Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python 3 on CentOS Stream may treat long file names as directories
published 4 months ago
Summary
The Python 3 packages for CentOS Stream can misread archive files that contain very long names, mistakenly thinking a regular file is a folder. This could cause scripts that extract such archives to fail or handle data incorrectly. Updating the Python 3 packages to the latest version resolves the issue.
What to do
- Update centos-stream platform-python to version 3.6.8-62.el8.tuxcare.els13.
- Update centos-stream platform-python-debug to version 3.6.8-62.el8.tuxcare.els13.
- Update centos-stream platform-python-devel to version 3.6.8-62.el8.tuxcare.els13.
- Update centos-stream python3-devel to version 3.6.8-62.el8.tuxcare.els13.
- Update centos-stream python3-idle to version 3.6.8-62.el8.tuxcare.els13.
- Update centos-stream python3-libs to version 3.6.8-62.el8.tuxcare.els13.
- Update centos-stream python3-test to version 3.6.8-62.el8.tuxcare.els13.
- Update centos-stream python3-tkinter to version 3.6.8-62.el8.tuxcare.els13.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS-Stream:8 | centos-stream | platform-python |
< 3.6.8-62.el8.tuxcare.els13 Fix: upgrade to 3.6.8-62.el8.tuxcare.els13
|
| TuxCare:CentOS-Stream:8 | centos-stream | platform-python-debug |
< 3.6.8-62.el8.tuxcare.els13 Fix: upgrade to 3.6.8-62.el8.tuxcare.els13
|
| TuxCare:CentOS-Stream:8 | centos-stream | platform-python-devel |
< 3.6.8-62.el8.tuxcare.els13 Fix: upgrade to 3.6.8-62.el8.tuxcare.els13
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-devel |
< 3.6.8-62.el8.tuxcare.els13 Fix: upgrade to 3.6.8-62.el8.tuxcare.els13
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-idle |
< 3.6.8-62.el8.tuxcare.els13 Fix: upgrade to 3.6.8-62.el8.tuxcare.els13
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-libs |
< 3.6.8-62.el8.tuxcare.els13 Fix: upgrade to 3.6.8-62.el8.tuxcare.els13
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-test |
< 3.6.8-62.el8.tuxcare.els13 Fix: upgrade to 3.6.8-62.el8.tuxcare.els13
|
| TuxCare:CentOS-Stream:8 | centos-stream | python3-tkinter |
< 3.6.8-62.el8.tuxcare.els13 Fix: upgrade to 3.6.8-62.el8.tuxcare.els13
|
Original advisory text
python3: Fix of CVE-2025-13462
- CVE-2025-13462: tarfile: skip AREGTYPE->DIRTYPE normalization while reading
GNU LONGNAME/LONGLINK and PAX follow-up headers, so a longname regular file
is not misparsed as a directory
GNU LONGNAME/LONGLINK and PAX follow-up headers, so a longname regular file
is not misparsed as a directory
References
- https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1781082676.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-13462 Vendor Advisory
Timeline
Published10 Jun 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1781082676 · OSV
Track software like this
Free during beta