UnratedFix available
python: Fix of CVE-2026-0864
Type: advisorySources: OSV
- CVE-2026-0864: normalize CR and CRLF line endings when writing multi-line values in ConfigParser - RawConfigParser.write() escaped only '\n' (to '\n\t'), so an attacker-controlled value containing a bare carriage return was written out verbatim and injected unexpected keys and values into the resulting configuration file. Applied at both write() call sites, for the DEFAULT section and for named sections; Python 2.7 has no _write_section(). Backported from upstream CPython (gh-143927, GH-143929).
- Products
- python, python-debug, python-devel, python-libs, python-test, python-tools, tkinter
- Affected versions
- Not specified
- Fixed versions
- 2.7.5-94.0.5.el7_9.tuxcare.els2
- CVEs
- CVE-2026-0864
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:35 UTC · Revision 1
Source evidence
- CVE-2026-0864: normalize CR and CRLF line endings when writing multi-line values in ConfigParser - RawConfigParser.write() escaped only '\n' (to '\n\t'), so an attacker-controlled value containing a bare carriage return was written out verbatim and injected unexpected keys and values into the resulting configuration file. Applied at both write() call sites, for the DEFAULT section and for named sections; Python 2.7 has no _write_section(). Backported from upstream CPython (gh-143927, GH-143929).
osv:CLSA-2026-1787646114
python
Fixed versions: 2.7.5-94.0.5.el7_9.tuxcare.els2
python-debug
Fixed versions: 2.7.5-94.0.5.el7_9.tuxcare.els2
python-devel
Fixed versions: 2.7.5-94.0.5.el7_9.tuxcare.els2
python-libs
Fixed versions: 2.7.5-94.0.5.el7_9.tuxcare.els2
python-test
Fixed versions: 2.7.5-94.0.5.el7_9.tuxcare.els2
python-tools
Fixed versions: 2.7.5-94.0.5.el7_9.tuxcare.els2
tkinter
Fixed versions: 2.7.5-94.0.5.el7_9.tuxcare.els2
Complete source record
{
"id": "4c173f305149b71427ce962c84ed670d6b55f87bcf56690990c3cc65ca0663a0",
"url": "https://osv.dev/vulnerability/CLSA-2026-1787646114",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "python: Fix of CVE-2026-0864",
"summary": "- CVE-2026-0864: normalize CR and CRLF line endings when writing multi-line values in ConfigParser - RawConfigParser.write() escaped only '\\n' (to '\\n\\t'), so an attacker-controlled value containing a bare carriage return was written out verbatim and injected unexpected keys and values into the resulting configuration file. Applied at both write() call sites, for the DEFAULT section and for named sections; Python 2.7 has no _write_section(). Backported from upstream CPython (gh-143927, GH-143929).",
"evidence": "osv:CLSA-2026-1787646114",
"products": [
{
"name": {
"value": "python",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.5.el7_9.tuxcare.els2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-debug",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.5.el7_9.tuxcare.els2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-devel",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.5.el7_9.tuxcare.els2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-libs",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.5.el7_9.tuxcare.els2",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-test",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.5.el7_9.tuxcare.els2",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python-tools",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.5.el7_9.tuxcare.els2",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tkinter",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.5-94.0.5.el7_9.tuxcare.els2",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1787646114",
"aliases": [
"CLSA-2026-1787646114"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.5.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "python",
"purl": "pkg:rpm/tuxcare/python?distro=rhel-7",
"ecosystem": "TuxCare:RHEL:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1787646114.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.5.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "python-debug",
"purl": "pkg:rpm/tuxcare/python-debug?distro=rhel-7",
"ecosystem": "TuxCare:RHEL:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1787646114.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.5.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "python-devel",
"purl": "pkg:rpm/tuxcare/python-devel?distro=rhel-7",
"ecosystem": "TuxCare:RHEL:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1787646114.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.5.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "python-libs",
"purl": "pkg:rpm/tuxcare/python-libs?distro=rhel-7",
"ecosystem": "TuxCare:RHEL:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1787646114.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.5.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "python-test",
"purl": "pkg:rpm/tuxcare/python-test?distro=rhel-7",
"ecosystem": "TuxCare:RHEL:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1787646114.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.5.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "python-tools",
"purl": "pkg:rpm/tuxcare/python-tools?distro=rhel-7",
"ecosystem": "TuxCare:RHEL:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1787646114.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5-94.0.5.el7_9.tuxcare.els2"
}
]
}
],
"package": {
"name": "tkinter",
"purl": "pkg:rpm/tuxcare/tkinter?distro=rhel-7",
"ecosystem": "TuxCare:RHEL:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1787646114.json"
}
}
],
"modified": "2026-10-26T09:31:58.524405251Z",
"provider": "osv",
"upstream": [
"CVE-2026-0864"
],
"references": [
"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1787646114.html",
"https://nvd.nist.gov/vuln/detail/CVE-2026-0864"
]
},
"related_cves": [
{
"value": "CVE-2026-0864",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 449215,
"published_at": "2026-08-25T08:22:06+00:00"
}