certfr_avis - certfr-2026-avi-1379

CERTFR-2026-AVI-1379

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans CPython. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Python	CPython	CPython sans le dernier correctif de sécurité

References

Title

Publication Time

Tags

Bulletin de sécurité Python FNAJMZV6XQYLVPABNINDMF3VF66AYLW4	2026-10-24	vendor-advisory
Bulletin de sécurité Python 43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK	2026-10-22	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "CPython sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "CPython",
        "vendor": {
          "name": "Python",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-114583",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114583"
    },
    {
      "name": "CVE-2026-115557",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115557"
    }
  ],
  "initial_release_date": "2026-10-26T00:00:00",
  "last_revision_date": "2026-10-26T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1379",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans CPython. Elles permettent \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans CPython",
  "vendor_advisories": [
    {
      "published_at": "2026-10-24",
      "title": "Bulletin de s\u00e9curit\u00e9 Python FNAJMZV6XQYLVPABNINDMF3VF66AYLW4",
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 Python 43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK",
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"
    }
  ]
}

CVE-2026-114583 (GCVE-0-2026-114583)

Vulnerability from cvelistv5

Published

2026-10-22 20:57

Modified

2026-10-27 00:36

Severity ?

6.9 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.

References

URL

Tags

	https://github.com/python/cpython/pull/160098	patch
	https://github.com/python/cpython/issues/160097	issue-tracking
	https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/
	https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b	patch
	https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477	patch
	https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5	patch
	https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d	patch
	https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2	patch
	https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0	patch

Impacted products

	Vendor	Product	Version
	Python Software Foundation	CPython	Version: 0 Version: 3.12.0 Version: 3.13.0 Version: 3.14.0 Version: 3.15.0 Version: 3.16.0a1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "tarfile"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.11.18",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.16",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.18",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.10",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.2",
              "status": "affected",
              "version": "3.15.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.16.0",
              "status": "affected",
              "version": "3.16.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Stan Ulbrych (https://github.com/StanFromIreland)"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Ethan Furman (https://github.com/ethanfurman)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "type": "text/html",
              "value": "tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\u003cbr\u003e\u003cbr\u003eThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter."
            }
          ],
          "value": "tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T00:36:15.766Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/160098"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/160097"
        },
        {
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "tar filter allows writing outside destination via empty-named symlink",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-114583",
    "datePublished": "2026-10-22T20:57:36.019Z",
    "dateReserved": "2026-10-21T18:58:26.985Z",
    "dateUpdated": "2026-10-27T00:36:15.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115557 (GCVE-0-2026-115557)

Vulnerability from cvelistv5

Published

2026-10-24 14:15

Modified

2026-10-27 00:36

Severity ?

9.4 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CWE

CWE-299 - Improper check for certificate revocation

Summary

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

References

URL

Tags

	http://www.openwall.com/lists/oss-security/2026/10/20/29	related
	https://github.com/python/cpython/pull/160042	patch
	https://github.com/python/cpython/issues/160040	issue-tracking
	https://emudhra.we-have-a-problem.com/	third-party-advisory
	https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/	vendor-advisory
	https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d	patch
	https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd	patch
	https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93	patch
	https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6	patch
	https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5	patch
	https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b	patch
	https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90	patch
	https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8	patch
	https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78	patch
	https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370	patch
	https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e	patch
	https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3	patch

Impacted products

	Vendor	Product	Version
	Python Software Foundation	CPython	Version: 0 Version: 3.12.0 Version: 3.13.0 Version: 3.14.0 Version: 3.15.0 Version: 3.16.0a1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-24T18:07:53.662Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/24/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "ssl"
          ],
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.11.18",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.16",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.18",
              "status": "affected",
              "version": "3.13.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.14.10",
              "status": "affected",
              "version": "3.14.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.15.2",
              "status": "affected",
              "version": "3.15.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.16.0",
              "status": "affected",
              "version": "3.16.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."
            }
          ],
          "value": "Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-299",
              "description": "CWE-299 Improper check for certificate revocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T00:36:07.516Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "related"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2026/10/20/29"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/160042"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/160040"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://emudhra.we-have-a-problem.com/"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Distrust compromised intermediate certificates in ssl module",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2026-115557",
    "datePublished": "2026-10-24T14:15:14.283Z",
    "dateReserved": "2026-10-22T21:32:20.396Z",
    "dateUpdated": "2026-10-27T00:36:07.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2026-AVI-1379

Vulnerability from certfr_avis

Solutions

CVE-2026-114583 (GCVE-0-2026-114583)

Vulnerability from cvelistv5

CVE-2026-115557 (GCVE-0-2026-115557)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature