Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python on CentOS allows config injection when writing files
published 1 month ago
Summary
The Python packages for CentOS (python, python-devel, python-libs, python-test, python-tools) could let an attacker add unexpected configuration keys by inserting a carriage return in a value. This could alter how applications read their settings. Install the updated Python packages from the CentOS repository to apply the fix.
What to do
- Update centos python to version 2.6.6-70.el6.tuxcare.els29.
- Update centos python-devel to version 2.6.6-70.el6.tuxcare.els29.
- Update centos python-libs to version 2.6.6-70.el6.tuxcare.els29.
- Update centos python-test to version 2.6.6-70.el6.tuxcare.els29.
- Update centos python-tools to version 2.6.6-70.el6.tuxcare.els29.
- Update centos tkinter to version 2.6.6-70.el6.tuxcare.els29.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:6 | centos | python |
< 2.6.6-70.el6.tuxcare.els29 Fix: upgrade to 2.6.6-70.el6.tuxcare.els29
|
| TuxCare:CentOS:6 | centos | python-devel |
< 2.6.6-70.el6.tuxcare.els29 Fix: upgrade to 2.6.6-70.el6.tuxcare.els29
|
| TuxCare:CentOS:6 | centos | python-libs |
< 2.6.6-70.el6.tuxcare.els29 Fix: upgrade to 2.6.6-70.el6.tuxcare.els29
|
| TuxCare:CentOS:6 | centos | python-test |
< 2.6.6-70.el6.tuxcare.els29 Fix: upgrade to 2.6.6-70.el6.tuxcare.els29
|
| TuxCare:CentOS:6 | centos | python-tools |
< 2.6.6-70.el6.tuxcare.els29 Fix: upgrade to 2.6.6-70.el6.tuxcare.els29
|
| TuxCare:CentOS:6 | centos | tkinter |
< 2.6.6-70.el6.tuxcare.els29 Fix: upgrade to 2.6.6-70.el6.tuxcare.els29
|
Original advisory text
python: Fix of CVE-2026-0864
- CVE-2026-0864: fix configuration injection in the ConfigParser module by
normalizing all line endings (CR, CRLF and LF) to LF+TAB when writing
multi-line values, so a carriage return in an attacker-controlled value
can no longer inject unexpected keys and values into the written file
normalizing all line endings (CR, CRLF and LF) to LF+TAB when writing
multi-line values, so a carriage return in an attacker-controlled value
can no longer inject unexpected keys and values into the written file
References
- https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1788794443.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-0864 Vendor Advisory
Timeline
Published7 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1788794443 · OSV
Track software like this
Free during beta