SUSE-SU-2026:4946-1

    Dashboard / Vulnerabilities / SUSE-SU-2026:4946-1

    SUSE-SU-2026:4946-1

    Published: 29 Oct 2026Last Modified: 31 Oct 2026

    Summary: Security update for python311

    Details: This update for python311 fixes the following issues: - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free (bsc#1283969). - CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses (bsc#1283826). - CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227). - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file modification and content disclosure (bsc#1280459). Changes for python311: - Update to version 3.11.17.

    References: https://www.suse.com/support/update/announcement/2026/suse-su-20264946-1/, https://bugzilla.suse.com/1267974, https://bugzilla.suse.com/1276223, https://bugzilla.suse.com/1276226, https://bugzilla.suse.com/1276227, https://bugzilla.suse.com/1277111, https://bugzilla.suse.com/1280459, https://bugzilla.suse.com/1283826, https://bugzilla.suse.com/1283969, https://bugzilla.suse.com/1285433, https://www.suse.com/security/cve/CVE-2026-15310, https://www.suse.com/security/cve/CVE-2026-15806, https://www.suse.com/security/cve/CVE-2026-17084, https://www.suse.com/security/cve/CVE-2026-19445, https://www.suse.com/security/cve/CVE-2026-19553, https://www.suse.com/security/cve/CVE-2026-19672, https://www.suse.com/security/cve/CVE-2026-82049, https://www.suse.com/security/cve/CVE-2026-9669

    Affected packages

    Package

    Name: python311-core

    Purl: pkg:rpm/suse/python311-core&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.11.17-150600.3.74.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2026:4946-1 | CVE-DB