SUSE-SU-2026:1530-1

UNKNOWN

Security update for python311

Published Apr 21, 2026

Modified 4 days ago

Fix available

Details

This update for python311 fixes the following issues:

CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).
CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
CVE-2026-4519: leading dashes in URLs are accepted by the webbrowser.open() API and allow for web browser command line option injection (bsc#1260026).

Affected Packages(13 packages)

libpython3_11-1_0

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Public Cloud 15 SP4

Fixed in:

3.11.15-150400.9.85.1

python311

Fixed in:

3.11.15-150400.9.85.1

python311-base

Fixed in:

3.11.15-150400.9.85.1

python311-core

Fixed in:

3.11.15-150400.9.85.1

python311-curses