SUSE-SU-2026:4941-1

    Dashboard / Vulnerabilities / SUSE-SU-2026:4941-1

    SUSE-SU-2026:4941-1

    Published: 29 Oct 2026Last Modified: 31 Oct 2026

    Summary: Security update for python313

    Details: This update for python313 fixes the following issues: - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free (bsc#1283969). - CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses (bsc#1283826). - CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227). - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file modification and content disclosure (bsc#1280459). Changes for python313: - Updated to version 3.13.16.

    References: https://www.suse.com/support/update/announcement/2026/suse-su-20264941-1/, https://bugzilla.suse.com/1276223, https://bugzilla.suse.com/1276226, https://bugzilla.suse.com/1276227, https://bugzilla.suse.com/1277111, https://bugzilla.suse.com/1280459, https://bugzilla.suse.com/1283826, https://bugzilla.suse.com/1283969, https://bugzilla.suse.com/1285433, https://www.suse.com/security/cve/CVE-2026-15310, https://www.suse.com/security/cve/CVE-2026-15806, https://www.suse.com/security/cve/CVE-2026-17084, https://www.suse.com/security/cve/CVE-2026-19445, https://www.suse.com/security/cve/CVE-2026-19553, https://www.suse.com/security/cve/CVE-2026-19672, https://www.suse.com/security/cve/CVE-2026-82049

    Affected packages

    Package

    Name: python313

    Purl: pkg:rpm/suse/python313&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP7

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.13.16-150700.4.61.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2026:4941-1 | CVE-DB