Release date:
2026-05-07 14:58:17 UTC
Description:
* SECURITY UPDATE: binascii.a2b_base64 / base64.b64decode stop decoding
after the first padded quad, silently dropping any excess data. The
behaviour can lead to data being accepted that other implementations
process differently.
- debian/patches/CVE-2026-3446.patch: backport of upstream commits
4561f6418a (main), e31c55121620 (3.14), 1f9958f909c1 (3.13). Treats
the pad character as non-alphabet data per RFC 4648 section 3.3:
the loop in binascii_a2b_base64 no longer breaks out on a pad
sequence; a `pads` counter is added so post-loop validation still
raises "Incorrect padding" for inputs that do not satisfy
`quad_pos + pads == 4`. The unused `binascii_find_valid` helper
is removed.
- CVE-2026-3446
Updated packages:
-
alt-python27_2.7.18-18_amd64.deb
sha:d63682d1ef5d43076ec82483aeb77c2b4275c9b2
-
alt-python27-debug_2.7.18-18_amd64.deb
sha:77e688f4ac5545b74ed0d2439aee127f199d522f
-
alt-python27-devel_2.7.18-18_amd64.deb
sha:67a24ae0c03d9c256fb36d35e58cff49d085b46f
-
alt-python27-idle_2.7.18-18_amd64.deb
sha:7a5bb0942110f7591868f8e72bf04b4733345956
-
alt-python27-libs_2.7.18-18_amd64.deb
sha:e7a198db9f29bca0a149504ba97e905661294d4e
-
alt-python27-test_2.7.18-18_amd64.deb
sha:6f6ead248762829f19ac4ea2bb8dd85bb4fc4c32
-
alt-python27-tkinter_2.7.18-18_amd64.deb
sha:b99b8853ce2b9276ce5bda80f2d028d0e84be6db
-
alt-python27-tools_2.7.18-18_amd64.deb
sha:e03d0f750c351a89ac935e9a14eb9884fbb72060
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
