Vulnerability-Lookup

RHSA-2026:65531

Vulnerability from csaf_redhat - Published: 2026-09-08 15:27 - Updated: 2026-09-08 22:45

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Moderate

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: python3.12: * python3.12-3.12.14-1.1.hum1 (aarch64, x86_64) * python3.12-debug-3.12.14-1.1.hum1 (aarch64, x86_64) * python3.12-devel-3.12.14-1.1.hum1 (aarch64, x86_64) * python3.12-idle-3.12.14-1.1.hum1 (aarch64, x86_64) * python3.12-libs-3.12.14-1.1.hum1 (aarch64, x86_64) * python3.12-test-3.12.14-1.1.hum1 (aarch64, x86_64) * python3.12-tkinter-3.12.14-1.1.hum1 (aarch64, x86_64) * python3.12-3.12.14-1.1.hum1.src (src) Security Fix(es): python3.12: * CVE-2026-15310 * CVE-2026-15806 * CVE-2026-19672 * CVE-2026-17084

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-15806

A flaw was found in Python. The `HTTPPasswordMgr` class in the `urllib.request` module did not correctly consider the URL scheme when matching stored credentials against a requested URL. This allowed credentials intended for an HTTPS (secure) connection to be sent over an unencrypted HTTP connection to the same host. A remote attacker, by redirecting or downgrading a client to plain HTTP, could exploit this to capture sensitive credentials in cleartext, leading to information disclosure.

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-420 - Unprotected Alternate Channel

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:python3-12-main@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:python3-12-main@src	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:python3-12-main@x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-17084

A flaw was found in the Python 'stringprep' module. This module incorrectly processed characters by using the latest Unicode codepoint attributes instead of the Unicode 3.2.0 standard specified in RFC 3454. This deviation can lead to mismatches when processing internationalized domain names (IDNA) using the IDNA 2003 standard. The consequence is a potential breakdown in interoperability for domain names containing characters with updated Unicode attributes since version 3.2.0.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE-439 - Behavioral Change in New Version or Environment

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:python3-12-main@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:python3-12-main@src	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:python3-12-main@x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-19672

A flaw was found in the Python `tarfile` module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX (Portable Operating System Interface) platforms. This occurs when processing a specially crafted archive containing member names that use directory traversal sequences (e.g., `../`) to leave and then re-enter the target directory. While only empty directories are created outside the destination, this can lead to unintended file system modifications.

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:python3-12-main@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:python3-12-main@src	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:python3-12-main@x86_64	—	Vendor Fix fix

