SUSE-SU-2026:4630-1: important: Security update for python310
SLE-SECURITY-UPDATES
null at suse.de
Mon Oct 12 20:30:42 UTC 2026
# Security update for python310
Announcement ID: SUSE-SU-2026:4630-1
Release Date: 2026-10-12T15:25:10Z
Rating: important
References:
* bsc#1264962
* bsc#1276223
* bsc#1276226
* bsc#1276227
* bsc#1277111
* bsc#1280459
* bsc#1283826
* bsc#1283969
Cross-References:
* CVE-2026-15310
* CVE-2026-15806
* CVE-2026-17084
* CVE-2026-19445
* CVE-2026-19553
* CVE-2026-19672
* CVE-2026-7210
* CVE-2026-82049
CVSS scores:
* CVE-2026-15310 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2026-15310 ( NVD ): 2.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-15806 ( SUSE ): 6.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-15806 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-15806 ( NVD ): 6.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-17084 ( SUSE ): 6.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-17084 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-17084 ( NVD ): 6.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-19445 ( SUSE ): 8.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
* CVE-2026-19445 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
* CVE-2026-19445 ( NVD ): 9.2
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-19553 ( SUSE ): 7.6
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-19553 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-19553 ( NVD ): 7.6
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-19672 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-19672 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-19672 ( NVD ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-7210 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-7210 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-7210 ( NVD ): 6.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-7210 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-82049 ( SUSE ): 8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-82049 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-82049 ( NVD ): 8.4
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Affected Products:
* openSUSE Leap 15.4
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
An update that solves eight vulnerabilities can now be installed.
## Description:
This update for python310 fixes the following issues:
* CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use
insufficient entropy for Expat hash-flooding protection (bsc#1264962).
* CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard
decompression (bsc#1277111).
* CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL
scheme sent over another scheme (bsc#1276223).
* CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes
outside Unicode 3.2.0 (bsc#1276226).
* CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext
instances can cause use-after-free (bsc#1283969).
* CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause
silent hostname verification bypasses (bsc#1283826).
* CVE-2026-19672: tarfile extraction filter bypass allows creation of
directories outside the destination (bsc#1276227).
* CVE-2026-82049: tarfile extraction filters mishandle archives containing a
hard link to a symbolic link, allowing file modification and content
disclosure (bsc#1280459).
Changes for python310:
* Update to 3.10.22 (final release, upstream EOS)
* Security
* gh-158446: Fix a crash or incorrect output that could occur when formatting
a float or complex with a precision close to the platform's INT_MAX.
PyOS_double_to_string() now raises ValueError for any precision of that
magnitude, regardless of presentation type or value, as the format string
parsers already did for precisions above INT_MAX.
* gh-156793: asyncio: loop.start_tls() and loop.create_connection() now
validate the server_hostname argument if an ssl.SSLContext is passed with
check_hostname set to True, emitting DeprecationWarning if server_hostname
is missing. (This will raise ValueError in Python 3.13 and later.)
(bsc#1283826, CVE-2026-19553)
* gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side,
server_hostname and session arguments similar to
ssl.SSLContext.wrap_socket(), but for backward compatiblity reasons emits
DeprecationWarning instead of ValueError. In particular, a context with
check_hostname enabled and no server_hostname passed to wrap_bio() now emits
DeprecationWarning to indicate the hostname wasn't checked. (In Python 3.13
and later, this raises ValueError.)
* gh-157265: In tarfile, when extracting a link falls back to extracting a
member of the archive, skip the member when the filter function returns None
when called with the extracted member's name replaced with the link's.
* gh-157190: Fixed a vulnerability in the tarfile data and tar extraction
filters where a crafted archive using a hard link to a symbolic link could
change the permissions and modification time of a file outside the
destination directory, and expose its contents inside the extracted tree.
This addresses CVE 2026-82049.(bsc#1280459, CVE-2026-82049)
* gh-157953: Update bundled libexpat to version 2.8.5.
* gh-156002: Bound the amount of data zipfile decompresses per read for
members compressed with bzip2, LZMA, or Zstandard, matching the existing
limit for deflate. A small archive member could previously expand into an
unbounded allocation even when read in small chunks. (bsc#1277111,
CVE-2026-15310)
* gh-155999: Fix the tarfile tar and data extraction filters creating
directories outside the destination for members whose name leaves the
destination and returns to it, such as ../evil/../dest/sub/file. The
containment check used the resolved path, but intermediate directories were
created from the name as given. (bsc#1276227, CVE-2026-19672)
* gh-156293: Fix a crash in ssl when an sni_callback switches a connection to
another SSLContext and the context that carries the callback is no longer
referenced by the application. Servers that keep their sni_callback context
alive (the usual case when it wraps the listening socket or is stored on the
server object) were not affected. This addresses CVE-2026-19445.
