Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python 3.5 packages risk crashes, cookie injection, tar errors
published 4 months ago
Summary
The Python 3.5 runtime and its standard libraries can be forced to stop working, allow specially crafted cookies to insert unwanted data, or misinterpret archive files, potentially leading to denial‑of‑service or data issues. These problems affect the core Python packages shipped by Canonical. Updating to the latest packages from the repository resolves the issues.
What to do
- Update canonical idle-python3.5 to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26.
- Update canonical libpython3.5 to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26.
- Update canonical libpython3.5-dev to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26.
- Update canonical libpython3.5-minimal to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26.
- Update canonical libpython3.5-stdlib to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26.
- Update canonical libpython3.5-testsuite to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26.
- Update canonical python3.5 to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26.
- Update canonical python3.5-dev to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26.
- Update canonical python3.5-doc to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26.
- Update canonical python3.5-examples to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26.
- Update canonical python3.5-minimal to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26.
- Update canonical python3.5-venv to version 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Ubuntu:16.04 | canonical | idle-python3.5 |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26
|
| TuxCare:Ubuntu:16.04 | canonical | libpython3.5 |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26
|
| TuxCare:Ubuntu:16.04 | canonical | libpython3.5-dev |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26
|
| TuxCare:Ubuntu:16.04 | canonical | libpython3.5-minimal |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26
|
| TuxCare:Ubuntu:16.04 | canonical | libpython3.5-stdlib |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26
|
| TuxCare:Ubuntu:16.04 | canonical | libpython3.5-testsuite |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26
|
| TuxCare:Ubuntu:16.04 | canonical | python3.5 |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26
|
| TuxCare:Ubuntu:16.04 | canonical | python3.5-dev |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26
|
| TuxCare:Ubuntu:16.04 | canonical | python3.5-doc |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26
|
| TuxCare:Ubuntu:16.04 | canonical | python3.5-examples |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26
|
| TuxCare:Ubuntu:16.04 | canonical | python3.5-minimal |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26
|
| TuxCare:Ubuntu:16.04 | canonical | python3.5-venv |
< 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26 Fix: upgrade to 1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26
|
Original advisory text
Fix CVE(s): CVE-2025-13462, CVE-2026-0672, CVE-2026-3644, CVE-2026-4224
* SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply
nested DTD content models
- debian/patches/CVE-2026-4224.patch: guard conv_content_model() in
Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to
bound recursion when a registered ElementDeclHandler converts a deeply
nested content model.
- CVE-2026-4224
* SECURITY UPDATE: HTTP header injection via control characters in cookies
- debian/patches/CVE-2026-0672.patch: add _has_control_character() and
reject control characters in Morsel.__setitem__()/setdefault()/set()
and BaseCookie.output() in Lib/http/cookies.py.
- CVE-2026-0672
* SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in
cookies via additional Morsel paths)
- debian/patches/CVE-2026-3644.patch: reject control characters in
Morsel.update(), Morsel.__setstate__() and Morsel.js_output() in
Lib/http/cookies.py.
- CVE-2026-3644
* SECURITY UPDATE: tarfile member type confusion (regular file parsed as
directory) via GNU long name/link headers
- debian/patches/CVE-2025-13462.patch: skip the AREGTYPE->DIRTYPE
normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up
headers (dircheck=False) in Lib/tarfile.py.
- CVE-2025-13462
nested DTD content models
- debian/patches/CVE-2026-4224.patch: guard conv_content_model() in
Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to
bound recursion when a registered ElementDeclHandler converts a deeply
nested content model.
- CVE-2026-4224
* SECURITY UPDATE: HTTP header injection via control characters in cookies
- debian/patches/CVE-2026-0672.patch: add _has_control_character() and
reject control characters in Morsel.__setitem__()/setdefault()/set()
and BaseCookie.output() in Lib/http/cookies.py.
- CVE-2026-0672
* SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in
cookies via additional Morsel paths)
- debian/patches/CVE-2026-3644.patch: reject control characters in
Morsel.update(), Morsel.__setstate__() and Morsel.js_output() in
Lib/http/cookies.py.
- CVE-2026-3644
* SECURITY UPDATE: tarfile member type confusion (regular file parsed as
directory) via GNU long name/link headers
- debian/patches/CVE-2025-13462.patch: skip the AREGTYPE->DIRTYPE
normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up
headers (dircheck=False) in Lib/tarfile.py.
- CVE-2025-13462
References
- https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1781173352.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-13462 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-0672 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-3644 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-4224 Vendor Advisory
Timeline
Published11 Jun 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1781173352 · OSV
Track software like this
Free during beta