Security update for python311
This update for python311 fixes the following issues: - CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611). - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the `configparser` module is used (bsc#1269066). - CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969). - CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240). - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted Unicode input (bsc#1267581). - CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734). - CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735). - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959). - CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web browser command line option injection (bsc#1260026). - CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319). - CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098). - CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Exp
SUSE-SU-2026:23743-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:SUSE-SU-2026:23743-1
python311
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.11.16-slfo.1.1_1.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
python311-core
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.11.16-slfo.1.1_1.1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.11.16-slfo.1.1_1.1"
}
]
}
],
"package": {
"name": "python311",
"purl": "pkg:rpm/suse/python311&distro=SUSE%20Linux%20Micro%206.1",
"ecosystem": "SUSE:Linux Micro 6.1"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23743-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"python311": "3.11.16-slfo.1.1_1.1",
"python311-base": "3.11.16-slfo.1.1_1.1",
"python311-curses": "3.11.16-slfo.1.1_1.1",
"libpython3_11-1_0": "3.11.16-slfo.1.1_1.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.11.16-slfo.1.1_1.1"
}
]
}
],
"package": {
"name": "python311-core",
"purl": "pkg:rpm/suse/python311-core&distro=SUSE%20Linux%20Micro%206.1",
"ecosystem": "SUSE:Linux Micro 6.1"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23743-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"python311": "3.11.16-slfo.1.1_1.1",
"python311-base": "3.11.16-slfo.1.1_1.1",
"python311-curses": "3.11.16-slfo.1.1_1.1",
"libpython3_11-1_0": "3.11.16-slfo.1.1_1.1"
}
]
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #19944 · Revision 1
- Added to Heist Feed
- Publisher date