ALAS2023-2026-3407

References: CVE-2026-114583  CVE-2026-115557  CVE-2026-12345 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process.

This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter. (CVE-2026-114583)

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration. (CVE-2026-115557)

The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms. (CVE-2026-12345)

Issue Correction:
Run dnf update python3.13 --releasever 2023.12.20261109 or dnf update --advisory ALAS2023-2026-3407 --releasever 2023.12.20261109 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    python3.13-3.13.18-1.amzn2023.0.1.aarch64
    python3.13-tkinter-3.13.18-1.amzn2023.0.1.aarch64
    python3.13-idle-3.13.18-1.amzn2023.0.1.aarch64
    python3.13-devel-3.13.18-1.amzn2023.0.1.aarch64
    python3.13-debug-3.13.18-1.amzn2023.0.1.aarch64
    python3.13-debugsource-3.13.18-1.amzn2023.0.1.aarch64
    python3.13-freethreading-debug-3.13.18-1.amzn2023.0.1.aarch64
    python3.13-libs-3.13.18-1.amzn2023.0.1.aarch64
    python3.13-debuginfo-3.13.18-1.amzn2023.0.1.aarch64
    python3.13-test-3.13.18-1.amzn2023.0.1.aarch64
    python3.13-freethreading-3.13.18-1.amzn2023.0.1.aarch64

src:
    python3.13-3.13.18-1.amzn2023.0.1.src

x86_64:
    python3.13-idle-3.13.18-1.amzn2023.0.1.x86_64
    python3.13-3.13.18-1.amzn2023.0.1.x86_64
    python3.13-tkinter-3.13.18-1.amzn2023.0.1.x86_64
    python3.13-devel-3.13.18-1.amzn2023.0.1.x86_64
    python3.13-debugsource-3.13.18-1.amzn2023.0.1.x86_64
    python3.13-freethreading-debug-3.13.18-1.amzn2023.0.1.x86_64
    python3.13-debug-3.13.18-1.amzn2023.0.1.x86_64
    python3.13-libs-3.13.18-1.amzn2023.0.1.x86_64
    python3.13-debuginfo-3.13.18-1.amzn2023.0.1.x86_64
    python3.13-test-3.13.18-1.amzn2023.0.1.x86_64
    python3.13-freethreading-3.13.18-1.amzn2023.0.1.x86_64