Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python 2.7 tar reading can cause extreme slowdown
published 1 month ago
Summary
The Python 2.7 libraries used on Ubuntu can spend a very long time processing specially crafted tar archives that claim data beyond the end of the file. This can make scripts that read such archives hang or become unresponsive, affecting any application that uses the tarfile module. Updating the listed Python 2.7 packages to the latest version resolves the issue.
What to do
- Update canonical idle-python2.7 to version 2.7.12-1ubuntu0~16.04.18+tuxcare.els25.
- Update canonical libpython2.7 to version 2.7.12-1ubuntu0~16.04.18+tuxcare.els25.
- Update canonical libpython2.7-dev to version 2.7.12-1ubuntu0~16.04.18+tuxcare.els25.
- Update canonical libpython2.7-minimal to version 2.7.12-1ubuntu0~16.04.18+tuxcare.els25.
- Update canonical libpython2.7-stdlib to version 2.7.12-1ubuntu0~16.04.18+tuxcare.els25.
- Update canonical libpython2.7-testsuite to version 2.7.12-1ubuntu0~16.04.18+tuxcare.els25.
- Update canonical python2.7 to version 2.7.12-1ubuntu0~16.04.18+tuxcare.els25.
- Update canonical python2.7-dev to version 2.7.12-1ubuntu0~16.04.18+tuxcare.els25.
- Update canonical python2.7-doc to version 2.7.12-1ubuntu0~16.04.18+tuxcare.els25.
- Update canonical python2.7-examples to version 2.7.12-1ubuntu0~16.04.18+tuxcare.els25.
- Update canonical python2.7-minimal to version 2.7.12-1ubuntu0~16.04.18+tuxcare.els25.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Ubuntu:16.04 | canonical | idle-python2.7 |
< 2.7.12-1ubuntu0~16.04.18+tuxcare.els25 Fix: upgrade to 2.7.12-1ubuntu0~16.04.18+tuxcare.els25
|
| TuxCare:Ubuntu:16.04 | canonical | libpython2.7 |
< 2.7.12-1ubuntu0~16.04.18+tuxcare.els25 Fix: upgrade to 2.7.12-1ubuntu0~16.04.18+tuxcare.els25
|
| TuxCare:Ubuntu:16.04 | canonical | libpython2.7-dev |
< 2.7.12-1ubuntu0~16.04.18+tuxcare.els25 Fix: upgrade to 2.7.12-1ubuntu0~16.04.18+tuxcare.els25
|
| TuxCare:Ubuntu:16.04 | canonical | libpython2.7-minimal |
< 2.7.12-1ubuntu0~16.04.18+tuxcare.els25 Fix: upgrade to 2.7.12-1ubuntu0~16.04.18+tuxcare.els25
|
| TuxCare:Ubuntu:16.04 | canonical | libpython2.7-stdlib |
< 2.7.12-1ubuntu0~16.04.18+tuxcare.els25 Fix: upgrade to 2.7.12-1ubuntu0~16.04.18+tuxcare.els25
|
| TuxCare:Ubuntu:16.04 | canonical | libpython2.7-testsuite |
< 2.7.12-1ubuntu0~16.04.18+tuxcare.els25 Fix: upgrade to 2.7.12-1ubuntu0~16.04.18+tuxcare.els25
|
| TuxCare:Ubuntu:16.04 | canonical | python2.7 |
< 2.7.12-1ubuntu0~16.04.18+tuxcare.els25 Fix: upgrade to 2.7.12-1ubuntu0~16.04.18+tuxcare.els25
|
| TuxCare:Ubuntu:16.04 | canonical | python2.7-dev |
< 2.7.12-1ubuntu0~16.04.18+tuxcare.els25 Fix: upgrade to 2.7.12-1ubuntu0~16.04.18+tuxcare.els25
|
| TuxCare:Ubuntu:16.04 | canonical | python2.7-doc |
< 2.7.12-1ubuntu0~16.04.18+tuxcare.els25 Fix: upgrade to 2.7.12-1ubuntu0~16.04.18+tuxcare.els25
|
| TuxCare:Ubuntu:16.04 | canonical | python2.7-examples |
< 2.7.12-1ubuntu0~16.04.18+tuxcare.els25 Fix: upgrade to 2.7.12-1ubuntu0~16.04.18+tuxcare.els25
|
| TuxCare:Ubuntu:16.04 | canonical | python2.7-minimal |
< 2.7.12-1ubuntu0~16.04.18+tuxcare.els25 Fix: upgrade to 2.7.12-1ubuntu0~16.04.18+tuxcare.els25
|
Original advisory text
Fix CVE(s): CVE-2026-11972
* SECURITY UPDATE: quadratic parse time in the tarfile module when a
streaming archive declares an offset past the end of the stream
- debian/patches/CVE-2026-11972.patch: stop the forward-seek loop in
_Stream.seek() as soon as read() returns no data, in Lib/tarfile.py,
so a crafted mode="r|" archive can no longer keep the parser reading
an exhausted stream.
- CVE-2026-11972
streaming archive declares an offset past the end of the stream
- debian/patches/CVE-2026-11972.patch: stop the forward-seek loop in
_Stream.seek() as soon as read() returns no data, in Lib/tarfile.py,
so a crafted mode="r|" archive can no longer keep the parser reading
an exhausted stream.
- CVE-2026-11972
References
- https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1789723233.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-11972 Vendor Advisory
Timeline
Published18 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1789723233 · OSV
Track software like this
Free during beta