python310-core (SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS package python310-core, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (24)

• CVE-2025-4517 — CVSS 9.4 (critical): Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this…
• CVE-2024-8088: There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API…
• CVE-2023-6597 — CVSS 7.8 (high): An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and…
• CVE-2023-52425 — CVSS 7.5 (high): libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large…
• CVE-2024-6232 — CVSS 7.5 (high): There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile…
• CVE-2024-7592 — CVSS 7.5 (high): There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that…
• CVE-2026-3644 — CVSS 7.5 (high): The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and…
• CVE-2025-4138 — CVSS 7.5 (high): Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of…
• CVE-2025-4330 — CVSS 7.5 (high): Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of…
• CVE-2026-4224 — CVSS 7.5 (high): When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content…
• CVE-2024-0450 — CVSS 6.2 (medium): An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile…
• CVE-2025-15282: User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
• CVE-2026-0672: When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects…
• CVE-2026-0865: User-controlled header names and values containing newlines can allow injecting HTTP headers.
• CVE-2025-15366: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects…
• CVE-2025-15367: The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands…
• CVE-2025-4516: There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape"…
• CVE-2025-11468: When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This…
• CVE-2024-6923 — CVSS 5.5 (medium): There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when…
• CVE-2023-27043 — CVSS 5.3 (medium): The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an…
• CVE-2024-12718 — CVSS 5.3 (medium): Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside…
• CVE-2025-13462 — CVSS 3.3 (low): The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such…
• CVE-2026-4519 — CVSS 3.3 (low): The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers…
• CVE-2026-3479: DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as…