Red Hat Security Advisory

RHSA-2026:38090

Red Hat Hardened Images RPMs Security Update

Released 2026-07-10 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images python3.13-3.13.14-1.4.hum1@aarch64, python3.13-3.13.14-1.4.hum1@src, python3.13-3.13.14-1.4.hum1@x86_64 +16

Fixes 2 records

TI-2026-10297 CVE-2026-11940 · GHSA-9mc4-rqmq-h467

tarfile extraction filter bypass allows escaping the destination directory

MEDIUM 41

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.0075 Published 2026-06-23 Partial fix · 3.10.21, 3.11.16 +4 CWE-22

TI-2025-03859 CVE-2025-4330 · GHSA-68pj-xrp5-vccj

Extraction filter bypass for linking outside extraction directory

MEDIUM 41

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2025-06-03 Partial fix · 3.9.23, 3.10.18 +4 CWE-22