ALAS2023-2026-1963

References: CVE-2026-0864  CVE-2026-11940  CVE-2026-11972  CVE-2026-3276  CVE-2026-9669 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

When using the "configparser" module to write configuration files
containing multi-line text values with carriage return characters (\r) the
resulting file could be injected with unexpected keys and values if the
attacker controls the written value. (CVE-2026-0864)

tarfile.extractall() with the 'data' or 'tar'
filter could be bypassed by a crafted archive where a hardlink
references a symlink stored at a deeper name than the hardlink itself.
The extraction fallback validated the symlink at it's archived location
but recreated it at the hardlink's shallower
path, letting a relative
target the filter judged contained escape the destination directory.
This allowed a malicious tar archive to create a symlink pointing
outside the destination, enabling out-of-destination file reads or
writes. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. (CVE-2026-11972)

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms. (CVE-2026-3276)

bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data. (CVE-2026-9669)

Issue Correction:
Run dnf update python3.9 --releasever 2023.12.20260720 or dnf update --advisory ALAS2023-2026-1963 --releasever 2023.12.20260720 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    python3-devel-3.9.25-1.amzn2023.0.8.aarch64
    python3-idle-3.9.25-1.amzn2023.0.8.aarch64
    python3-tkinter-3.9.25-1.amzn2023.0.8.aarch64
    python3-3.9.25-1.amzn2023.0.8.aarch64
    python3-debug-3.9.25-1.amzn2023.0.8.aarch64
    python3.9-debugsource-3.9.25-1.amzn2023.0.8.aarch64
    python3.9-debuginfo-3.9.25-1.amzn2023.0.8.aarch64
    python3-libs-3.9.25-1.amzn2023.0.8.aarch64
    python3-test-3.9.25-1.amzn2023.0.8.aarch64

noarch:
    python-unversioned-command-3.9.25-1.amzn2023.0.8.noarch

src:
    python3.9-3.9.25-1.amzn2023.0.8.src

x86_64:
    python3-devel-3.9.25-1.amzn2023.0.8.x86_64
    python3.9-debugsource-3.9.25-1.amzn2023.0.8.x86_64
    python3-idle-3.9.25-1.amzn2023.0.8.x86_64
    python3-tkinter-3.9.25-1.amzn2023.0.8.x86_64
    python3-3.9.25-1.amzn2023.0.8.x86_64
    python3-debug-3.9.25-1.amzn2023.0.8.x86_64
    python3.9-debuginfo-3.9.25-1.amzn2023.0.8.x86_64
    python3-test-3.9.25-1.amzn2023.0.8.x86_64
    python3-libs-3.9.25-1.amzn2023.0.8.x86_64