File _patchinfo of Package patchinfo.39617

<patchinfo incident="39617">
  <issue tracker="cve" id="2025-4435"/>
  <issue tracker="cve" id="2025-4330"/>
  <issue tracker="cve" id="2025-4138"/>
  <issue tracker="cve" id="2024-12718"/>
  <issue tracker="cve" id="2025-4517"/>
  <issue tracker="cve" id="2025-6069"/>
  <issue tracker="bnc" id="1244059">VUL-0: CVE-2025-4138: python: may allow symlink targets to point outside the destination directory, and the modification of some file metadata.</issue>
  <issue tracker="bnc" id="1244032">VUL-0: CVE-2025-4517: python: arbitrary filesystem writes outside the extraction directory during extraction with filter="data"</issue>
  <issue tracker="bnc" id="1244060">VUL-0: CVE-2025-4330: python: Extraction filter bypass for linking outside extraction directory</issue>
  <issue tracker="bnc" id="1244705">VUL-0: CVE-2025-6069: python,python3,python310,python311,python312,python313,python36,python39: worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser</issue>
  <issue tracker="bnc" id="1244061">VUL-0: CVE-2025-4435: python: Tarfile extracts filtered members when errorlevel=0</issue>
  <issue tracker="bnc" id="1244056">VUL-0: CVE-2024-12718: python: Bypass extraction filter to modify file metadata outside extraction directory</issue>
  <packager>mcepl</packager>
  <rating>important</rating>
  <category>security</category>
  <summary>Security update for python3</summary>
  <description>This update for python3 fixes the following issues:

- CVE-2024-12718: Fixed extraction filter bypass that allowed file metadata modification outside extraction directory (bsc#1244056)
- CVE-2025-4138: Fixed issue that might allow symlink targets to point outside the destination directory, and the modification of some file metadata (bsc#1244059)
- CVE-2025-4330: Fixed extraction filter bypass that allowed linking outside extraction directory (bsc#1244060)
- CVE-2025-4435: Fixed Tarfile extracts filtered members when errorlevel=0 (bsc#1244061)
- CVE-2025-4517: Fixed arbitrary filesystem writes outside the extraction directory during extraction with filter="data" (bsc#1244032)
- CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705)
</description>
</patchinfo>