python3 (SUSE:Linux Enterprise Server for SAP Applications 15 SP5) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server for SAP Applications 15 SP5 package python3, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (15)

• CVE-2025-4517 — CVSS 9.4 (critical): Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this…
• CVE-2025-4138 — CVSS 7.5 (high): Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of…
• CVE-2025-4330 — CVSS 7.5 (high): Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of…
• CVE-2025-8194 — CVSS 7.5 (high): There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar…
• CVE-2025-4435 — CVSS 7.5 (high): When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and…
• CVE-2026-1299: The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email…
• CVE-2025-15282: User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
• CVE-2026-0672: When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects…
• CVE-2026-0865: User-controlled header names and values containing newlines can allow injecting HTTP headers.
• CVE-2025-15366: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects…
• CVE-2025-15367: The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands…
• CVE-2025-4516: There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape"…
• CVE-2025-11468: When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This…
• CVE-2024-12718 — CVSS 5.3 (medium): Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside…
• CVE-2025-6069 — CVSS 4.3 (medium): The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading…