Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python 3 on CentOS allows file injection or archive escape
published 2 months ago
Summary
The Python 3 packages for CentOS Stream (including platform-python, platform-python-debug, platform-python-devel, python3-devel, and python3-idle) have been updated to stop malicious line endings from altering configuration files and to prevent crafted archive files from creating links outside the intended folder. If you are using these packages, install the latest updates to keep your systems safe from these possible attacks.
What to do
- Update centos-stream platform-python to version 3.6.8-62.el8.tuxcare.els17.
- Update centos-stream platform-python-debug to version 3.6.8-62.el8.tuxcare.els17.
- Update centos-stream platform-python-devel to version 3.6.8-62.el8.tuxcare.els17.
- Update centos-stream python3-devel to version 3.6.8-62.el8.tuxcare.els17.
- Update centos-stream python3-idle to version 3.6.8-62.el8.tuxcare.els17.
- Update centos-stream python3-libs to version 3.6.8-62.el8.tuxcare.els17.
- Update centos-stream python3-test to version 3.6.8-62.el8.tuxcare.els17.
- Update centos-stream python3-tkinter to version 3.6.8-62.el8.tuxcare.els17.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS-Stream:8 | centos-stream | platform-python |
< 3.6.8-62.el8.tuxcare.els17 Fix: upgrade to 3.6.8-62.el8.tuxcare.els17
|
| TuxCare:CentOS-Stream:8 | centos-stream | platform-python-debug |
< 3.6.8-62.el8.tuxcare.els17 Fix: upgrade to 3.6.8-62.el8.tuxcare.els17
|
| TuxCare:CentOS-Stream:8 | centos-stream | platform-python-devel |
< 3.6.8-62.el8.tuxcare.els17 Fix: upgrade to 3.6.8-62.el8.tuxcare.els17
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-devel |
< 3.6.8-62.el8.tuxcare.els17 Fix: upgrade to 3.6.8-62.el8.tuxcare.els17
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-idle |
< 3.6.8-62.el8.tuxcare.els17 Fix: upgrade to 3.6.8-62.el8.tuxcare.els17
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-libs |
< 3.6.8-62.el8.tuxcare.els17 Fix: upgrade to 3.6.8-62.el8.tuxcare.els17
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-test |
< 3.6.8-62.el8.tuxcare.els17 Fix: upgrade to 3.6.8-62.el8.tuxcare.els17
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-tkinter |
< 3.6.8-62.el8.tuxcare.els17 Fix: upgrade to 3.6.8-62.el8.tuxcare.els17
|
Original advisory text
python3: Fix of 2 CVEs
- CVE-2026-0864: normalize CR and CRLF line endings when writing multi-line
configparser values, preventing config-file injection
- CVE-2026-11940: re-filter the hardlink-extraction fallback at the link
member's own path so a crafted archive cannot create a symlink outside
the destination directory
configparser values, preventing config-file injection
- CVE-2026-11940: re-filter the hardlink-extraction fallback at the link
member's own path so a crafted archive cannot create a symlink outside
the destination directory
References
- https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1787647735.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-0864 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-11940 Vendor Advisory
Timeline
Published25 Aug 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1787647735 · OSV
Track software like this
Free during beta