Threats

Impact Moderate

References

28 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:65531	self
https://access.redhat.com/security/cve/CVE-2026-15310	external
https://access.redhat.com/security/cve/CVE-2026-15806	external
https://access.redhat.com/security/cve/CVE-2026-17084	external
https://access.redhat.com/security/cve/CVE-2026-19672	external
https://access.redhat.com/security/updates/classi…	external
https://images.redhat.com/	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-15806	self
https://bugzilla.redhat.com/show_bug.cgi?id=2517978	external
https://www.cve.org/CVERecord?id=CVE-2026-15806	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15806	external
https://github.com/python/cpython/issues/155694	external
https://github.com/python/cpython/pull/155696	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2026-17084	self
https://bugzilla.redhat.com/show_bug.cgi?id=2517897	external
https://www.cve.org/CVERecord?id=CVE-2026-17084	external
https://nvd.nist.gov/vuln/detail/CVE-2026-17084	external
https://github.com/python/cpython/issues/155292	external
https://github.com/python/cpython/pull/155293	external
https://mail.python.org/archives/list/security-an…	external
https://access.redhat.com/security/cve/CVE-2026-19672	self
https://bugzilla.redhat.com/show_bug.cgi?id=2519726	external
https://www.cve.org/CVERecord?id=CVE-2026-19672	external
https://nvd.nist.gov/vuln/detail/CVE-2026-19672	external
https://github.com/python/cpython/pull/156000	external
https://mail.python.org/archives/list/security-an…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\npython3.12:\n  * python3.12-3.12.14-1.1.hum1 (aarch64, x86_64)\n  * python3.12-debug-3.12.14-1.1.hum1 (aarch64, x86_64)\n  * python3.12-devel-3.12.14-1.1.hum1 (aarch64, x86_64)\n  * python3.12-idle-3.12.14-1.1.hum1 (aarch64, x86_64)\n  * python3.12-libs-3.12.14-1.1.hum1 (aarch64, x86_64)\n  * python3.12-test-3.12.14-1.1.hum1 (aarch64, x86_64)\n  * python3.12-tkinter-3.12.14-1.1.hum1 (aarch64, x86_64)\n  * python3.12-3.12.14-1.1.hum1.src (src)\n\nSecurity Fix(es):\n\npython3.12:\n  * CVE-2026-15310\n  * CVE-2026-15806\n  * CVE-2026-19672\n  * CVE-2026-17084",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:65531",
        "url": "https://access.redhat.com/errata/RHSA-2026:65531"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-15310",
        "url": "https://access.redhat.com/security/cve/CVE-2026-15310"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-15806",
        "url": "https://access.redhat.com/security/cve/CVE-2026-15806"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-17084",
        "url": "https://access.redhat.com/security/cve/CVE-2026-17084"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-19672",
        "url": "https://access.redhat.com/security/cve/CVE-2026-19672"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65531.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-09-08T22:45:40+00:00",
      "generator": {
        "date": "2026-09-08T22:45:40+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.17"
        }
      },
      "id": "RHSA-2026:65531",
      "initial_release_date": "2026-09-08T15:27:28+00:00",
      "revision_history": [
        {
          "date": "2026-09-08T15:27:28+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-08T15:29:54+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-08T22:45:40+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-12-main@aarch64",
                "product": {
                  "name": "python3-12-main@aarch64",
                  "product_id": "python3-12-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12@3.12.14-1.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-12-main@src",
                "product": {
                  "name": "python3-12-main@src",
                  "product_id": "python3-12-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12@3.12.14-1.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-12-main@x86_64",
                "product": {
                  "name": "python3-12-main@x86_64",
                  "product_id": "python3-12-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.12@3.12.14-1.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-12-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python3-12-main@aarch64"
        },
        "product_reference": "python3-12-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-12-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python3-12-main@src"
        },
        "product_reference": "python3-12-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-12-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:python3-12-main@x86_64"
        },
        "product_reference": "python3-12-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15806",
      "cwe": {
        "id": "CWE-420",
        "name": "Unprotected Alternate Channel"
      },
      "discovery_date": "2026-08-18T16:01:17.631858+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517978"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Python. The `HTTPPasswordMgr` class in the `urllib.request` module did not correctly consider the URL scheme when matching stored credentials against a requested URL. This allowed credentials intended for an HTTPS (secure) connection to be sent over an unencrypted HTTP connection to the same host. A remote attacker, by redirecting or downgrading a client to plain HTTP, could exploit this to capture sensitive credentials in cleartext, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python: Information disclosure due to incorrect URL scheme matching",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python3-12-main@aarch64",
          "Red Hat Hardened Images:python3-12-main@src",
          "Red Hat Hardened Images:python3-12-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15806"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517978",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517978"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15806",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15806"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15806",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15806"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/155694",
          "url": "https://github.com/python/cpython/issues/155694"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/155696",
          "url": "https://github.com/python/cpython/pull/155696"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/"
        }
      ],
      "release_date": "2026-08-18T15:50:57.983000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T15:27:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python3-12-main@aarch64",
            "Red Hat Hardened Images:python3-12-main@src",
            "Red Hat Hardened Images:python3-12-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65531"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python3-12-main@aarch64",
            "Red Hat Hardened Images:python3-12-main@src",
            "Red Hat Hardened Images:python3-12-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python: Python: Information disclosure due to incorrect URL scheme matching"
    },
    {
      "cve": "CVE-2026-17084",
      "cwe": {
        "id": "CWE-439",
        "name": "Behavioral Change in New Version or Environment"
      },
      "discovery_date": "2026-08-18T14:01:00.899953+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517897"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Python \u0027stringprep\u0027 module. This module incorrectly processed characters by using the latest Unicode codepoint attributes instead of the Unicode 3.2.0 standard specified in RFC 3454. This deviation can lead to mismatches when processing internationalized domain names (IDNA) using the IDNA 2003 standard. The consequence is a potential breakdown in interoperability for domain names containing characters with updated Unicode attributes since version 3.2.0.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python3-12-main@aarch64",
          "Red Hat Hardened Images:python3-12-main@src",
          "Red Hat Hardened Images:python3-12-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-17084"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517897",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517897"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-17084",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-17084"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-17084",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17084"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/155292",
          "url": "https://github.com/python/cpython/issues/155292"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/155293",
          "url": "https://github.com/python/cpython/pull/155293"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/"
        }
      ],
      "release_date": "2026-08-18T13:57:31.876000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T15:27:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python3-12-main@aarch64",
            "Red Hat Hardened Images:python3-12-main@src",
            "Red Hat Hardened Images:python3-12-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65531"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python3-12-main@aarch64",
            "Red Hat Hardened Images:python3-12-main@src",
            "Red Hat Hardened Images:python3-12-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability"
    },
    {
      "cve": "CVE-2026-19672",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-08-19T15:41:31.754751+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2519726"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Python `tarfile` module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX (Portable Operating System Interface) platforms. This occurs when processing a specially crafted archive containing member names that use directory traversal sequences (e.g., `../`) to leave and then re-enter the target directory. While only empty directories are created outside the destination, this can lead to unintended file system modifications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:python3-12-main@aarch64",
          "Red Hat Hardened Images:python3-12-main@src",
          "Red Hat Hardened Images:python3-12-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19672"
        },
        {
          "category": "external",
          "summary": "RHBZ#2519726",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519726"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19672",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19672"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19672",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19672"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/156000",
          "url": "https://github.com/python/cpython/pull/156000"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/"
        }
      ],
      "release_date": "2026-08-19T15:24:08.616000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T15:27:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:python3-12-main@aarch64",
            "Red Hat Hardened Images:python3-12-main@src",
            "Red Hat Hardened Images:python3-12-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65531"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:python3-12-main@aarch64",
            "Red Hat Hardened Images:python3-12-main@src",
            "Red Hat Hardened Images:python3-12-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination"
    }
  ]
}

