CLSA-2026-1777944042 Fix CVE(s): CVE-2025-8194, CVE-2026-4519, CVE-2026-4786

SECURITY UPDATE: tarfile DoS via negative member offsets - debian/patches/CVE-2025-8194.patch: validate that member offsets are non-negative in Lib/tarfile.py. - CVE-2025-8194 SECURITY UPDATE: webbrowser.open accepts URLs with leading dashes - debian/patches/CVE-2026-4519-CVE-2026-4786.patch:...

RHEL 9 : python3.11 (RHSA-2026:13692)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13692 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

MiracleLinux 8 : python3.12-3.12.13-2.el8_10 (AXSA:2026-523:13)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-523:13 advisory. expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-593...

Fedora 43 : python3.14 (2026-97a8eb204a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-97a8eb204a advisory. Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Tenable has extracted the preceding description block directly from th...

Fedora 43 : python3.6 (2026-f08d5a8191)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f08d5a8191 advisory. - Security fixes for CVE-2026-4786, CVE-2026-6100 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora 44 : python3.6 (2026-a335d04675)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a335d04675 advisory. - Security fixes for CVE-2026-4786, CVE-2026-6100 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1618)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1618 advisory. The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update, |= operator, and unpickling paths were not patched, allowing control...

AlmaLinux 9 : python3.9 (ALSA-2026:10949)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:10949 advisory. python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules CVE-2026-6100 python: cpython: Python:...

Fedora 43 : python3.9 (2026-7986d7f994)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7986d7f994 advisory. Security fixes for CVE-2026-4786 and CVE-2026-6100 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora 44 : python3.9 (2026-85cf3694d8)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-85cf3694d8 advisory. Security fixes for CVE-2026-4786 and CVE-2026-6100 Tenable has extracted the preceding description block directly from the Fedora security advisory...

python315-3.15.0~a8-3.1 on GA media (moderate)

python315-3.15.0a8-3.1 on GA media Announcement ID: openSUSE-SU-2026:10648-1 Rating: moderate Cross-References: CVE-2026-1502 CVE-2026-4786 CVE-2026-5713 CVE-2026-6019 CVE-2026-6100 CVSS scores: CVE-2026-1502 SUSE : 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N CVE-2026-1502 SUSE : 5.7...

CLSA-2026-1777454964 python: Fix of 2 CVEs

CVE-2026-4519: reject webbrowser.open URLs with a leading dash to prevent CLI option injection into the spawned browser process - CVE-2026-4786: validate URLs after %action substitution and swap the substitution order in UnixBrowser.open to close a bypass of the CVE-2026-4519 dash-prefix check...

Oracle Linux 8 : python3 (ELSA-2026-11077)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-11077 advisory. 3.6.8-76.0.1 - Add Oracle Linux distribution in platform.py Orabug: 20812544 3.6.8.openela.0 - Add openela to supported dists 3.6.8-76 - Security fixe...

AlmaLinux 8 : python3.12 (ALSA-2026:10950)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:10950 advisory. expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-59375...

Oracle Linux 9 : python3.11 (ELSA-2026-10774)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-10774 advisory. 3.11.13-5.3.0.1 - Remove upstream URL reference Orabug: 36073032 3.11.13-5.3 - Security fixes for CVE-2026-4786, CVE-2026-6100 Resolves: RHEL-167913,...

python3 security update

3.6.8-76.0.1 - Add Oracle Linux distribution in platform.py Orabug: 20812544 3.6.8.openela.0 - Add openela to supported dists 3.6.8-76 - Security fixes for CVE-2026-4786, CVE-2026-6100 Resolves: RHEL-167890, RHEL-168128...

Fedora 42 : mingw-python3 (2026-763e814afa)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-763e814afa advisory. Backport fix for CVE-2026-4786. ---- Backport fixes for CVE-2026-6100, CVE-2026-3479, CVE-2026-1502 Tenable has extracted the preceding description...

Fedora 42 : python3.14 (2026-1fd21102d1)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1fd21102d1 advisory. Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 ---- New minor version of the alternate Python interpreter Tenable has...

Fedora 43 : mingw-python3 (2026-43577dc43b)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-43577dc43b advisory. Backport fix for CVE-2026-4786. ---- Backport fixes for CVE-2026-6100, CVE-2026-3479, CVE-2026-1502 Tenable has extracted the preceding description...

RockyLinux 9 : python3.11 (RLSA-2026:10774)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:10774 advisory. python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules CVE-2026-6100 python: cpython: Python:...