Red Hat Patches New Python Vulnerabilities
Red Hat has released updates for Python 3.11 on RHEL 9 to address a new wave of security vulnerabilities. The patches address several CVEs, including CVE-2026-21513, which is a privilege escalation vulnerability. The rapid disclosure cadence highlights the ongoing need for automated patching and dependency management in the Python ecosystem.
- The specified vulnerability, CVE-2026-21513, is not a flaw in Python; it is a security feature bypass in the Microsoft MSHTML Framework, as confirmed by multiple security advisories in February 2026. - Red Hat's recent updates to Python 3.11 on RHEL 9 addressed several other vulnerabilities, including CVE-2023-6597, a path traversal flaw in the `tempfile` module. This high-severity issue could allow a privileged user to modify file permissions outside of the intended temporary directory. - Another patched vulnerability was CVE-2024-6232, a Regular Expression Denial of Service (ReDoS) flaw in Python's `tarfile` module. A specially crafted tar archive could cause excessive backtracking in the regex engine, leading to high CPU consumption and a denial of service. - The updates also covered CVE-2024-6923, an email header injection vulnerability. This flaw in the `email` module failed to properly quote newlines in headers, potentially allowing an attacker to inject arbitrary headers and spoof emails. - The Python Software Foundation (PSF) acts as a CVE Numbering Authority (CNA), which allows it to assign CVE IDs and manage the disclosure process for vulnerabilities in Python and pip. This role is intended to streamline the reporting and remediation of security issues within the Python ecosystem. - The disclosure and patching of these vulnerabilities are managed through a coordinated process, where security researchers report issues to the PSF or project maintainers, who then develop and release fixes before the vulnerability details are made public. - Other recent Red Hat advisories for Python on RHEL 9 have included fixes for issues like a NULL-dereference in the `python-cryptography` package (CVE-2023-49083) and parsing errors in the `email` module (CVE-2023-27043).