CVE-2026-15806 (GCVE-0-2026-15806)

Vulnerability from cvelistv5 – Published: 2026-08-18 15:50 – Updated: 2026-09-02 00:38

Title

`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

Summary

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 18:56 UTC

CWE

Assigner

PSF mitre root

References

9 references

URL	Tags
https://github.com/python/cpython/issues/155694	issue-tracking
https://github.com/python/cpython/pull/155696	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/a0d023fb…	patch
https://github.com/python/cpython/commit/a2773a34…	patch
https://github.com/python/cpython/commit/a7bb524f…	patch
https://github.com/python/cpython/commit/641be42b…	patch
https://github.com/python/cpython/commit/851cf9a7…	patch
http://www.openwall.com/lists/oss-security/2026/08/18/3

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.15.0rc2 (python)

Credits

Łukasz (https://github.com/lkk7) Kirill Podoprigora (https://github.com/Eclips4) Senthil Kumaran (https://github.com/orsenthil)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-18T18:07:31.778Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/18/3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15806",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T18:56:36.349726Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T18:56:57.585Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/python/cpython/issues/155694"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.15.0rc2",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "\u0141ukasz (https://github.com/lkk7)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Kirill Podoprigora (https://github.com/Eclips4)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Senthil Kumaran (https://github.com/orsenthil)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "type": "text/html",
              "value": "The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\u003cbr\u003e\u003cbr\u003eCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\u003cbr\u003e\u003cbr\u003eUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."
            }
          ],
          "value": "The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-522",
              "description": "CWE-522",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T00:38:15.504Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/155694"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/155696"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-15806",
    "datePublished": "2026-08-18T15:50:57.983Z",
    "dateReserved": "2026-07-15T08:49:13.390Z",
    "dateUpdated": "2026-09-02T00:38:15.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-17084 (GCVE-0-2026-17084)

Vulnerability from cvelistv5 – Published: 2026-08-18 13:57 – Updated: 2026-09-10 00:35

