[CLSA-2026:1793021252] Fix CVE(s): CVE-2024-0397, CVE-2025-8194
Type:
security
Severity:
Important
Release date:
2026-10-26 13:27:44 UTC
Description:
* SECURITY UPDATE: infinite loop in tarfile on archives with negative member offsets - debian/patches/CVE-2025-8194.patch: reject negative byte counts in TarInfo._block() in Lib/tarfile.py, add regression tests - CVE-2025-8194 * SECURITY UPDATE: race condition in ssl.SSLContext.cert_store_stats() and get_ca_certs() walking the X509_STORE without its lock - debian/patches/CVE-2024-0397.patch: take a locked deep copy of the store objects via an X509_STORE_get1_objects() shim in Modules/_ssl.c - CVE-2024-0397 * SECURITY UPDATE: IMAP command injection through CR/LF in command arguments - debian/patches/CVE-2025-15366.patch: reject NUL, CR and LF in IMAP4._command() arguments in Lib/imaplib.py (other control characters stay allowed and are sent quoted), add regression test - CVE-2025-15366 * SECURITY UPDATE: POP3 command injection through control characters in commands - debian/patches/CVE-2025-15367.patch: reject control characters in POP3._putcmd() in Lib/poplib.py, add regression test - CVE-2025-15367
CVEs fixed:
Updated packages:
  • idle-python2.7_2.7.16-2+deb10u4+tuxcare.els9_all.deb
    sha:8e35320504b413d0198728b808f26eb33f3907c2
  • libpython2.7_2.7.16-2+deb10u4+tuxcare.els9_amd64.deb
    sha:f7a5d2ba28061d30294df512e6485c19da39cfd1
  • libpython2.7-dev_2.7.16-2+deb10u4+tuxcare.els9_amd64.deb
    sha:3ce04cfaa18d3101dfa9ca56edd6ed4347b27658
  • libpython2.7-minimal_2.7.16-2+deb10u4+tuxcare.els9_amd64.deb
    sha:02101a1fa39184541b1176cf1136d2bd392eff56
  • libpython2.7-stdlib_2.7.16-2+deb10u4+tuxcare.els9_amd64.deb
    sha:055f13ef7ccff6721859d2bdabfd3c73661e57d6
  • libpython2.7-testsuite_2.7.16-2+deb10u4+tuxcare.els9_all.deb
    sha:0d3ccd9a11d407bf0a16a0183612ec3f1a04b3d0
  • python2.7_2.7.16-2+deb10u4+tuxcare.els9_amd64.deb
    sha:96aa4bcd7532272c9fae797c6c1635218c1cf239
  • python2.7-dev_2.7.16-2+deb10u4+tuxcare.els9_amd64.deb
    sha:e40381efc29fe5dbb473edf011aedd587aa7b59b
  • python2.7-doc_2.7.16-2+deb10u4+tuxcare.els9_all.deb
    sha:21e34ab8bb246a3f0d62b7c2472fcf332373ca64
  • python2.7-examples_2.7.16-2+deb10u4+tuxcare.els9_all.deb
    sha:290a5c1470328caf392ddfb69b4850c7aee20945
  • python2.7-minimal_2.7.16-2+deb10u4+tuxcare.els9_amd64.deb
    sha:39410e629cbbc7a9e7022feb3c3fae0486977e15
  • libpython2.7_2.7.16-2+deb10u4+tuxcare.els9_arm64.deb
    sha:b3d70c4296d5148cfbd6b7a3310d0bac95e86731
  • libpython2.7-dev_2.7.16-2+deb10u4+tuxcare.els9_arm64.deb
    sha:40a75476596a1c4c8edda7ba152de47ad661f56e
  • libpython2.7-minimal_2.7.16-2+deb10u4+tuxcare.els9_arm64.deb
    sha:693ddcd692d7594a002a1fc80f8951a2794f26c7
  • libpython2.7-stdlib_2.7.16-2+deb10u4+tuxcare.els9_arm64.deb
    sha:a7fd2cf00b495ce3671a7448f015e4f08e4f1dac
  • python2.7_2.7.16-2+deb10u4+tuxcare.els9_arm64.deb
    sha:619ab16f2406a57abafbbcdf052f9ab5c86b363f
  • python2.7-dev_2.7.16-2+deb10u4+tuxcare.els9_arm64.deb
    sha:792b4554f6fc507ce08c986fe5eab0330eb9f9f8
  • python2.7-minimal_2.7.16-2+deb10u4+tuxcare.els9_arm64.deb
    sha:9f12ea83ad29debe0f40adfc655210171aed7b48
  • libpython2.7_2.7.16-2+deb10u4+tuxcare.els9_armel.deb
    sha:68d21200d5f0831dace9c307a92466393f2cd3ab
  • libpython2.7-dev_2.7.16-2+deb10u4+tuxcare.els9_armel.deb
    sha:d8c45625ae226462862a06b4510d121caaa9fefd
  • libpython2.7-minimal_2.7.16-2+deb10u4+tuxcare.els9_armel.deb
    sha:20e0edc0cbe18fb788e1b55dbe69e2084823a8c6
  • libpython2.7-stdlib_2.7.16-2+deb10u4+tuxcare.els9_armel.deb
    sha:0984642185c76848e4f1173a2ba603f113eb765c
  • python2.7_2.7.16-2+deb10u4+tuxcare.els9_armel.deb
    sha:249eece94a13c3a9351a0a905956d38bcdef3963
  • python2.7-dev_2.7.16-2+deb10u4+tuxcare.els9_armel.deb
    sha:7fb7f87395e0e6ae21af23f7c199a1df6cf067ba
  • python2.7-minimal_2.7.16-2+deb10u4+tuxcare.els9_armel.deb
    sha:285e5fc2f420e5fdb0f3671d778222a28194ea59
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.