Release date:
2026-09-17 00:44:26 UTC
Description:
* SECURITY UPDATE: quadratic parse time in the tarfile module when a
streaming archive declares an offset past the end of the stream
- debian/patches/CVE-2026-11972.patch: stop the forward-seek loop in
_Stream.seek() as soon as read() returns no data, in Lib/tarfile.py,
so a crafted mode="r|" archive can no longer keep the parser reading
an exhausted stream.
- CVE-2026-11972
Updated packages:
-
idle-python2.7_2.7.17-1~18.04ubuntu1.11+tuxcare.els17_all.deb
sha:1286bb4a69366748b3fa13c63fc64fec878ef874
-
libpython2.7_2.7.17-1~18.04ubuntu1.11+tuxcare.els17_amd64.deb
sha:59e1b6bb9a0ecd9387413cc078e6f07b6e92ffcf
-
libpython2.7-dev_2.7.17-1~18.04ubuntu1.11+tuxcare.els17_amd64.deb
sha:d396e8dc9ef0332f57f0d1800dcb2964cf0d14d5
-
libpython2.7-minimal_2.7.17-1~18.04ubuntu1.11+tuxcare.els17_amd64.deb
sha:7b0fd4594ecf45c675dafb4c134c6bf39ca8aaa4
-
libpython2.7-stdlib_2.7.17-1~18.04ubuntu1.11+tuxcare.els17_amd64.deb
sha:429185f8713667a7a2f9aa357e1e1a2644589339
-
libpython2.7-testsuite_2.7.17-1~18.04ubuntu1.11+tuxcare.els17_all.deb
sha:616c624ba095f10e57928823dee39ef5edfe299d
-
python2.7_2.7.17-1~18.04ubuntu1.11+tuxcare.els17_amd64.deb
sha:28af9d1250490ca6f48739366814824462c13097
-
python2.7-dev_2.7.17-1~18.04ubuntu1.11+tuxcare.els17_amd64.deb
sha:85d5ea67e91e62d747da240f34119343fb1c6cb6
-
python2.7-doc_2.7.17-1~18.04ubuntu1.11+tuxcare.els17_all.deb
sha:c848233d5761bab00cfda6a145a0792409f0a747
-
python2.7-examples_2.7.17-1~18.04ubuntu1.11+tuxcare.els17_all.deb
sha:ebf68cbdffca8fe1ea8ad40e49004554588786ed
-
python2.7-minimal_2.7.17-1~18.04ubuntu1.11+tuxcare.els17_amd64.deb
sha:0321c58dc8db451ddaa6a32021e5eddf3f3a66f0
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
