Amazon Linux 2023 Security Advisory: ALAS2023-2026-3230
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26
FAQs regarding Amazon Linux ALAS/CVE Severity
When decompressing crafted zip files using the bzip/LZMA/Zstandard
compressions, Python could use an attacker-controlled size to
pre-allocate memory, possibly resulting in memory exhaustion. (CVE-2026-15310)
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.
Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.
Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs. (CVE-2026-15806)
The "stringprep" module didn't process characters from RFC 3454 tables
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used
instead of the specified Unicode 3.2.0. This behavior would cause
mismatches when processing domain names using IDNA 2003 (the "idna"
codec) and the in_table_b2() function of the "stringprep" module. This
only affects domain names containing characters that were not previously
registered or had their Unicode attributes such as case-folding
behavior updated since Unicode 3.2.0. (CVE-2026-17084)
A remote, unauthenticated TLS client can make a server crash or call
through a freed pointer if its sni_callback assigns a different context to
SSLSocket.context (the documented way to select a certificate per server
name) and nothing else keeps the original ssl.SSLContext alive. Typical
cases are servers that create an SSLContext per connection or replace it
while connections are open; servers that wrap their listening socket with
it are not affected.
Mitigation: keep a reference to every SSLContext that sets sni_callback for
the lifetime of the server. TLS clients are not affected. (CVE-2026-19445)
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument
to not be None if ssl.SSLContext.check_hostname was set. Due to a
missing parameter check in SSLObject, if the server_hostname argument
isn't supplied then hostname verification would be silently skipped.
This defect could lead to programs where certificate hostname verification
*appeared* to be succeeding with SSLContext.check_hostname = True and no
ValueError being raised due to misconfiguration.
If the program passes a server_hostname value that isn't an empty string
or None to any of these APIs then certificate hostname verification
proceeds as expected and the program is not affected by this vulnerability.
Mitigating this vulnerability doesn't require updating Python or applying
the patch. To mitigate, pass a valid non-None and non-empty
server_hostname value to SSLContext.wrap_bio(),
asyncio.create_connection(), or asyncio.loop.start_tls() and
certificate hostname verification will proceed as expected. Upgrading to
the latest version of Python or applying the patch only changes the
behavior from silently skipping hostname verification to raising a
ValueError, similar to SSLContext.wrap_socket(), when server_hostname
isn't supplied. (CVE-2026-19553)
The tarfile module's tar and data
extraction filters created directories outside the destination for
members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.
Only
empty directories are created outside the destination. Member contents
are still extracted inside it. To return to the destination the member's
name must contain the destination directory's own final component, so
extraction into a secure randomised directory is not affected.
This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created. (CVE-2026-19672)
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree. (CVE-2026-82049)
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None. (CVE-2026-87910)
Affected Packages:
python3.12
Issue Correction:
Run dnf update python3.12 --releasever 2023.12.20261026 or dnf update --advisory ALAS2023-2026-3230 --releasever 2023.12.20261026 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
python3.12-devel-3.12.15-2.amzn2023.0.1.aarch64
python3.12-3.12.15-2.amzn2023.0.1.aarch64
python3.12-tkinter-3.12.15-2.amzn2023.0.1.aarch64
python3.12-idle-3.12.15-2.amzn2023.0.1.aarch64
python3.12-debugsource-3.12.15-2.amzn2023.0.1.aarch64
python3.12-debug-3.12.15-2.amzn2023.0.1.aarch64
python3.12-debuginfo-3.12.15-2.amzn2023.0.1.aarch64
python3.12-libs-3.12.15-2.amzn2023.0.1.aarch64
python3.12-test-3.12.15-2.amzn2023.0.1.aarch64
src:
python3.12-3.12.15-2.amzn2023.0.1.src
x86_64:
python3.12-idle-3.12.15-2.amzn2023.0.1.x86_64
python3.12-3.12.15-2.amzn2023.0.1.x86_64
python3.12-debugsource-3.12.15-2.amzn2023.0.1.x86_64
python3.12-tkinter-3.12.15-2.amzn2023.0.1.x86_64
python3.12-devel-3.12.15-2.amzn2023.0.1.x86_64
python3.12-debuginfo-3.12.15-2.amzn2023.0.1.x86_64
python3.12-debug-3.12.15-2.amzn2023.0.1.x86_64
python3.12-libs-3.12.15-2.amzn2023.0.1.x86_64
python3.12-test-3.12.15-2.amzn2023.0.1.x86_64