[LFS Trac] #5972: Python security fixes: CVE-2026-4360 and 15308

#5972: Python security fixes: CVE-2026-4360 and 15308
-------------------------+----------------------
 Reporter:  Joe Locash   |      Owner:  lfs-book
     Type:  enhancement  |     Status:  new
 Priority:  high         |  Milestone:  13.1
Component:  Book         |    Version:  git
 Severity:  normal       |   Keywords:
-------------------------+----------------------
 2 CVE's have been fixed in Python recently, the one reported today has a
 high severity.

 {{{
 From: Petr Viktorin via Security-announce <[email protected]>
 Date: Tue, 30 Jun 2026 13:45:44 +0200
 Subject: [Security-announce][CVE-2026-4360] Tarfile.extract doesn't fully
 respect filter parameter
 There is a LOW severity vulnerability affecting CPython.

 In the Tarfile.extract function, the filter parameter is not passed
 properly called when extracting hardlinks. An affected system that
 extracts content from untrusted tar files could end up writing files
 with an unexpected uid/gid despite the user passing filter='data' to the
 extract function.

 Please see the linked CVE ID for the latest information on affected
 versions:

 * https://www.cve.org/CVERecord?id=CVE-2026-4360
 * https://github.com/python/cpython/pull/151988
 }}}

 Upstream PR for the 3.14 branch:
 https://github.com/python/cpython/pull/152609


 {{{
 From: Seth Larson <[email protected]>
 Date: Thu, 9 Jul 2026 17:08:21 +0000
 Subject: [Security-announce][CVE-2026-15308] Incremental HTMLParser allows
 CPU-exhaustion DoS via repeated unterminated markup declarations

 There is a HIGH severity vulnerability affecting CPython.

 The incremental HTML parser (html.parser.HTMLParser) allows for CPU
 denial-of-service through repeated unterminated markup declarations when
 processing uncontrolled data.

 Please see the linked CVE ID for the latest information on affected
 versions:

 * https://www.cve.org/CVERecord?id=CVE-2026-15308
 * https://github.com/python/cpython/pull/153031
 }}}
 Upstream PR for the 3.14 branch:
 https://github.com/python/cpython/pull/153039

 Patches attached for both.
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/5972>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page