[CLSA-2026:1789662396] python3.9: Fix of CVE-2026-82049
Type:
security
Severity:
Important
Release date:
2026-09-17 16:26:47 UTC
Description:
- CVE-2026-82049: fix tarfile data/tar filter bypass where a hard link to a symlink was extracted as a copy of the symlink at a shallower path, letting its relative target escape the destination directory; makelink_with_filter() now resolves the link target with os.path.realpath() before os.link() (upstream gh-157190, commit b8f23e30)
CVEs fixed:
Updated packages:
  • python-unversioned-command-3.9.16-1.el9_2.2.tuxcare.els35.noarch.rpm
    sha:3fd39483008f5e13ea422a162105fd4f46fb77436a626ee587293720a69a3ddf
  • python3-3.9.16-1.el9_2.2.tuxcare.els35.i686.rpm
    sha:4e7217ef821945801e6eee56bbbca490559f7309db3637caca908369ecc93450
  • python3-3.9.16-1.el9_2.2.tuxcare.els35.x86_64.rpm
    sha:0eaad8c44a6a741dfb026f519437d1c27ce8b1be97c740bdb3a42ad85279f6fc
  • python3-debug-3.9.16-1.el9_2.2.tuxcare.els35.i686.rpm
    sha:e13afe7d2bdf88cbd28e0e16ab600b0b60209c9e5f361cca22b5da07712efbc4
  • python3-debug-3.9.16-1.el9_2.2.tuxcare.els35.x86_64.rpm
    sha:e14845b681807119b0c0f2858f3d831296ab3f38801c7ee88ea77070f1d49a56
  • python3-devel-3.9.16-1.el9_2.2.tuxcare.els35.i686.rpm
    sha:4489101c45e61ffc63543a95267a25e396e23ee30cebe6ef3839bb2c248da4c6
  • python3-devel-3.9.16-1.el9_2.2.tuxcare.els35.x86_64.rpm
    sha:29509c55ceb02011235124aa028e7e3f72b992daeb5dec674e92b4c74ccebca2
  • python3-idle-3.9.16-1.el9_2.2.tuxcare.els35.i686.rpm
    sha:29dcc2b79ea3bfd72a45f8b16bd6d1715e27be288c9e8a4107dc2916e621f4fb
  • python3-idle-3.9.16-1.el9_2.2.tuxcare.els35.x86_64.rpm
    sha:e48cb3989f1d7538e13016b780ad42805ad7cb57c45ab865ff82f78772f76291
  • python3-libs-3.9.16-1.el9_2.2.tuxcare.els35.i686.rpm
    sha:8bcad311eb83f739159381fa5490506d72ab9de32390caf0332f2ef9f6e17f4e
  • python3-libs-3.9.16-1.el9_2.2.tuxcare.els35.x86_64.rpm
    sha:92196214c0500e58036f25d29f3d209091abb61036af3e063fb6da0d7bb867aa
  • python3-test-3.9.16-1.el9_2.2.tuxcare.els35.i686.rpm
    sha:2d0d0d5257b9212f26d8dec598aeaba6f8371668f06b1ac5198249e3bb2558dd
  • python3-test-3.9.16-1.el9_2.2.tuxcare.els35.x86_64.rpm
    sha:f9064a170b843eecd9a831fcbce829f3713574462aa654f9de19c991094693b6
  • python3-tkinter-3.9.16-1.el9_2.2.tuxcare.els35.i686.rpm
    sha:42e71caba81bf105f105871d82065301c188d404b836d08b020982e679f11d35
  • python3-tkinter-3.9.16-1.el9_2.2.tuxcare.els35.x86_64.rpm
    sha:02e293a89d04dd23dcef86fbc4d8f7aa2cad912d549c0587d930157487ccd995
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.