Mailman 3 June 2026 - Security-announce

[CVE-2026-4360] Tarfile.extract doesn't fully respect filter parameter
by Petr Viktorin June 30, 2026

June 30, 2026

There is a LOW severity vulnerability affecting CPython. In the Tarfile.extract function, the filter parameter is not passed properly called when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract function. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-4360 * https://github.com/python/cpython/pull/151988

1 0

[CVE-2026-11972] tarfile opened in streaming mode mishandles EOF
by Seth Larson June 23, 2026

June 23, 2026

There is a MEDIUM severity vulnerability affecting CPython. When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-11972 * https://github.com/python/cpython/pull/151982

1 0

[CVE-2026-0864] Configparser newline injection in write() method
by Seth Larson June 23, 2026

June 23, 2026

There is a MEDIUM severity vulnerability affecting CPython. When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-0864 * https://github.com/python/cpython/pull/143929

1 0

[CVE-2026-11940] tarfile extraction filter bypass allows escaping the destination directory
by Stan Ulbrych June 23, 2026

June 23, 2026

There is a HIGH severity vulnerability affecting CPython. tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-11940 * https://github.com/python/cpython/pull/151559

1 0

[CVE-2026-12003] In-tree (development) search paths can be enabled without modifying install directory
by Steve Dower June 16, 2026

June 16, 2026

There is a MODERATE (CVSSv4 5.3) severity vulnerability affecting CPython up to (and including) 3.11.15, 3.12.13, 3.13.14, 3.14.6 and 3.15.0b2. To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates a different default sys.path. This code remains in release builds, so that release-ready builds can be built in-tree. On Windows, since builds are written to 'PCbuild/<arch>', the value of VPATH is set to '..\..', which results in a landmark of '..\..\Modules\setup.local'. This path is outside the install directory of Python, and may have different permissions, potentially allowing a low-privilege user to create the landmark and an alternative `Lib` folder that will be discovered by an otherwise restricted install. Such a setup occurs with the legacy default install location for all users (in the now superseded EXE installer), due to how Windows allows all users to create folders in the root directory of their OS drive. **Our recommended mitigation** on Windows is to migrate away from the legacy installer and use the new [Python install manager](https://www.python.org/downloads/latest/pymanager/) to install for the current user. Installs where the directory two levels above the Python installation directory have equivalent permissions are unaffected (in general, a per-user install cannot be modified at all by other users, removing any escalation of privilege risk, and could be directly modified by a privileged user, making the potential tampering irrelevant). Alternative mitigations might include preemptively creating and restricting access to a `Modules` directory. Be aware that only 3.13 and 3.14 will receive updated legacy installers - earlier fixes are only provided as sources. Platforms other than Windows allow VPATH to be overridden, but as they don't usually use a separated directory in the build for binaries, are unlikely to have a landmark reference outside of the install directory. The landmark detection involving VPATH is a fallback for when a more specific landmark - .\pybuilddir.txt - is absent, and was included for compatibility. Future releases of Python will no longer include the fallback, and so builds will need to generate or preserve the pybuilddir.txt file in order to work in-tree. This landmark file has been generated on Windows since 3.11, and on other platforms for longer. Reported by Jake Yamaki, Senior Consultant, Bishop Fox. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-12003 * https://github.com/python/cpython/pull/151545

1 0

[CVE-2026-9669] bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow
by Emma Smith June 8, 2026

June 8, 2026

There is a HIGH severity vulnerability affecting CPython. bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-9669 * https://github.com/python/cpython/pull/150600

1 0

[CVE-2026-7774] tarfile.data_filter path traversal bypass allows writing outside the extraction directory
by Stan Ulbrych June 4, 2026

June 4, 2026

There is a MEDIUM severity vulnerability affecting CPython. tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-7774 * https://github.com/python/cpython/pull/149487

1 0

[CVE-2026-3276] Potential DoS via quadratic complexity in unicodedata.normalize()
by Stan Ulbrych June 3, 2026

June 3, 2026

There is a MEDIUM severity vulnerability affecting CPython. unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-3276 * https://github.com/python/cpython/pull/149080

1 0

[CVE-2026-8643] pip can extract console_scripts and gui_scripts outside installation directory
by Seth Larson June 1, 2026

June 1, 2026

There is a MEDIUM severity vulnerability affecting pip. pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-8643 * https://github.com/pypa/pip/pull/14000

1 0