{"id":"CLSA-2026-1781173352","summary":"Fix CVE(s): CVE-2025-13462, CVE-2026-0672, CVE-2026-3644, CVE-2026-4224","details":"   * SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply\n     nested DTD content models\n     - debian/patches/CVE-2026-4224.patch: guard conv_content_model() in\n       Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to\n       bound recursion when a registered ElementDeclHandler converts a deeply\n       nested content model.\n     - CVE-2026-4224\n   * SECURITY UPDATE: HTTP header injection via control characters in cookies\n     - debian/patches/CVE-2026-0672.patch: add _has_control_character() and\n       reject control characters in Morsel.__setitem__()/setdefault()/set()\n       and BaseCookie.output() in Lib/http/cookies.py.\n     - CVE-2026-0672\n   * SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in\n     cookies via additional Morsel paths)\n     - debian/patches/CVE-2026-3644.patch: reject control characters in\n       Morsel.update(), Morsel.__setstate__() and Morsel.js_output() in\n       Lib/http/cookies.py.\n     - CVE-2026-3644\n   * SECURITY UPDATE: tarfile member type confusion (regular file parsed as\n     directory) via GNU long name/link headers\n     - debian/patches/CVE-2025-13462.patch: skip the AREGTYPE-\u003eDIRTYPE\n       normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up\n       headers (dircheck=False) in Lib/tarfile.py.\n     - CVE-2025-13462","modified":"2026-10-26T09:32:00.767515318Z","published":"2026-06-11T10:26:46Z","upstream":["CVE-2025-13462","CVE-2026-0672","CVE-2026-3644","CVE-2026-4224"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1781173352.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13462"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0672"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3644"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224"}],"affected":[{"package":{"name":"idle-python3.5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/idle-python3.5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781173352.json"}},{"package":{"name":"libpython3.5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libpython3.5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781173352.json"}},{"package":{"name":"libpython3.5-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libpython3.5-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781173352.json"}},{"package":{"name":"libpython3.5-minimal","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libpython3.5-minimal?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781173352.json"}},{"package":{"name":"libpython3.5-stdlib","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libpython3.5-stdlib?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781173352.json"}},{"package":{"name":"libpython3.5-testsuite","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libpython3.5-testsuite?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781173352.json"}},{"package":{"name":"python3.5","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/python3.5?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781173352.json"}},{"package":{"name":"python3.5-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/python3.5-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781173352.json"}},{"package":{"name":"python3.5-doc","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/python3.5-doc?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781173352.json"}},{"package":{"name":"python3.5-examples","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/python3.5-examples?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781173352.json"}},{"package":{"name":"python3.5-minimal","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/python3.5-minimal?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781173352.json"}},{"package":{"name":"python3.5-venv","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/python3.5-venv?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.2-2ubuntu0~16.04.13+tuxcare.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1781173352.json"}}],"schema_version":"1.9.0"}