(bsc#1283969, CVE-2026-19445)
* gh-155292: Change the stringprep module and encodings.idna codec to not
consider Unicode codepoint attributes beyond those defined in RFC 3454.
(bsc#1276226, CVE-2026-17084)
* gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr credentials to the
URL scheme, preventing credentials stored for an HTTPS URL from being used
for a matching HTTP URL, while URIs without a scheme continue to match any
scheme. (bsc#1276223, CVE-2026-15806)
* gh-149018: Improved protection against XML hash-flooding attacks in
xml.parsers.expat and xml.etree.ElementTree when Python is compiled with
libExpat 2.8.0 or later. (bsc#1264962, CVE-2026-7210)
* Library
* gh-156002: zipfile again reads members through a third-party decompressor
installed by monkey-patching the private _get_decompressor() to return an
object that only implements old BZ2Decompressor API from Python 3.3. Note
that decompressors without needs_input and two-argument decompress() are
vulnerable to CVE 2026-15310.
* gh-156353: Fix configparser parsing when using whitespace in delimiters.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-4630
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-4630
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-4630
* openSUSE Leap 15.4
zypper in -t patch SUSE-2026-4630
* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-4630
## Package List:
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
* python310-curses-debuginfo-3.10.22-150400.4.129.1
* python310-devel-3.10.22-150400.4.129.1
* python310-base-debuginfo-3.10.22-150400.4.129.1
* python310-3.10.22-150400.4.129.1
* python310-base-3.10.22-150400.4.129.1
* python310-curses-3.10.22-150400.4.129.1
* python310-idle-3.10.22-150400.4.129.1
* python310-tools-3.10.22-150400.4.129.1
* python310-dbm-3.10.22-150400.4.129.1
* libpython3_10-1_0-debuginfo-3.10.22-150400.4.129.1
* python310-dbm-debuginfo-3.10.22-150400.4.129.1
* python310-tk-3.10.22-150400.4.129.1
* libpython3_10-1_0-3.10.22-150400.4.129.1
* python310-debuginfo-3.10.22-150400.4.129.1
* python310-tk-debuginfo-3.10.22-150400.4.129.1
* python310-debugsource-3.10.22-150400.4.129.1
* python310-core-debugsource-3.10.22-150400.4.129.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
x86_64)
* python310-curses-debuginfo-3.10.22-150400.4.129.1
* python310-devel-3.10.22-150400.4.129.1
* python310-base-debuginfo-3.10.22-150400.4.129.1
* python310-3.10.22-150400.4.129.1
* python310-base-3.10.22-150400.4.129.1
* python310-curses-3.10.22-150400.4.129.1
* python310-idle-3.10.22-150400.4.129.1
* python310-tools-3.10.22-150400.4.129.1
* python310-dbm-3.10.22-150400.4.129.1
* libpython3_10-1_0-debuginfo-3.10.22-150400.4.129.1
* python310-dbm-debuginfo-3.10.22-150400.4.129.1
* python310-tk-3.10.22-150400.4.129.1
* libpython3_10-1_0-3.10.22-150400.4.129.1
* python310-debuginfo-3.10.22-150400.4.129.1
* python310-tk-debuginfo-3.10.22-150400.4.129.1
* python310-debugsource-3.10.22-150400.4.129.1
* python310-core-debugsource-3.10.22-150400.4.129.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
x86_64)
* python310-curses-debuginfo-3.10.22-150400.4.129.1
* python310-devel-3.10.22-150400.4.129.1
* python310-base-debuginfo-3.10.22-150400.4.129.1
* python310-3.10.22-150400.4.129.1
* python310-base-3.10.22-150400.4.129.1
* python310-curses-3.10.22-150400.4.129.1
* python310-idle-3.10.22-150400.4.129.1
* python310-tools-3.10.22-150400.4.129.1
* python310-dbm-3.10.22-150400.4.129.1
* libpython3_10-1_0-debuginfo-3.10.22-150400.4.129.1
* python310-dbm-debuginfo-3.10.22-150400.4.129.1
* python310-tk-3.10.22-150400.4.129.1
* libpython3_10-1_0-3.10.22-150400.4.129.1
* python310-debuginfo-3.10.22-150400.4.129.1
