Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python 2 on CentOS can hang during tar extraction
published 1 month ago
Summary
CentOS packages for Python 2 may get stuck when processing a specially crafted tar file that declares an extremely large size, causing the program to loop indefinitely. The same packages also prevent a compression routine from being reused after an error, avoiding potential data corruption. Update the Python 2 packages from the CentOS repositories to the latest released versions to apply the fixes.
What to do
- Update centos python2 to version 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27.
- Update centos python2-debug to version 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27.
- Update centos python2-devel to version 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27.
- Update centos python2-libs to version 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27.
- Update centos python2-test to version 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27.
- Update centos python2-tkinter to version 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27.
- Update centos python2-tools to version 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:8.5 | centos | python2 |
< 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27 Fix: upgrade to 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27
|
| TuxCare:CentOS:8.5 | centos | python2-debug |
< 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27 Fix: upgrade to 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27
|
| TuxCare:CentOS:8.5 | centos | python2-devel |
< 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27 Fix: upgrade to 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27
|
| TuxCare:CentOS:8.5 | centos | python2-libs |
< 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27 Fix: upgrade to 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27
|
| TuxCare:CentOS:8.5 | centos | python2-test |
< 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27 Fix: upgrade to 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27
|
| TuxCare:CentOS:8.5 | centos | python2-tkinter |
< 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27 Fix: upgrade to 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27
|
| TuxCare:CentOS:8.5 | centos | python2-tools |
< 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27 Fix: upgrade to 2.7.18-7.module_el8.5.0+2572+feb7e0cc.tuxcare.els27
|
Original advisory text
python2: Fix of 2 CVEs
- CVE-2026-11972: break out of the block loop in tarfile._Stream.seek as soon
as read() returns no data, so a member header declaring a huge size can no
longer keep a stream-mode archive spinning until it is interrupted
- CVE-2026-9669: latch the libbz2 error code in BZ2Decomp_decompress and raise
ValueError on any later call, so a BZ2Decompressor cannot be re-entered
after a decompression error and write outside its output buffer; the same
error is latched on BZ2FileObject through the new Util_BzRead wrapper, so a
BZ2File whose stream already errored re-reports that IOError on every later
read instead of re-entering BZ2_bzDecompress
as read() returns no data, so a member header declaring a huge size can no
longer keep a stream-mode archive spinning until it is interrupted
- CVE-2026-9669: latch the libbz2 error code in BZ2Decomp_decompress and raise
ValueError on any later call, so a BZ2Decompressor cannot be re-entered
after a decompression error and write outside its output buffer; the same
error is latched on BZ2FileObject through the new Util_BzRead wrapper, so a
BZ2File whose stream already errored re-reports that IOError on every later
read instead of re-entering BZ2_bzDecompress
References
- https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1789993180.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-11972 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9669 Vendor Advisory
Timeline
Published21 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1789993180 · OSV
Track software like this
Free during beta