Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python 3.11 may allow config injection via line endings
published 2 months ago
Summary
The Python 3.11 packages for AlmaLinux (including the standard, debug, development, IDLE, and libraries versions) could write configuration files with inconsistent line endings, letting an attacker alter settings when the file is read later. Updating to the latest Python 3.11 release ensures all line endings are normalized, removing the injection risk. Apply the latest package updates as soon as possible.
What to do
- Update almalinux python3.11 to version 3.11.11-2.el9_6.2.tuxcare.els16.
- Update almalinux python3.11-debug to version 3.11.11-2.el9_6.2.tuxcare.els16.
- Update almalinux python3.11-devel to version 3.11.11-2.el9_6.2.tuxcare.els16.
- Update almalinux python3.11-idle to version 3.11.11-2.el9_6.2.tuxcare.els16.
- Update almalinux python3.11-libs to version 3.11.11-2.el9_6.2.tuxcare.els16.
- Update almalinux python3.11-test to version 3.11.11-2.el9_6.2.tuxcare.els16.
- Update almalinux python3.11-tkinter to version 3.11.11-2.el9_6.2.tuxcare.els16.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.6 | almalinux | python3.11 |
< 3.11.11-2.el9_6.2.tuxcare.els16 Fix: upgrade to 3.11.11-2.el9_6.2.tuxcare.els16
|
| TuxCare:AlmaLinux:9.6 | almalinux | python3.11-debug |
< 3.11.11-2.el9_6.2.tuxcare.els16 Fix: upgrade to 3.11.11-2.el9_6.2.tuxcare.els16
|
| TuxCare:AlmaLinux:9.6 | almalinux | python3.11-devel |
< 3.11.11-2.el9_6.2.tuxcare.els16 Fix: upgrade to 3.11.11-2.el9_6.2.tuxcare.els16
|
| TuxCare:AlmaLinux:9.6 | almalinux | python3.11-idle |
< 3.11.11-2.el9_6.2.tuxcare.els16 Fix: upgrade to 3.11.11-2.el9_6.2.tuxcare.els16
|
| TuxCare:AlmaLinux:9.6 | almalinux | python3.11-libs |
< 3.11.11-2.el9_6.2.tuxcare.els16 Fix: upgrade to 3.11.11-2.el9_6.2.tuxcare.els16
|
| TuxCare:AlmaLinux:9.6 | almalinux | python3.11-test |
< 3.11.11-2.el9_6.2.tuxcare.els16 Fix: upgrade to 3.11.11-2.el9_6.2.tuxcare.els16
|
| TuxCare:AlmaLinux:9.6 | almalinux | python3.11-tkinter |
< 3.11.11-2.el9_6.2.tuxcare.els16 Fix: upgrade to 3.11.11-2.el9_6.2.tuxcare.els16
|
Original advisory text
python3.11: Fix of CVE-2026-0864
- CVE-2026-0864: normalize all line endings (CR, CRLF, and LF) when writing
multi-line configparser values to prevent configuration injection
multi-line configparser values to prevent configuration injection
References
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787312520.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-0864 Vendor Advisory
Timeline
Published25 Aug 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1787312520 · OSV
Track software like this
Free during beta