Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python 3.5 config files can be altered with crafted input
published 2 months ago
Summary
The configparser component used by Python 3.5 on Ubuntu can treat line breaks incorrectly, letting an attacker add extra settings when a specially crafted multi-line value is saved. This could let an attacker change configuration files and potentially affect program behavior. Update the affected Python 3.5 packages to the latest version that normalizes line endings to fix the problem.
What to do
- Update canonical idle-python3.5 to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29.
- Update canonical libpython3.5 to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29.
- Update canonical libpython3.5-dev to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29.
- Update canonical libpython3.5-minimal to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29.
- Update canonical libpython3.5-stdlib to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29.
- Update canonical libpython3.5-testsuite to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29.
- Update canonical python3.5 to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29.
- Update canonical python3.5-dev to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29.
- Update canonical python3.5-doc to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29.
- Update canonical python3.5-examples to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29.
- Update canonical python3.5-minimal to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29.
- Update canonical python3.5-venv to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Ubuntu:16.04 | canonical | idle-python3.5 |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29
|
| TuxCare:Ubuntu:16.04 | canonical | libpython3.5 |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29
|
| TuxCare:Ubuntu:16.04 | canonical | libpython3.5-dev |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29
|
| TuxCare:Ubuntu:16.04 | canonical | libpython3.5-minimal |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29
|
| TuxCare:Ubuntu:16.04 | canonical | libpython3.5-stdlib |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29
|
| TuxCare:Ubuntu:16.04 | canonical | libpython3.5-testsuite |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29
|
| TuxCare:Ubuntu:16.04 | canonical | python3.5 |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29
|
| TuxCare:Ubuntu:16.04 | canonical | python3.5-dev |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29
|
| TuxCare:Ubuntu:16.04 | canonical | python3.5-doc |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29
|
| TuxCare:Ubuntu:16.04 | canonical | python3.5-examples |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29
|
| TuxCare:Ubuntu:16.04 | canonical | python3.5-minimal |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29
|
| TuxCare:Ubuntu:16.04 | canonical | python3.5-venv |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els29
|
Original advisory text
Fix CVE(s): CVE-2026-0864
* SECURITY UPDATE: configuration-file injection in the configparser module
when writing multi-line values containing carriage returns
- debian/patches/CVE-2026-0864.patch: normalize CRLF and bare CR to LF
before applying the '\n' -> '\n\t' continuation escape in
_write_section() in Lib/configparser.py, so an attacker-controlled
value can no longer inject additional keys and values into the written
file; adds the upstream regression test test_crlf_normalization to
Lib/test/test_configparser.py.
- CVE-2026-0864
when writing multi-line values containing carriage returns
- debian/patches/CVE-2026-0864.patch: normalize CRLF and bare CR to LF
before applying the '\n' -> '\n\t' continuation escape in
_write_section() in Lib/configparser.py, so an attacker-controlled
value can no longer inject additional keys and values into the written
file; adds the upstream regression test test_crlf_normalization to
Lib/test/test_configparser.py.
- CVE-2026-0864
References
- https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1787648497.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-0864 Vendor Advisory
Timeline
Published25 Aug 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1787648497 · OSV
Track software like this
Free during beta