The Red Hat security advisory RHSA-2026:57660 reports security fixes for Red Hat Hardened Images RPMs, specifically python3.11 packages version 3.11.16-1.hum1. Among the addressed vulnerabilities is CVE-2026-3479, a path traversal vulnerability in Python's pkgutil.get_data() function that improperly validates the resource argument, enabling local attackers to read or write files outside the intended package directory. This can lead to integrity and confidentiality impacts, such as unauthorized file modification or information disclosure. The advisory also references CVE-2026-6019 and CVE-2026-18503 but does not detail them. Red Hat currently does not provide an official fix that meets their criteria for CVE-2026-3479, and mitigation options are limited or unavailable. The advisory includes detailed package versions and architectures affected and directs users to the Red Hat images repository for updates.

The path traversal vulnerability (CVE-2026-3479) allows a local attacker to access or modify files outside the intended directory, potentially leading to unauthorized information disclosure or modification of critical files. This can compromise system integrity by enabling code execution or bypassing security mechanisms if critical files are overwritten. The advisory rates the severity as medium and notes no known exploits in the wild. The impact includes potential integrity and confidentiality breaches but no direct availability impact is described.

Red Hat currently does not offer an official fix for CVE-2026-3479 that meets their criteria for ease of deployment and stability. Users should monitor Red Hat advisories for updates and consider upgrading to supported product versions once fixes become available. No specific mitigations are provided in the advisory. Customers with a Technical Account Manager (TAM) can consult directly for tailored guidance. Applying the updated python3.11 packages (version 3.11.16-1.hum1) from the Red Hat Hardened Images repository is recommended once available.