THREATIST.IORead the docs Red Hat Hardened Images RPMs Security Update
Released 2026-04-23 · Red Hat rating Moderate · View on Red Hat →
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed.
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK.
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open().