* python310-tk-debuginfo-3.10.22-150400.4.129.1
* python310-debugsource-3.10.22-150400.4.129.1
* python310-core-debugsource-3.10.22-150400.4.129.1
* openSUSE Leap 15.4 (aarch64 i586 ppc64le s390x x86_64)
* python310-idle-3.10.22-150400.4.129.1
* libpython3_10-1_0-3.10.22-150400.4.129.1
* python310-doc-3.10.22-150400.4.129.1
* python310-3.10.22-150400.4.129.1
* python310-dbm-debuginfo-3.10.22-150400.4.129.1
* python310-debugsource-3.10.22-150400.4.129.1
* python310-core-debugsource-3.10.22-150400.4.129.1
* python310-curses-debuginfo-3.10.22-150400.4.129.1
* python310-devel-3.10.22-150400.4.129.1
* libpython3_10-1_0-debuginfo-3.10.22-150400.4.129.1
* python310-testsuite-3.10.22-150400.4.129.1
* python310-testsuite-debuginfo-3.10.22-150400.4.129.1
* python310-base-debuginfo-3.10.22-150400.4.129.1
* python310-curses-3.10.22-150400.4.129.1
* python310-base-3.10.22-150400.4.129.1
* python310-tools-3.10.22-150400.4.129.1
* python310-dbm-3.10.22-150400.4.129.1
* python310-tk-3.10.22-150400.4.129.1
* python310-debuginfo-3.10.22-150400.4.129.1
* python310-doc-devhelp-3.10.22-150400.4.129.1
* python310-tk-debuginfo-3.10.22-150400.4.129.1
* openSUSE Leap 15.4 (x86_64)
* libpython3_10-1_0-32bit-3.10.22-150400.4.129.1
* python310-32bit-3.10.22-150400.4.129.1
* python310-32bit-debuginfo-3.10.22-150400.4.129.1
* python310-base-32bit-debuginfo-3.10.22-150400.4.129.1
* libpython3_10-1_0-32bit-debuginfo-3.10.22-150400.4.129.1
* python310-base-32bit-3.10.22-150400.4.129.1
* openSUSE Leap 15.4 (aarch64_ilp32)
* python310-64bit-debuginfo-3.10.22-150400.4.129.1
* python310-base-64bit-3.10.22-150400.4.129.1
* libpython3_10-1_0-64bit-debuginfo-3.10.22-150400.4.129.1
* python310-64bit-3.10.22-150400.4.129.1
* libpython3_10-1_0-64bit-3.10.22-150400.4.129.1
* python310-base-64bit-debuginfo-3.10.22-150400.4.129.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
* python310-curses-debuginfo-3.10.22-150400.4.129.1
* python310-devel-3.10.22-150400.4.129.1
* python310-base-debuginfo-3.10.22-150400.4.129.1
* python310-3.10.22-150400.4.129.1
* python310-base-3.10.22-150400.4.129.1
* python310-curses-3.10.22-150400.4.129.1
* python310-idle-3.10.22-150400.4.129.1
* python310-tools-3.10.22-150400.4.129.1
* python310-dbm-3.10.22-150400.4.129.1
* libpython3_10-1_0-debuginfo-3.10.22-150400.4.129.1
* python310-dbm-debuginfo-3.10.22-150400.4.129.1
* python310-tk-3.10.22-150400.4.129.1
* libpython3_10-1_0-3.10.22-150400.4.129.1
* python310-debuginfo-3.10.22-150400.4.129.1
* python310-tk-debuginfo-3.10.22-150400.4.129.1
* python310-debugsource-3.10.22-150400.4.129.1
* python310-core-debugsource-3.10.22-150400.4.129.1
## References:
* https://www.suse.com/security/cve/CVE-2026-15310.html
* https://www.suse.com/security/cve/CVE-2026-15806.html
* https://www.suse.com/security/cve/CVE-2026-17084.html
* https://www.suse.com/security/cve/CVE-2026-19445.html
* https://www.suse.com/security/cve/CVE-2026-19553.html
* https://www.suse.com/security/cve/CVE-2026-19672.html
* https://www.suse.com/security/cve/CVE-2026-7210.html
* https://www.suse.com/security/cve/CVE-2026-82049.html
* https://bugzilla.suse.com/show_bug.cgi?id=1264962
* https://bugzilla.suse.com/show_bug.cgi?id=1276223
* https://bugzilla.suse.com/show_bug.cgi?id=1276226
* https://bugzilla.suse.com/show_bug.cgi?id=1276227
* https://bugzilla.suse.com/show_bug.cgi?id=1277111
* https://bugzilla.suse.com/show_bug.cgi?id=1280459
* https://bugzilla.suse.com/show_bug.cgi?id=1283826
* https://bugzilla.suse.com/show_bug.cgi?id=1283969
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261012/27a80d94/attachment.htm>
More information about the sle-security-updates
mailing list