{"id":"CLSA-2026-1781176375","summary":"Fix CVE(s): CVE-2025-13462, CVE-2026-0672, CVE-2026-3644, CVE-2026-4224","details":"   * SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply\n     nested DTD content models\n     - debian/patches/CVE-2026-4224.patch: guard conv_content_model() in\n       Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to\n       bound recursion when a registered ElementDeclHandler converts a deeply\n       nested content model.\n     - CVE-2026-4224\n   * SECURITY UPDATE: HTTP header injection via control characters in cookies\n     - debian/patches/CVE-2026-0672.patch: reject control characters in\n       Morsel.__setitem__()/set(), add a validating Morsel.setdefault()\n       override, and guard BaseCookie.output() in Lib/Cookie.py.\n     - CVE-2026-0672\n   * SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in\n     cookies via additional Morsel paths)\n     - debian/patches/CVE-2026-3644.patch: add a validating Morsel.update()\n       override and reject control characters in Morsel.js_output() in\n       Lib/Cookie.py.\n     - CVE-2026-3644\n   * SECURITY UPDATE: tarfile member type confusion (regular file parsed as\n     directory) via GNU long name/link headers\n     - debian/patches/CVE-2025-13462.patch: skip the AREGTYPE-\u003eDIRTYPE\n       normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up\n       headers (dircheck=False) in Lib/tarfile.py.\n     - CVE-2025-13462","modified":"2026-10-26T09:32:03.579381079Z","published":"2026-06-11T11:15:35Z","upstream":["CVE-2025-13462","CVE-2026-0672","CVE-2026-3644","CVE-2026-4224"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1781176375.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13462"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0672"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3644"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224"}],"affected":[{"package":{"name":"idle-python2.7","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/idle-python2.7?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.11+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781176375.json"}},{"package":{"name":"libpython2.7","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpython2.7?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.11+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781176375.json"}},{"package":{"name":"libpython2.7-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpython2.7-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.11+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781176375.json"}},{"package":{"name":"libpython2.7-minimal","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpython2.7-minimal?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.11+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781176375.json"}},{"package":{"name":"libpython2.7-stdlib","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpython2.7-stdlib?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.11+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781176375.json"}},{"package":{"name":"libpython2.7-testsuite","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libpython2.7-testsuite?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.11+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781176375.json"}},{"package":{"name":"python2.7","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python2.7?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.11+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781176375.json"}},{"package":{"name":"python2.7-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python2.7-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.11+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781176375.json"}},{"package":{"name":"python2.7-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python2.7-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.11+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781176375.json"}},{"package":{"name":"python2.7-examples","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python2.7-examples?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.11+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781176375.json"}},{"package":{"name":"python2.7-minimal","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python2.7-minimal?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.11+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1781176375.json"}}],"schema_version":"1.9.0"}