Logo
componentpython3
Name
python3
Version
3.14.6
Type
library
Description
-
Licenses
Python-2.0others
PURL
-
CPE
cpe:2.3:a:python:python:3.14.6:-:*:*:*:*:*:*

Other Versions#


Project
Branch
Version
2025.02.x
3.12.13

Patches#


#
Title
Author
Resolve
1
Make the build of pyc files conditional
Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2
Add an option to disable pydoc
Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
3
Add an option to disable IDLE
Maxime Ripard <maxime.ripard@free-electrons.com>
4
configure.ac: move PY_STDLIB_MOD_SET_NA further up
Thomas Petazzoni <thomas.petazzoni@bootlin.com>
5
Add option to disable the sqlite3 module
Thomas Petazzoni <thomas.petazzoni@bootlin.com>
6
Add an option to disable the tk module
Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
7
Add an option to disable the curses module
Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
8
Add an option to disable expat
Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
9
configure.ac: detect unusable termio operations
Thomas Petazzoni <thomas.petazzoni@bootlin.com>
10
gh-139275: Fix compilation of
Pablo Galindo Salgado <Pablogsal@gmail.com>
11
[3.14] gh-151558: Fix symlink escape via `tarfile`
"Miss Islington (bot)"
CVE-2026-11940

Vulnerabilities#


Name
Analysis
Description
Exploitable
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
Exploitable
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Patched
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory.  This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.