SUSE-SU-2026:4630-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2026/suse-su-20264630-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:4630-1

Upstream

CVE (8)

Related

CVE (8)

Published

2026-10-12T15:25:09Z

Modified

2026-10-13T10:30:04Z

Summary

Security update for python310

Details

This update for python310 fixes the following issues:

CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free (bsc#1283969).
CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses (bsc#1283826).
CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).
CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file modification and content disclosure (bsc#1280459).

Changes for python310:

Update to 3.10.22 (final release, upstream EOS)
Security
gh-158446: Fix a crash or incorrect output that could occur when formatting a float or complex with a precision close to the platform's INT_MAX. PyOS_double_to_string() now raises ValueError for any precision of that magnitude, regardless of presentation type or value, as the format string parsers already did for precisions above INT_MAX.
gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate the server_hostname argument if an ssl.SSLContext is passed with check_hostname set to True, emitting DeprecationWarning if server_hostname is missing. (This will raise ValueError in Python 3.13 and later.) (bsc#1283826, CVE-2026-19553)
gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments similar to ssl.SSLContext.wrap_socket(), but for backward compatiblity reasons emits DeprecationWarning instead of ValueError. In particular, a context with check_hostname enabled and no server_hostname passed to wrap_bio() now emits DeprecationWarning to indicate the hostname wasn't checked. (In Python 3.13 and later, this raises ValueError.)
gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member's name replaced with the link's.
gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049.(bsc#1280459, CVE-2026-82049)
gh-157953: Update bundled libexpat to version 2.8.5.
gh-156002: Bound the amount of data zipfile decompresses per read for members compressed with bzip2, LZMA, or Zstandard, matching the existing limit for deflate. A small archive member could previously expand into an unbounded allocation even when read in small chunks. (bsc#1277111, CVE-2026-15310)
gh-155999: Fix the tarfile tar and data extraction filters creating directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. (bsc#1276227, CVE-2026-19672)
gh-156293: Fix a crash in ssl when an sni_callback switches a connection to another SSLContext and the context that carries the callback is no longer referenced by the application. Servers that keep their sni_callback context alive (the usual case when it wraps the listening socket or is stored on the server object) were not affected. This addresses CVE-2026-19445. (bsc#1283969, CVE-2026-19445)
gh-155292: Change the stringprep module and encodings.idna codec to not consider Unicode codepoint attributes beyond those defined in RFC 3454. (bsc#1276226, CVE-2026-17084)
gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr credentials to the URL scheme, preventing credentials stored for an HTTPS URL from being used for a matching HTTP URL, while URIs without a scheme continue to match any scheme. (bsc#1276223, CVE-2026-15806)
gh-149018: Improved protection against XML hash-flooding attacks in xml.parsers.expat and xml.etree.ElementTree when Python is compiled with libExpat 2.8.0 or later. (bsc#1264962, CVE-2026-7210)
Library
gh-156002: zipfile again reads members through a third-party decompressor installed by monkey-patching the private _get_decompressor() to return an object that only implements old BZ2Decompressor API from Python 3.3. Note that decompressors without needs_input and two-argument decompress() are vulnerable to CVE 2026-15310.
gh-156353: Fix configparser parsing when using whitespace in delimiters.

References

Affected packages

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS

python310

Package

Name: python310
Purl: pkg:rpm/suse/python310&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.10.22-150400.4.129.1

Ecosystem specific

{
    "binaries":  [
        {
            "libpython3_10-1_0":  "3.10.22-150400.4.129.1",
            "python310":  "3.10.22-150400.4.129.1",
            "python310-base":  "3.10.22-150400.4.129.1",
            "python310-curses":  "3.10.22-150400.4.129.1",
            "python310-dbm":  "3.10.22-150400.4.129.1",
            "python310-devel":  "3.10.22-150400.4.129.1",
            "python310-idle":  "3.10.22-150400.4.129.1",
            "python310-tk":  "3.10.22-150400.4.129.1",
            "python310-tools":  "3.10.22-150400.4.129.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"

python310-core

Package

Name: python310-core
Purl: pkg:rpm/suse/python310-core&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.10.22-150400.4.129.1

Ecosystem specific

{
    "binaries":  [
        {
            "libpython3_10-1_0":  "3.10.22-150400.4.129.1",
            "python310":  "3.10.22-150400.4.129.1",
            "python310-base":  "3.10.22-150400.4.129.1",
            "python310-curses":  "3.10.22-150400.4.129.1",
            "python310-dbm":  "3.10.22-150400.4.129.1",
            "python310-devel":  "3.10.22-150400.4.129.1",
            "python310-idle":  "3.10.22-150400.4.129.1",
            "python310-tk":  "3.10.22-150400.4.129.1",
            "python310-tools":  "3.10.22-150400.4.129.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"

SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS

python310

Package

Name: python310
Purl: pkg:rpm/suse/python310&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.10.22-150400.4.129.1

Ecosystem specific

{
    "binaries":  [
        {
            "libpython3_10-1_0":  "3.10.22-150400.4.129.1",
            "python310":  "3.10.22-150400.4.129.1",
            "python310-base":  "3.10.22-150400.4.129.1",
            "python310-curses":  "3.10.22-150400.4.129.1",
            "python310-dbm":  "3.10.22-150400.4.129.1",
            "python310-devel":  "3.10.22-150400.4.129.1",
            "python310-idle":  "3.10.22-150400.4.129.1",
            "python310-tk":  "3.10.22-150400.4.129.1",
            "python310-tools":  "3.10.22-150400.4.129.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"

python310-core

Package

Name: python310-core
Purl: pkg:rpm/suse/python310-core&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.10.22-150400.4.129.1

Ecosystem specific

{
    "binaries":  [
        {
            "libpython3_10-1_0":  "3.10.22-150400.4.129.1",
            "python310":  "3.10.22-150400.4.129.1",
            "python310-base":  "3.10.22-150400.4.129.1",
            "python310-curses":  "3.10.22-150400.4.129.1",
            "python310-dbm":  "3.10.22-150400.4.129.1",
            "python310-devel":  "3.10.22-150400.4.129.1",
            "python310-idle":  "3.10.22-150400.4.129.1",
            "python310-tk":  "3.10.22-150400.4.129.1",
            "python310-tools":  "3.10.22-150400.4.129.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"

SUSE:Linux Enterprise Server 15 SP4-LTSS

python310

Package

Name: python310
Purl: pkg:rpm/suse/python310&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.10.22-150400.4.129.1

Ecosystem specific

{
    "binaries":  [
        {
            "libpython3_10-1_0":  "3.10.22-150400.4.129.1",
            "python310":  "3.10.22-150400.4.129.1",
            "python310-base":  "3.10.22-150400.4.129.1",
            "python310-curses":  "3.10.22-150400.4.129.1",
            "python310-dbm":  "3.10.22-150400.4.129.1",
            "python310-devel":  "3.10.22-150400.4.129.1",
            "python310-idle":  "3.10.22-150400.4.129.1",
            "python310-tk":  "3.10.22-150400.4.129.1",
            "python310-tools":  "3.10.22-150400.4.129.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"

python310-core

Package

Name: python310-core
Purl: pkg:rpm/suse/python310-core&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.10.22-150400.4.129.1

Ecosystem specific

{
    "binaries":  [
        {
            "libpython3_10-1_0":  "3.10.22-150400.4.129.1",
            "python310":  "3.10.22-150400.4.129.1",
            "python310-base":  "3.10.22-150400.4.129.1",
            "python310-curses":  "3.10.22-150400.4.129.1",
            "python310-dbm":  "3.10.22-150400.4.129.1",
            "python310-devel":  "3.10.22-150400.4.129.1",
            "python310-idle":  "3.10.22-150400.4.129.1",
            "python310-tk":  "3.10.22-150400.4.129.1",
            "python310-tools":  "3.10.22-150400.4.129.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP4

python310

Package

Name: python310
Purl: pkg:rpm/suse/python310&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.10.22-150400.4.129.1

Ecosystem specific

{
    "binaries":  [
        {
            "libpython3_10-1_0":  "3.10.22-150400.4.129.1",
            "python310":  "3.10.22-150400.4.129.1",
            "python310-base":  "3.10.22-150400.4.129.1",
            "python310-curses":  "3.10.22-150400.4.129.1",
            "python310-dbm":  "3.10.22-150400.4.129.1",
            "python310-devel":  "3.10.22-150400.4.129.1",
            "python310-idle":  "3.10.22-150400.4.129.1",
            "python310-tk":  "3.10.22-150400.4.129.1",
            "python310-tools":  "3.10.22-150400.4.129.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"

python310-core

Package

Name: python310-core
Purl: pkg:rpm/suse/python310-core&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.10.22-150400.4.129.1

Ecosystem specific

{
    "binaries":  [
        {
            "libpython3_10-1_0":  "3.10.22-150400.4.129.1",
            "python310":  "3.10.22-150400.4.129.1",
            "python310-base":  "3.10.22-150400.4.129.1",
            "python310-curses":  "3.10.22-150400.4.129.1",
            "python310-dbm":  "3.10.22-150400.4.129.1",
            "python310-devel":  "3.10.22-150400.4.129.1",
            "python310-idle":  "3.10.22-150400.4.129.1",
            "python310-tk":  "3.10.22-150400.4.129.1",
            "python310-tools":  "3.10.22-150400.4.129.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4630-1.json"