Red Hat Security AdvisoryRHSA-2026:68132
Red Hat Hardened Images RPMs Security Update
Released 2026-09-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images python3.10-3.10.21-1.3.hum1@aarch64, python3.10-3.10.21-1.3.hum1@src, python3.10-3.10.21-1.3.hum1@x86_64 +12
Fixes 4 records
Priority LOW 38
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link.
CVSS 4.0HIGH 8.4· Local · No auth · User interaction · EPSS 0.00188 · Published 2026-09-14 · Fixed in 3.10.22, 3.11.17 +3 CWE-59
Priority LOW 36
bz2.BZ2Decompressor objects could be reused after a decompression error.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00428 · Published 2026-06-08 · Partial fix · 3.10.21, 3.11.16 +4 CWE-121
Priority LOW 29
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00486 · Published 2026-06-03 · Partial fix · 3.10.21, 3.11.16 +4 CWE-407
Priority LOW 27
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed.
CVSS 4.0MEDIUM 5.9· Network · No auth · User interaction · EPSS 0.00457 · Published 2026-05-13 · Fixed in 3.10.21, 3.11.16 +4 CWE-918