Title

stringprep.map_table_b2() deviates from RFC 3454 Table B.2

Summary

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 16:03 UTC

CWE

CWE-436 - Interpretation Conflict

Assigner

PSF mitre root

References

10 references

URL	Tags
https://github.com/python/cpython/pull/155293	patch
https://github.com/python/cpython/issues/155292	issue-tracking
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://github.com/python/cpython/commit/7e109d08…	patch
https://github.com/python/cpython/commit/5181304b…	patch
https://github.com/python/cpython/commit/1e54caa0…	patch
https://github.com/python/cpython/commit/c016c253…	patch
https://github.com/python/cpython/commit/c28b121a…	patch
https://github.com/python/cpython/commit/c42790b3…	patch
http://www.openwall.com/lists/oss-security/2026/08/18/2

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.15.0rc2 (python)

Credits

Bitshift (https://github.com/TheShiftedBit) Seth Larson (https://github.com/sethmlarson) Stan Ulbrych (https://github.com/StanFromIreland) Marc-Andre Lemburg (https://github.com/malemburg) Petr Viktorin (https://github.com/encukou)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17084",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T16:03:21.438212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-436",
                "description": "CWE-436 Interpretation Conflict",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T16:03:44.732Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-18T17:08:22.725Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/18/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "stringprep",
            "idna"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.15.0rc2",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bitshift (https://github.com/TheShiftedBit)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Seth Larson (https://github.com/sethmlarson)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Stan Ulbrych (https://github.com/StanFromIreland)"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Marc-Andre Lemburg (https://github.com/malemburg)"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Petr Viktorin (https://github.com/encukou)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The \"stringprep\" module didn\u0027t process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."
            }
          ],
          "value": "The \"stringprep\" module didn\u0027t process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T00:35:47.485Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/155293"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/155292"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "stringprep.map_table_b2() deviates from RFC 3454 Table B.2",
      "x_generator": {
        "engine": "Vulnogram 0.6.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-17084",
    "datePublished": "2026-08-18T13:57:31.876Z",
    "dateReserved": "2026-07-24T14:36:15.943Z",
    "dateUpdated": "2026-09-10T00:35:47.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19672 (GCVE-0-2026-19672)

Vulnerability from cvelistv5 – Published: 2026-08-19 15:24 – Updated: 2026-08-27 19:41

Title

tarfile extraction filter bypass allows creation of directories outside the destination

Summary

The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 19:28 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

PSF mitre root

References

3 references

URL	Tags
https://github.com/python/cpython/pull/156000	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Python Software Foundation	CPython	Affected: 0 , < 3.16.0 (python)

Credits

Lohinth (https://github.com/l0h1nth) Stan Ulbrych (https://github.com/StanFromIreland) Petr Viktorin (https://github.com/encukou) Ethan Furman (https://github.com/ethanfurman)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-26T01:30:52.965Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/25/10"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19672",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T19:28:09.797384Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T19:41:14.871Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "tarfile"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.16.0",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Lohinth (https://github.com/l0h1nth)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Stan Ulbrych (https://github.com/StanFromIreland)"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Petr Viktorin (https://github.com/encukou)"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Ethan Furman (https://github.com/ethanfurman)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "type": "text/html",
              "value": "The \u003cspan\u003etarfile\u003c/span\u003e module\u0027s \u003cspan\u003etar\u003c/span\u003e and \u003cspan\u003edata\u003c/span\u003e\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as \u003cspan\u003e../evil/../dest/sub/file\u003c/span\u003e. The containment check used the resolved path, but intermediate directories were created from the name as given.\u003cbr\u003e\u003cbr\u003eOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member\u0027s\n name must contain the destination directory\u0027s own final component, so \nextraction into a secure randomised directory is not affected.\u003cbr\u003e\u003cbr\u003eThis affects POSIX platforms only. On Windows, \u003cspan\u003e..\u003c/span\u003e components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."
            }
          ],
          "value": "The tarfile module\u0027s tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member\u0027s\n name must contain the destination directory\u0027s own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T15:24:08.616Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/156000"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/pull/156000"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "tarfile extraction filter bypass allows creation of directories outside the destination"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-19672",
    "datePublished": "2026-08-19T15:24:08.616Z",
    "dateReserved": "2026-08-12T21:17:15.148Z",
    "dateUpdated": "2026-08-27T19:41:14.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:65531

CVE-2026-15806 (GCVE-0-2026-15806)

CVE-2026-17084 (GCVE-0-2026-17084)

CVE-2026-19672 (GCVE-0-2026-19672)

Tags

Sightings

Nomenclature