Threats Tagged 'cve-2026-15308'

The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Python HTMLParser quadratic complexity (CVE-2025-6069) * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075) * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for python313 fixes the following issues: - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044). - CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041). - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the `configparser` module is used (bsc#1269066). - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959). - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268). - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977). - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788). - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their operating systems, and relevant configuration data stored within them. Discovery also identifies and reports more detailed facts for some versions of key Red Hat packages and products that it finds in the network.

This update includes the following RPMs: python3.13: * python3.13-3.13.15-1.hum1 (aarch64, x86_64) * python3.13-debug-3.13.15-1.hum1 (aarch64, x86_64) * python3.13-devel-3.13.15-1.hum1 (aarch64, x86_64) * python3.13-freethreading-3.13.15-1.hum1 (aarch64, x86_64) * python3.13-freethreading-debug-3.13.15-1.hum1 (aarch64, x86_64) * python3.13-idle-3.13.15-1.hum1 (aarch64, x86_64) * python3.13-libs-3.13.15-1.hum1 (aarch64, x86_64) * python3.13-test-3.13.15-1.hum1 (aarch64, x86_64) * python3.13-tkinter-3.13.15-1.hum1 (aarch64, x86_64) * python3.13-3.13.15-1.hum1.src (src) Security Fix(es): python3.13: * CVE-2026-11940 * CVE-2026-11972 * CVE-2026-15308 * CVE-2026-4360 * CVE-2026-6879

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * None Known issues: * None