{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: tarfile AREGTYPE->DIRTYPE misnormalization of multi-block member headers\n - debian/patches/CVE-2025-13462.patch: in Lib/tarfile.py, add a dircheck flag to\n frombuf()/fromtarfile() and read the follow-up header of GNU long-name and PAX\n multi-block members with dircheck=False in _proc_gnulong()/_proc_pax(), so the old-V7\n \"AREGTYPE name ending in / is a directory\" normalization is no longer applied to a\n follow-up header based on its truncated name. Prevents a crafted tar archive from being\n interpreted differently by tarfile than by other tools. Backport of upstream commit\n 42d754e34c (gh-141707), the same fix shipped by Debian in DLA-4583-1; applies to 3.7.3\n without code changes (the affected functions are structurally identical). Bundles the\n upstream regression test test_longname_file_not_directory (test_tarfile.py).\n - CVE-2025-13462\n * SECURITY UPDATE: C stack overflow in pyexpat via deeply nested DTD content model\n - debian/patches/CVE-2026-4224.patch: guard the recursion in Modules/pyexpat.c\n conv_content_model() with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() so a deeply\n nested inline DTD content model parsed by an Expat parser with a registered\n ElementDeclHandler raises RecursionError instead of crashing the interpreter. Adapted\n from upstream commit eb0e8be3a7 (gh-145986); upstream uses the private\n _Py_EnterRecursiveCall() API, replaced here with the equivalent public 3.7 macros. The\n upstream regression test is not bundled (it needs 3.7-absent test.support helpers and a\n 500000-deep model); the fix was verified manually.\n - CVE-2026-4224\n * SECURITY UPDATE: control-character injection in http.cookies (HTTP response splitting)\n - debian/patches/CVE-2026-3644.patch: reject control characters (\\x00-\\x1F, \\x7F) in\n Lib/http/cookies.py across all Morsel/BaseCookie paths via a new _has_control_character()\n helper. CVE-2026-3644 is the incomplete-fix follow-up to CVE-2026-0672 and its upstream\n fix (commit 57e88c1cf9, gh-145599) depends on the helper introduced by the CVE-2026-0672\n base commit (95746b3a13, gh-143919). 3.7.3 shipped neither fix, so this patch bundles both:\n the base validation in Morsel.__setitem__/setdefault/set and BaseCookie.output, plus the\n follow-up validation in Morsel.update/__setstate__ and BaseCookie.js_output.\n Also closes CVE-2026-0672. The upstream Morsel.__ior__ override is omitted: it only exists\n to neutralize dict.__ior__ (PEP 584, Python 3.9+), which 3.7 does not have, so there is no\n |= bypass to close. The module docstring doctest and the test_basic keebler fixture in\n test_http_cookies.py are updated to drop a \\012 control character now rejected by load(),\n and the upstream regression tests test_control_characters/test_control_characters_output\n are bundled with the test.support.control_characters_c0() helper they require.\n - CVE-2026-3644", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1781259901", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1781259901" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/debian10els/advisories/2026/clsa-2026_1781259901.json" } ], "tracking": { "current_release_date": "2026-06-12T10:34:57Z", "generator": { "date": "2026-06-12T10:34:57Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1781259901", "initial_release_date": "2026-06-12T10:34:57Z", "revision_history": [ { "date": "2026-06-12T10:34:57Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix CVE(s): CVE-2025-13462, CVE-2026-3644, CVE-2026-4224, CVE-2026-7210" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 10", "product": { "name": "Debian 10", "product_id": "Debian-10", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:10:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "product": { "name": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "product_id": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-doc@3.7.3-2%2Bdeb10u7%2Btuxcare.els5?arch=all" } } }, { "category": "product_version", "name": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "product": { "name": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "product_id": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/idle-python3.7@3.7.3-2%2Bdeb10u7%2Btuxcare.els5?arch=all" } } }, { "category": "product_version", "name": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "product": { "name": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "product_id": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7-testsuite@3.7.3-2%2Bdeb10u7%2Btuxcare.els5?arch=all" } } }, { "category": "product_version", "name": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "product": { "name": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "product_id": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-examples@3.7.3-2%2Bdeb10u7%2Btuxcare.els5?arch=all" } } }, { "category": "product_version", "name": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all", "product": { "name": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all", "product_id": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7-testsuite@3.7.3-2%2Bdeb10u7%2Btuxcare.els3?arch=all" } } }, { "category": "product_version", "name": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all", "product": { "name": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all", "product_id": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/idle-python3.7@3.7.3-2%2Bdeb10u7%2Btuxcare.els3?arch=all" } } }, { "category": "product_version", "name": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all", "product": { "name": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all", "product_id": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-doc@3.7.3-2%2Bdeb10u7%2Btuxcare.els3?arch=all" } } }, { "category": "product_version", "name": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all", "product": { "name": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all", "product_id": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-examples@3.7.3-2%2Bdeb10u7%2Btuxcare.els3?arch=all" } } }, { "category": "product_version", "name": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all", "product": { "name": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all", "product_id": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-examples@3.7.3-2%2Bdeb10u7%2Btuxcare.els2?arch=all" } } }, { "category": "product_version", "name": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all", "product": { "name": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all", "product_id": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/idle-python3.7@3.7.3-2%2Bdeb10u7%2Btuxcare.els2?arch=all" } } }, { "category": "product_version", "name": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all", "product": { "name": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all", "product_id": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-doc@3.7.3-2%2Bdeb10u7%2Btuxcare.els2?arch=all" } } }, { "category": "product_version", "name": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all", "product": { "name": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all", "product_id": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7-testsuite@3.7.3-2%2Bdeb10u7%2Btuxcare.els2?arch=all" } } } ], "category": "architecture", "name": "all" }, { "branches": [ { "category": "product_version", "name": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product": { "name": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_id": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-dev@3.7.3-2%2Bdeb10u7%2Btuxcare.els5?arch=amd64" } } }, { "category": "product_version", "name": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product": { "name": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_id": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7@3.7.3-2%2Bdeb10u7%2Btuxcare.els5?arch=amd64" } } }, { "category": "product_version", "name": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product": { "name": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_id": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7-stdlib@3.7.3-2%2Bdeb10u7%2Btuxcare.els5?arch=amd64" } } }, { "category": "product_version", "name": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product": { "name": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_id": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-minimal@3.7.3-2%2Bdeb10u7%2Btuxcare.els5?arch=amd64" } } }, { "category": "product_version", "name": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product": { "name": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_id": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7-dev@3.7.3-2%2Bdeb10u7%2Btuxcare.els5?arch=amd64" } } }, { "category": "product_version", "name": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product": { "name": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_id": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-venv@3.7.3-2%2Bdeb10u7%2Btuxcare.els5?arch=amd64" } } }, { "category": "product_version", "name": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product": { "name": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_id": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7@3.7.3-2%2Bdeb10u7%2Btuxcare.els5?arch=amd64" } } }, { "category": "product_version", "name": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product": { "name": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_id": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7-minimal@3.7.3-2%2Bdeb10u7%2Btuxcare.els5?arch=amd64" } } }, { "category": "product_version", "name": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product": { "name": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_id": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7-stdlib@3.7.3-2%2Bdeb10u7%2Btuxcare.els3?arch=amd64" } } }, { "category": "product_version", "name": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product": { "name": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_id": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7-dev@3.7.3-2%2Bdeb10u7%2Btuxcare.els3?arch=amd64" } } }, { "category": "product_version", "name": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product": { "name": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_id": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7@3.7.3-2%2Bdeb10u7%2Btuxcare.els3?arch=amd64" } } }, { "category": "product_version", "name": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product": { "name": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_id": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-minimal@3.7.3-2%2Bdeb10u7%2Btuxcare.els3?arch=amd64" } } }, { "category": "product_version", "name": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product": { "name": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_id": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-dev@3.7.3-2%2Bdeb10u7%2Btuxcare.els3?arch=amd64" } } }, { "category": "product_version", "name": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product": { "name": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_id": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7@3.7.3-2%2Bdeb10u7%2Btuxcare.els3?arch=amd64" } } }, { "category": "product_version", "name": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product": { "name": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_id": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-venv@3.7.3-2%2Bdeb10u7%2Btuxcare.els3?arch=amd64" } } }, { "category": "product_version", "name": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product": { "name": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_id": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7-minimal@3.7.3-2%2Bdeb10u7%2Btuxcare.els3?arch=amd64" } } }, { "category": "product_version", "name": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product": { "name": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_id": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-dev@3.7.3-2%2Bdeb10u7%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product": { "name": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_id": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7@3.7.3-2%2Bdeb10u7%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product": { "name": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_id": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7-minimal@3.7.3-2%2Bdeb10u7%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product": { "name": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_id": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-venv@3.7.3-2%2Bdeb10u7%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product": { "name": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_id": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7@3.7.3-2%2Bdeb10u7%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product": { "name": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_id": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7-stdlib@3.7.3-2%2Bdeb10u7%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product": { "name": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_id": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libpython3.7-dev@3.7.3-2%2Bdeb10u7%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product": { "name": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_id": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/python3.7-minimal@3.7.3-2%2Bdeb10u7%2Btuxcare.els2?arch=amd64" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all