SUSE-SU-2026:3104-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2026:3104-1

HIGH8.1

Security update for python311

Published Jul 17, 2026

Modified 1 weeks ago

Fix available

Details

Description of the patch:

This update for python311 fixes the following issues

CVE-2026-1502: CR/LF bytes not rejected by HTTP client proxy tunnel headers or host (bsc#1261969).
CVE-2026-4786: URLs containing %action can bypass mitigation that allows command injection via the webbrowser.open() API (bsc#1262319).
CVE-2026-6019: HTML parser-sensitive sequence not neutralized by http.cookies.Morsel.js_output() (bsc#1262654).
CVE-2026-6100: use-after-free in decompression modules when a memory allocation fails with a MemoryError and the decompression instance is re-used (bsc#1262098).

Affected Packages

libpython3_11-1_0

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSS

Fixed in:

3.11.15-150600.3.59.3

python311-base

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSS

Fixed in:

3.11.15-150600.3.59.3

python311

SUSE Linux Enterprise Module for Python 3 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

3.11.15-150600.3.59.3

python311-curses

SUSE Linux Enterprise Module for Python 3 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

3.11.15-150600.3.59.3

python311-dbm

SUSE Linux Enterprise Module for Python 3 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

3.11.15-150600.3.59.3

python311-devel

SUSE Linux Enterprise Module for Python 3 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

3.11.15-150600.3.59.3

python311-idle

SUSE Linux Enterprise Module for Python 3 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

3.11.15-150600.3.59.3

python311-tk

SUSE Linux Enterprise Module for Python 3 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

3.11.15-150600.3.59.3

python311-tools

SUSE Linux Enterprise Module for Python 3 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

3.11.15-150600.3.59.3

References

https://bugzilla.suse.com/1261969

https://bugzilla.suse.com/1262098

https://bugzilla.suse.com/1262319

https://bugzilla.suse.com/1262654

https://lists.suse.com/pipermail/sle-updates/2026-July/048442.html

https://www.suse.com/security/cve/CVE-2026-1502/

https://www.suse.com/security/cve/CVE-2026-4786/

https://www.suse.com/security/cve/CVE-2026-6019/

https://www.suse.com/security/cve/CVE-2026-6100/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2026/suse-su-20263104-1/

CVSS Analysis

CVSS v3.1

8.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.1/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Upstream

CVE-2026-1502 CVE-2026-4786 CVE-2026-6019 CVE-2026-6100

Ecosystems(9)

SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise Server 15 SP6

Timeline

PublishedJul 17, 2026

ModifiedJul 17, 2026