SUSE-SU-2026:1530-1

HIGH7.5

Security update for python311

Published Apr 21, 2026

Modified 1 months ago

Fix available

Details

Description of the patch:

This update for python311 fixes the following issues:

CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).
CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
CVE-2026-4519: leading dashes in URLs are accepted by the webbrowser.open() API and allow for web browser command line option injection (bsc#1260026).

Affected Packages(11 packages)

libpython3_11-1_0

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Public Cloud 15 SP4

Fixed in:

3.11.15-150400.9.85.1

python311

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Public Cloud 15 SP4

Fixed in:

3.11.15-150400.9.85.1

python311-base

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Public Cloud 15 SP4

Fixed in:

3.11.15-150400.9.85.1

python311-curses

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

3.11.15-150400.9.85.1

python311-dbm

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

3.11.15-150400.9.85.1

python311-devel

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

3.11.15-150400.9.85.1

python311-doc

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

3.11.15-150400.9.85.1

python311-doc-devhelp

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

3.11.15-150400.9.85.1

python311-idle

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

3.11.15-150400.9.85.1

python311-tk

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

3.11.15-150400.9.85.1

References

https://bugzilla.suse.com/1259611

https://bugzilla.suse.com/1259734

https://bugzilla.suse.com/1259735

https://bugzilla.suse.com/1259989

https://bugzilla.suse.com/1260026

https://lists.suse.com/pipermail/sle-updates/2026-April/045830.html

https://www.suse.com/security/cve/CVE-2025-13462/

https://www.suse.com/security/cve/CVE-2026-3479/

https://www.suse.com/security/cve/CVE-2026-3644/

https://www.suse.com/security/cve/CVE-2026-4224/

https://www.suse.com/security/cve/CVE-2026-4519/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2026/suse-su-20261530-1/

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Upstream

CVE-2025-13462 CVE-2026-3479 CVE-2026-3644 CVE-2026-4224 CVE-2026-4519

Ecosystems(9)

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Public Cloud 15 SP4

Timeline

PublishedApr 21, 2026

ModifiedApr 21, 2026

SUSE-SU-2026:1530-1 | Mondoo Vulnerability Intelligence