Your message dated Sat, 05 Sep 2026 16:32:06 +0000
with message-id <[email protected]>
and subject line Bug#1141533: fixed in python3.13 3.13.5-2+deb13u5
has caused the Debian Bug report #1141533,
regarding pypy3: CVE-2026-11940
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1141533: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141533
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: pypy3
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
The following vulnerability was published for pypy3.
CVE-2026-11940[0]:
| tarfile.extractall() with the 'data' or 'tar' filter could be
| bypassed by a crafted archive where a hardlink references a symlink
| stored at a deeper name than the hardlink itself. The extraction
| fallback validated the symlink at it's archived location but
| recreated it at the hardlink's shallower path, letting a relative
| target the filter judged contained escape the destination
| directory. This allowed a malicious tar archive to create a
| symlink pointing outside the destination, enabling out-of-
| destination file reads or writes. This was an incomplete fix of
| CVE-2025-4330.
https://github.com/python/cpython/issues/151558
https://github.com/python/cpython/pull/151559
https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df
(3.15 branch)
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-11940
https://www.cve.org/CVERecord?id=CVE-2026-11940
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: python3.13
Source-Version: 3.13.5-2+deb13u5
Done: Moritz Mühlenhoff <[email protected]>
We believe that the bug you reported is fixed in the latest version of
python3.13, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Moritz Mühlenhoff <[email protected]> (supplier of updated python3.13 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 10 Aug 2026 14:06:59 +0200
Source: python3.13
Architecture: source
Version: 3.13.5-2+deb13u5
Distribution: trixie
Urgency: medium
Maintainer: Matthias Klose <[email protected]>
Changed-By: Moritz Mühlenhoff <[email protected]>
Closes: 1141524 1141531 1141533 1141534
Changes:
python3.13 (3.13.5-2+deb13u5) trixie; urgency=medium
.
* CVE-2026-6879
* CVE-2026-0864 (Closes: #1141524)
* CVE-2026-4360 (Closes: #1141531)
* CVE-2026-11940 (Closes: #1141533)
* CVE-2026-11972 (Closes: #1141534)
Checksums-Sha1:
c6d5fe11260ea54c96caeda6dbf817983980fff0 4298 python3.13_3.13.5-2+deb13u5.dsc
412b8df93c26d980ddcb4407728ec93504a898fa 299640
python3.13_3.13.5-2+deb13u5.debian.tar.xz
Checksums-Sha256:
4be84e20fb902354fa86955e2fbea6e8bdbd158f54833423488308a9b3532662 4298
python3.13_3.13.5-2+deb13u5.dsc
a51f456e654ce2c9b40cc1db8005e5041cdb0b2c3aa96ab0871c49fe95280366 299640
python3.13_3.13.5-2+deb13u5.debian.tar.xz
Files:
d8bba168e3c3dce76ecddeed76d9dc3a 4298 python optional
python3.13_3.13.5-2+deb13u5.dsc
3c05432fbc5501a90208f9efd06f6e8c 299640 python optional
python3.13_3.13.5-2+deb13u5.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmqay4oACgkQEMKTtsN8
TjYvVA/+JIvNeFaT9Ncg+iOE4ARiP4u6HZXEALCGYCvYEGdVaAY5HT5Q07tXxP2/
C5R83aLlnrjZ4i9nICz6lmhtszNVfrd9cuI8sfvraTPnWA/PMiIVOsaIao+WJr3e
Nh+SdPzdMq/SzCMrypCcO1osmykC6M9vF560wyp+OQnUxernAVTO6706yFeqIAAE
WcfQO9jWqxzHpP1vgrUxpANE67ibnOXHTv4g6vsHj1G3GaXPv+a0tzDFRr7+Axwj
JgXR1C4gEj5lPsBdanOKtykzBf5yg88v7xDWmONX6S0chSuY2jiSpMGO983++akd
a/ovIsD4pUWUueYzYb3FVF4tEu224oD+BwOUxExtk/ymU5Wqnd0jgxAmi1ssJyNQ
DgxkOtxPpgGB1YtRuqCrlbUCPfyiARd5897J8JrTPCm2k1ZI+TZNcl/t8WYeRU48
MyHgh5l32Orq1fPwmZIr4t5iwhEur+PS5VjyU2G9XsEX+cdU6qGh+QUlWnpk4aC4
09sBYODyemyiYUqpHxKu2HI6WWJkWf0pNs+kGTCINr5xYS4BW+jd6L6AjacHEgDm
Mk9FIteUnzUlxVHGY2f9qeTQ4XIOyx9dweKGboYn771riaY9SY2BU48QyrcDmhn4
mrdV52xpn/gtZAQEXAwzQVIfAtv9Uj6e+ryisEP0bahEZTR6cIU=
=CTkN
-----END PGP SIGNATURE-----
pgpkzrc8TN4XE.pgp
Description: PGP signature
--- End Message ---
