Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python packages can cause system slowdown and data issues
published 22 days ago
Summary
The Python packages provided by SUSE (python, python-base, python-doc) contain several bugs that could let a malicious file consume excessive CPU, cause crashes, or write files to the wrong location. This can affect the stability of applications that process XML, URLs, CSV files, or archive files. Install the latest Python update from SUSE to fix these problems.
What to do
- Update suse python to version 2.7.18-33.88.1.
- Update suse python-base to version 2.7.18-33.88.1.
- Update suse python-doc to version 2.7.18-33.88.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | suse | python |
< 2.7.18-33.88.1 Fix: upgrade to 2.7.18-33.88.1
|
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | suse | python-base |
< 2.7.18-33.88.1 Fix: upgrade to 2.7.18-33.88.1
|
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | suse | python-doc |
< 2.7.18-33.88.1 Fix: upgrade to 2.7.18-33.88.1
|
Original advisory text
Security update for python
This update for python fixes the following issues:
- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high
CPU usage (bsc#1273148).
- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect
sniffing and consume significant CPU (bsc#1274683).
- CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for
members whose name leaves the destination and retu (bsc#1276227).
Changes for python:
- Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)
- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high
CPU usage (bsc#1273148).
- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect
sniffing and consume significant CPU (bsc#1274683).
- CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for
members whose name leaves the destination and retu (bsc#1276227).
Changes for python:
- Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20264633-1/ Vendor Advisory
- https://bugzilla.suse.com/1267974 Third Party Advisory
- https://bugzilla.suse.com/1273148 Third Party Advisory
- https://bugzilla.suse.com/1274683 Third Party Advisory
- https://bugzilla.suse.com/1276223 Third Party Advisory
- https://bugzilla.suse.com/1276226 Third Party Advisory
- https://bugzilla.suse.com/1276227 Third Party Advisory
- https://bugzilla.suse.com/1276903 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-15806 URL
- https://www.suse.com/security/cve/CVE-2026-17084 URL
- https://www.suse.com/security/cve/CVE-2026-18503 URL
- https://www.suse.com/security/cve/CVE-2026-19672 URL
- https://www.suse.com/security/cve/CVE-2026-6879 URL
- https://www.suse.com/security/cve/CVE-2026-9669 URL
Timeline
Published13 Oct 2026
Updated13 Oct 2026
First seen13 Oct 2026
Sources
SUSE-SU-2026:4633-1 · OSV
Track software like this
Free during beta