as a component of Debian 10", "product_id": "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all" }, "product_reference": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64 as a component of Debian 10", "product_id": "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" }, "product_reference": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64 as a component of Debian 10", "product_id": "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" }, "product_reference": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64 as a component of Debian 10", "product_id": "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" }, "product_reference": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64 as a component of Debian 10", "product_id": "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" }, "product_reference": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64 as a component of Debian 10", "product_id": "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" }, "product_reference": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all as a component of Debian 10", "product_id": "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all" }, "product_reference": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64 as a component of Debian 10", "product_id": "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" }, "product_reference": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64 as a component of Debian 10", "product_id": "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" }, "product_reference": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all as a component of Debian 10", "product_id": "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all" }, "product_reference": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64 as a component of Debian 10", "product_id": "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" }, "product_reference": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all as a component of Debian 10", "product_id": "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all" }, "product_reference": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64 as a component of Debian 10", "product_id": "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" }, "product_reference": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all as a component of Debian 10", "product_id": "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all" }, "product_reference": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64 as a component of Debian 10", "product_id": "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" }, "product_reference": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all as a component of Debian 10", "product_id": "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all" }, "product_reference": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64 as a component of Debian 10", "product_id": "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" }, "product_reference": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64 as a component of Debian 10", "product_id": "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" }, "product_reference": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64 as a component of Debian 10", "product_id": "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" }, "product_reference": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64 as a component of Debian 10", "product_id": "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" }, "product_reference": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all as a component of Debian 10", "product_id": "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all" }, "product_reference": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64 as a component of Debian 10", "product_id": "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" }, "product_reference": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64 as a component of Debian 10", "product_id": "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" }, "product_reference": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all as a component of Debian 10", "product_id": "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all" }, "product_reference": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all as a component of Debian 10", "product_id": "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all" }, "product_reference": "python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64 as a component of Debian 10", "product_id": "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64" }, "product_reference": "python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all as a component of Debian 10", "product_id": "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all" }, "product_reference": "idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64 as a component of Debian 10", "product_id": "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64" }, "product_reference": "python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64 as a component of Debian 10", "product_id": "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64" }, "product_reference": "libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64 as a component of Debian 10", "product_id": "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64" }, "product_reference": "python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all as a component of Debian 10", "product_id": "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all" }, "product_reference": "python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64 as a component of Debian 10", "product_id": "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64" }, "product_reference": "libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64 as a component of Debian 10", "product_id": "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64" }, "product_reference": "libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64 as a component of Debian 10", "product_id": "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64" }, "product_reference": "libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64 as a component of Debian 10", "product_id": "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64" }, "product_reference": "python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all as a component of Debian 