[CLSA-2026:1792577610] Fix CVE(s): CVE-2024-0397, CVE-2025-8194
Type:
security
Severity:
Important
Release date:
2026-10-21 10:13:43 UTC
Description:
* SECURITY UPDATE: infinite loop and deadlock when parsing tar archives with negative member offsets - debian/patches/CVE-2025-8194.patch: reject negative byte counts in TarInfo._block() with InvalidHeaderError in Lib/tarfile.py, so a crafted negative member size can no longer move the read offset backwards; add regression tests to Lib/test/test_tarfile.py - CVE-2025-8194 * SECURITY UPDATE: memory race condition in ssl.SSLContext cert_store_stats() and get_ca_certs() - debian/patches/CVE-2024-0397.patch: add an X509_STORE_get1_objects() shim that takes a locked deep copy of the certificate store objects and use it in cert_store_stats() and get_ca_certs() in Modules/_ssl.c, so certificates loaded concurrently can no longer free objects that are being iterated - CVE-2024-0397
CVEs fixed:
Updated packages:
  • idle-python2.7_2.7.18-1~20.04.7+tuxcare.els9_all.deb
    sha:32dae78e3adc44786f53da6fb0ca4b5b1cd52e34
  • libpython2.7_2.7.18-1~20.04.7+tuxcare.els9_amd64.deb
    sha:cebfd43bcceb051724e5c9db66dfbdf97b32f847
  • libpython2.7-dev_2.7.18-1~20.04.7+tuxcare.els9_amd64.deb
    sha:09c55d70da9dd9982771b06f03bace842ca32dd3
  • libpython2.7-minimal_2.7.18-1~20.04.7+tuxcare.els9_amd64.deb
    sha:972ea88506083262a311f442d2126c162ace636f
  • libpython2.7-stdlib_2.7.18-1~20.04.7+tuxcare.els9_amd64.deb
    sha:180108e0ada11f6135d0252fdf8bd08a7b595d28
  • libpython2.7-testsuite_2.7.18-1~20.04.7+tuxcare.els9_all.deb
    sha:c19ff5871afedf0ec0d9bf7023f3bad8b7d6eabc
  • python2.7_2.7.18-1~20.04.7+tuxcare.els9_amd64.deb
    sha:53494d8b3c054b1b6a0e625ea51449e8134c57f1
  • python2.7-dev_2.7.18-1~20.04.7+tuxcare.els9_amd64.deb
    sha:eb1a9fb4c6454fe6b0f8a24799b72ab45c948ec5
  • python2.7-doc_2.7.18-1~20.04.7+tuxcare.els9_all.deb
    sha:a8b2aa6dbcc2d304cd0f04950c7a9a5bbaeb06aa
  • python2.7-examples_2.7.18-1~20.04.7+tuxcare.els9_all.deb
    sha:6bc2e3bbf218df6aeef0d0aa88d60a01733ca5d9
  • python2.7-minimal_2.7.18-1~20.04.7+tuxcare.els9_amd64.deb
    sha:8115fd85b1bc212d8a970490c7bf6f53630298f1
  • libpython2.7_2.7.18-1~20.04.7+tuxcare.els9_arm64.deb
    sha:20642dd67ad64389003228689fd65808d5343f00
  • libpython2.7-dev_2.7.18-1~20.04.7+tuxcare.els9_arm64.deb
    sha:ed3cb094a263f69acdd73bba7db80d961ba306b3
  • libpython2.7-minimal_2.7.18-1~20.04.7+tuxcare.els9_arm64.deb
    sha:ca2db3ccc8052d4d741b32c8dcfe74e2efc7b291
  • libpython2.7-stdlib_2.7.18-1~20.04.7+tuxcare.els9_arm64.deb
    sha:f3113ffb3b19e62f397855745b81d029dc370e7a
  • python2.7_2.7.18-1~20.04.7+tuxcare.els9_arm64.deb
    sha:469386b390f50b2d277a30f1ca37a5eee01c717a
  • python2.7-dev_2.7.18-1~20.04.7+tuxcare.els9_arm64.deb
    sha:73a92917ab6d0e6dfda1e2dbf4e1a52d37b4cb1d
  • python2.7-minimal_2.7.18-1~20.04.7+tuxcare.els9_arm64.deb
    sha:eb6b77ddc773d1a1587168b66e9d4741a216f15e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.