[CLSA-2026:1781516351] Fix CVE(s): CVE-2025-15366, CVE-2025-15367
Type:
security
Severity:
Important
Release date:
2026-06-15 09:40:43 UTC
Description:
* SECURITY UPDATE: imaplib.IMAP4._command() concatenated each command argument into the wire-level command without inspecting it, so a caller passing user-controlled text could inject additional IMAP commands using CR/LF or other control characters. - debian/patches/CVE-2025-15366.patch: backport of cpython 6262704b (gh-143921, Seth Larson). Adds a module-level _control_chars regex and rejects any byte in [\x00-\x1F\x7F] with ValueError before concatenating each argument. Upstream-main-only fix; mirrors Red Hat's python3-3.6.8-21.el7_9.4 (RHSA-2026:6464). - CVE-2025-15366 * SECURITY UPDATE: poplib.POP3._putcmd() encoded its argument and sent it to the server without inspecting it, allowing the same command injection via user() / pass_() / apop() / rpop() / top(). - debian/patches/CVE-2025-15367.patch: backport of cpython b234a2b6 (gh-143923, Seth Larson). Rejects any byte in [\x00-\x1F\x7F] with ValueError before sending. Upstream-main-only fix; mirrors Red Hat's python3-3.6.8-21.el7_9.4 (RHSA-2026:6464). - CVE-2025-15367
CVEs fixed:
Updated packages:
  • alt-python36_3.6.15-38_amd64.deb
    sha:32871a5b46ab18bba50a75d4b552101025b84e66
  • alt-python36-debug_3.6.15-38_amd64.deb
    sha:2772a53d49dea6a0d92832fb3751c469dc5b0723
  • alt-python36-devel_3.6.15-38_amd64.deb
    sha:3e25ad279ffd990b851f963d0456a20a7cf73c65
  • alt-python36-libs_3.6.15-38_amd64.deb
    sha:0be742360221eebb0049c46e7676a34226e25e04
  • alt-python36-test_3.6.15-38_amd64.deb
    sha:70f092aa1fcf7763821716996afce3f01f3498ef
  • alt-python36-tkinter_3.6.15-38_amd64.deb
    sha:a0c0db2c7dfdc8a233c02732e0051892b05f13f4
  • alt-python36-tools_3.6.15-38_amd64.deb
    sha:37bd2fd77f9be522bf65f53fbdd65cf5a4e1d9d9
  • alt-python36_3.6.15-38_arm64.deb
    sha:fe770d0257021b8e870b041a4655e914eb6099fb
  • alt-python36-debug_3.6.15-38_arm64.deb
    sha:9f567d758bb2bc8fd0cb641ab29dab12588629cd
  • alt-python36-devel_3.6.15-38_arm64.deb
    sha:ed674567085a3fe043abcc5c9e0d24dc5efd5a42
  • alt-python36-libs_3.6.15-38_arm64.deb
    sha:266a43bf3294740e3bee10aa6434d45ceb87cbd4
  • alt-python36-test_3.6.15-38_arm64.deb
    sha:97ca9aec90a73c5dbd998e1f645d98fbddd3a4c2
  • alt-python36-tkinter_3.6.15-38_arm64.deb
    sha:0ceda8105176dc3e5f21b7af00aaec6cc67914e5
  • alt-python36-tools_3.6.15-38_arm64.deb
    sha:8cd258b8c451a644388fdb6f71b24c8226b4f1fe
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.