10", "product_id": "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all" }, "product_reference": "libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all", "relates_to_product_reference": "Debian-10" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-13462", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "The \"tarfile\" module would still apply normalization of AREGTYPE (\\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-13462" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab", "url": "https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114", "url": "https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017", "url": "https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406", "url": "https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7", "url": "https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084", "url": "https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084" }, { "category": "external", "summary": "https://github.com/python/cpython/issues/141707", "url": "https://github.com/python/cpython/issues/141707" }, { "category": "external", "summary": "https://github.com/python/cpython/pull/143934", "url": "https://github.com/python/cpython/pull/143934" }, { "category": "external", "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/" } ], "release_date": "2026-03-12T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-06-12T10:25:23.256566Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1781259901", "product_ids": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1781259901" }, { "category": "none_available", "date": "2026-03-12T18:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ] }, { "cve": "CVE-2026-3644", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-3644" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4", "url": "https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd", "url": "https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd", "url": "https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd" }, { "category": "external", "summary": "https://github.com/python/cpython/issues/145599", "url": "https://github.com/python/cpython/issues/145599" }, { "category": "external", "summary": "https://github.com/python/cpython/pull/145600", "url": "https://github.com/python/cpython/pull/145600" }, { "category": "external", "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/" } ], "release_date": "2026-03-16T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-06-12T10:25:23.256566Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1781259901", "product_ids": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1781259901" }, { "category": "none_available", "date": "2026-03-16T18:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-4224", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "description", "text": "When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-4224" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a", "url": "https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785", "url": "https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee", "url": "https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3", "url": "https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768", "url": "https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768" }, { "category": "external", "summary": "https://github.com/python/cpython/issues/145986", "url": "https://github.com/python/cpython/issues/145986" }, { "category": "external", "summary": "https://github.com/python/cpython/pull/145987", "url": "https://github.com/python/cpython/pull/145987" }, { "category": "external", "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/03/16/4", "url": "http://www.openwall.com/lists/oss-security/2026/03/16/4" } ], "release_date": "2026-03-16T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-06-12T10:25:23.256566Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1781259901", "product_ids": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1781259901" }, { "category": "none_available", "date": "2026-03-16T18:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-7210", "cwe": { "id": "CWE-331", "name": "Insufficient Entropy" }, "notes": [ { "category": "description", "text": "`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" ], "known_affected": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-7210" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4", "url": "https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566", "url": "https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a", "url": "https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a" }, { "category": "external", "summary": "https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f", "url": "https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f" }, { "category": "external", "summary": "https://github.com/python/cpython/issues/149018", "url": "https://github.com/python/cpython/issues/149018" }, { "category": "external", "summary": "https://github.com/python/cpython/pull/149023", "url": "https://github.com/python/cpython/pull/149023" }, { "category": "external", "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/05/11/13", "url": "http://www.openwall.com/lists/oss-security/2026/05/11/13" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/05/11/8", "url": "http://www.openwall.com/lists/oss-security/2026/05/11/8" } ], "release_date": "2026-05-11T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-06-12T10:25:23.256566Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1781259901", "product_ids": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1781259901" }, { "category": "none_available", "date": "2026-05-11T18:16:00Z", "details": "Affected", "product_ids": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els2.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els3.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els3.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els2.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els3.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:idle-python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:libpython3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-stdlib-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:libpython3.7-testsuite-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-dev-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-doc-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-examples-0:3.7.3-2+deb10u7+tuxcare.els5.all", "Debian-10:python3.7-minimal-0:3.7.3-2+deb10u7+tuxcare.els5.amd64", "Debian-10:python3.7-venv-0:3.7.3-2+deb10u7+tuxcare.els5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] } ] }