaraco.context"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7979-1.json"

cves_map

{
    "cves": [
        {
            "id": "CVE-2026-23949",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:25.10"
}