{"id":"CLSA-2026-1777545539","summary":"Fix of 6 CVEs","details":"   * SECURITY UPDATE: fix quadratic complexity in http cookie parsing with backslash escapes\n     - debian/patches/CVE-2024-7592.patch: fix quadratic complexity in http cookie parsing with backslash escapes\n     - CVE-2024-7592\n   * SECURITY UPDATE: reject leading dashes in webbrowser URLs and %action substitution bypass\n     - debian/patches/CVE-2026-4519.patch: reject leading dashes in webbrowser URLs and %action substitution bypass\n     - CVE-2026-4519\n   * SECURITY UPDATE: fix quadratic complexity in os.path.expandvars()\n     - debian/patches/CVE-2025-6075.patch: fix quadratic complexity in os.path.expandvars()\n     - CVE-2025-6075\n   * SECURITY UPDATE: remove quadratic behavior in xml.dom.minidom node id-cache clearing\n     - debian/patches/CVE-2025-12084.patch: remove quadratic behavior in xml.dom.minidom node id-cache clearing\n     - CVE-2025-12084\n   * SECURITY UPDATE: remove backtracking when parsing tarfile PAX headers\n     - debian/patches/CVE-2024-6232.patch: remove backtracking when parsing tarfile PAX headers\n     - CVE-2024-6232\n   * SECURITY UPDATE: reject malformed addresses in email.utils.parseaddr / getaddresses\n     - debian/patches/CVE-2023-27043.patch: reject malformed addresses in email.utils.parseaddr / getaddresses\n     - CVE-2023-27043","modified":"2026-06-04T10:03:57.711763229Z","published":"2026-04-30T10:39:04Z","upstream":["CVE-2023-27043","CVE-2024-6232","CVE-2024-7592","CVE-2025-12084","CVE-2025-6075","CVE-2026-4519"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1777545539.html"}],"affected":[{"package":{"name":"idle-python2.7","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/idle-python2.7?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.16-2+deb10u4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1777545539.json"}},{"package":{"name":"libpython2.7","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython2.7?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.16-2+deb10u4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1777545539.json"}},{"package":{"name":"libpython2.7-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython2.7-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.16-2+deb10u4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1777545539.json"}},{"package":{"name":"libpython2.7-minimal","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython2.7-minimal?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.16-2+deb10u4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1777545539.json"}},{"package":{"name":"libpython2.7-stdlib","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython2.7-stdlib?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.16-2+deb10u4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1777545539.json"}},{"package":{"name":"libpython2.7-testsuite","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libpython2.7-testsuite?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.16-2+deb10u4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1777545539.json"}},{"package":{"name":"python2.7","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python2.7?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.16-2+deb10u4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1777545539.json"}},{"package":{"name":"python2.7-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python2.7-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.16-2+deb10u4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1777545539.json"}},{"package":{"name":"python2.7-doc","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python2.7-doc?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.16-2+deb10u4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1777545539.json"}},{"package":{"name":"python2.7-examples","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python2.7-examples?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.16-2+deb10u4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1777545539.json"}},{"package":{"name":"python2.7-minimal","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python2.7-minimal?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.16-2+deb10u4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1777545539.json"}}],"schema_version":"1.7.5"}