SUSE-CU-2026:12547-1: Security update of bci/spack

sle-container-updates at lists.suse.com sle-container-updates at lists.suse.com
Wed Oct 21 10:05:18 UTC 2026 

SUSE Container Update Advisory: bci/spack
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12547-1
Container Tags        : bci/spack:0.23 , bci/spack:0.23.1 , bci/spack:0.23.1-25.72 , bci/spack:latest
Container Release     : 25.72
Severity              : important
Type                  : security
References            : 1257599 1259735 1259989 1261970 1262467 1263083 1263443 1264962
                        1265268 1266669 1267581 1267821 1267974 1268977 1269066 1269788
                        1269959 1271192 1273091 1273148 1274683 1276223 1276226 1276227
                        1276903 1277111 1277271 1280459 CVE-2026-0864 CVE-2026-11940
                        CVE-2026-11972 CVE-2026-13346 CVE-2026-15308 CVE-2026-15310 CVE-2026-15806
                        CVE-2026-1703 CVE-2026-17084 CVE-2026-18503 CVE-2026-19672 CVE-2026-3219
                        CVE-2026-3276 CVE-2026-3446 CVE-2026-3479 CVE-2026-4224 CVE-2026-4360
                        CVE-2026-6019 CVE-2026-6357 CVE-2026-6879 CVE-2026-7210 CVE-2026-7774
                        CVE-2026-82049 CVE-2026-8328 CVE-2026-8643 CVE-2026-9669 
-----------------------------------------------------------------

The container bci/spack was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4754-1
Released:    Tue Oct 20 12:50:53 2026
Summary:     Security update for python3
Type:        security
Severity:    important
References:  1257599,1259735,1259989,1261970,1262467,1263083,1263443,1264962,1265268,1266669,1267581,1267821,1267974,1268977,1269066,1269788,1269959,1271192,1273091,1273148,1274683,1276223,1276226,1276227,1276903,1277111,1277271,1280459,CVE-2026-0864,CVE-2026-11940,CVE-2026-11972,CVE-2026-13346,CVE-2026-15308,CVE-2026-15310,CVE-2026-15806,CVE-2026-1703,CVE-2026-17084,CVE-2026-18503,CVE-2026-19672,CVE-2026-3219,CVE-2026-3276,CVE-2026-3446,CVE-2026-3479,CVE-2026-4224,CVE-2026-4360,CVE-2026-6019,CVE-2026-6357,CVE-2026-6879,CVE-2026-7210,CVE-2026-7774,CVE-2026-82049,CVE-2026-8328,CVE-2026-8643,CVE-2026-9669
This update for python3 fixes the following issues:

Security issues fixed:

- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
  `configparser` module is used (bsc#1269066).
- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously
  crafted wheel archives (bsc#1257599 bsc#1274743).
- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429 bsc#1262467).
- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted
  Unicode input (bsc#1267581).
- CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).
- CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting
  hardlinks (bsc#1269959).
- CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442
  bsc#1263443).
- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high
  CPU usage (bsc#1273148).
- CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding
  protection (bsc#1264962).
- CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction directory
  (bsc#1267821).
- CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
- CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
  (bsc#1266669).
- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and
  enables arbitrary file reads and writes (bsc#1268977).
- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS
  (bsc#1269788).
- CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).
- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations
  (bsc#1271192).
- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect
  sniffing and consume significant CPU (bsc#1274683).
- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).
- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file
  modification and content disclosure (bsc#1280459).

Non security issue fixed:

- Fix an error that returned non-zero exit status 1 (bsc#1277271).
- Fix regression in `http.cookies` (bsc#1263083).  
- Update bundled pip wheels to pip-20.0.2-py2.py3-none-any.whl.


The following package changes have been done:

- libpython3_6m1_0-3.6.15-150300.10.129.1 updated
- python3-base-3.6.15-150300.10.129.1 updated

More information about the sle-container-updates mailing list