ALAS2023-2026-1964

References: CVE-2025-13462  CVE-2026-0864  CVE-2026-11972 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations. (CVE-2025-13462)

When using the "configparser" module to write configuration files
containing multi-line text values with carriage return characters (\r) the
resulting file could be injected with unexpected keys and values if the
attacker controls the written value. (CVE-2026-0864)

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. (CVE-2026-11972)

Issue Correction:
Run dnf update python3.13 --releasever 2023.12.20260720 or dnf update --advisory ALAS2023-2026-1964 --releasever 2023.12.20260720 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    python3.13-3.13.14-1.amzn2023.0.2.aarch64
    python3.13-idle-3.13.14-1.amzn2023.0.2.aarch64
    python3.13-devel-3.13.14-1.amzn2023.0.2.aarch64
    python3.13-tkinter-3.13.14-1.amzn2023.0.2.aarch64
    python3.13-debugsource-3.13.14-1.amzn2023.0.2.aarch64
    python3.13-freethreading-debug-3.13.14-1.amzn2023.0.2.aarch64
    python3.13-debug-3.13.14-1.amzn2023.0.2.aarch64
    python3.13-libs-3.13.14-1.amzn2023.0.2.aarch64
    python3.13-debuginfo-3.13.14-1.amzn2023.0.2.aarch64
    python3.13-test-3.13.14-1.amzn2023.0.2.aarch64
    python3.13-freethreading-3.13.14-1.amzn2023.0.2.aarch64

src:
    python3.13-3.13.14-1.amzn2023.0.2.src

x86_64:
    python3.13-tkinter-3.13.14-1.amzn2023.0.2.x86_64
    python3.13-debugsource-3.13.14-1.amzn2023.0.2.x86_64
    python3.13-idle-3.13.14-1.amzn2023.0.2.x86_64
    python3.13-3.13.14-1.amzn2023.0.2.x86_64
    python3.13-devel-3.13.14-1.amzn2023.0.2.x86_64
    python3.13-debug-3.13.14-1.amzn2023.0.2.x86_64
    python3.13-freethreading-debug-3.13.14-1.amzn2023.0.2.x86_64
    python3.13-debuginfo-3.13.14-1.amzn2023.0.2.x86_64
    python3.13-libs-3.13.14-1.amzn2023.0.2.x86_64
    python3.13-test-3.13.14-1.amzn2023.0.2.x86_64
    python3.13-freethreading-3.13.14-1.amzn2023.0.2.x86_64