{"id":"CLSA-2026-1781174666","summary":"Fix CVE(s): CVE-2025-13462, CVE-2026-0672, CVE-2026-3644, CVE-2026-4224","details":"   * SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply\n     nested DTD content models\n     - debian/patches/CVE-2026-4224.patch: guard conv_content_model() in\n       Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to\n       bound recursion when a registered ElementDeclHandler converts a deeply\n       nested content model.\n     - CVE-2026-4224\n   * SECURITY UPDATE: HTTP header injection via control characters in cookies\n     - debian/patches/CVE-2026-0672.patch: add _has_control_character() and\n       reject control characters in Morsel.__setitem__()/setdefault()/set()\n       and BaseCookie.output() in Lib/http/cookies.py.\n     - CVE-2026-0672\n   * SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in\n     cookies via additional Morsel paths)\n     - debian/patches/CVE-2026-3644.patch: reject control characters in\n       Morsel.update(), Morsel.__setstate__() and Morsel.js_output() in\n       Lib/http/cookies.py.\n     - CVE-2026-3644\n   * SECURITY UPDATE: tarfile member type confusion (regular file parsed as\n     directory) via GNU long name/link headers\n     - debian/patches/CVE-2025-13462.patch: skip the AREGTYPE-\u003eDIRTYPE\n       normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up\n       headers (dircheck=False) in Lib/tarfile.py.\n     - CVE-2025-13462","modified":"2026-10-26T09:32:03.516182037Z","published":"2026-06-11T10:47:05Z","upstream":["CVE-2025-13462","CVE-2026-0672","CVE-2026-3644","CVE-2026-4224"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1781174666.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13462"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0672"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3644"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224"}],"affected":[{"package":{"name":"idle-python3.6","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/idle-python3.6?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1.12+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781174666.json"}},{"package":{"name":"libpython3.6","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpython3.6?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1.12+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781174666.json"}},{"package":{"name":"libpython3.6-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpython3.6-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1.12+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781174666.json"}},{"package":{"name":"libpython3.6-minimal","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpython3.6-minimal?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1.12+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781174666.json"}},{"package":{"name":"libpython3.6-stdlib","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpython3.6-stdlib?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1.12+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781174666.json"}},{"package":{"name":"libpython3.6-testsuite","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpython3.6-testsuite?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1.12+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781174666.json"}},{"package":{"name":"python3.6","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python3.6?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1.12+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781174666.json"}},{"package":{"name":"python3.6-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python3.6-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1.12+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781174666.json"}},{"package":{"name":"python3.6-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python3.6-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1.12+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781174666.json"}},{"package":{"name":"python3.6-examples","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python3.6-examples?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1.12+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781174666.json"}},{"package":{"name":"python3.6-minimal","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python3.6-minimal?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1.12+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781174666.json"}},{"package":{"name":"python3.6-venv","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python3.6-venv?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1.12+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781174666.json"}}],"schema_version":"1.9.0"}