Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1079
_____________________________________________________________________

DATE                : 26/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Python versions prior to 3.15.2,
                         3.14.10, 3.13.18, 3.12.16, 3.11.18.

====================================================================
https://discuss.python.org/t/python-3-15-2-3-14-10-3-13-18-3-12-16-and-3-11-18-are-out/109678
_____________________________________________________________________
 
 Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out

Oct 26

Hugo van Kemenade     hugovk CPython core developer


Here are expedited security releases of Python 3.15, 3.14, 3.13, 3.12
and 3.11.

    Python 3.15.2
    Python 3.14.10
    Python 3.13.18
    Python 3.12.16
    Python 3.11.18

They address the compromised eMudhra intermediate CA keys. These keys
are now blocked by the ssl module as a last resort against their use.
Normal uses of pip, including to upgrade pip itself, are now safe from
attacks based on those compromised keys, even if pip hasn’t been updated
yet.

    Python 3.15.2 and 3.14.10 come with binary installers.
    Python 3.13.18, 3.12.16 and 3.11.18 are source-only security
releases.


Security content in all five releases

    CVE-2026-115557 — gh-160040: Distrust compromised eMudhra
intermediate CA keys

    CVE-2026-114583 — gh-160097: Reject links replacing the destination
in tarfile.tar_filter

    gh-160300: Reject cookies with a negative version in http.cookiejar


Additional security content by version

Python 3.13.18, 3.12.16 and 3.11.18

These fixes were already included in Python 3.15.1 and 3.14.9.

    CVE-2026-77214 and CVE-2026-102633 — gh-158876: Update bundled
Expat to 2.9.0

    CVE-2024-3220 — gh-159428: Don’t read mimetypes.knownfiles by
default on Windows

    gh-87720: Fix additional header refolding-quoting edge case


Python 3.13.18 and 3.12.16

This fix was already included in Python 3.15.0 and 3.14.9.

    gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory

For the full details, see the 3.15.2 changelog, 3.14.10 changelog,
3.13.18 changelog, 3.12.16 changelog and 3.11.18 changelog.


Stay safe and upgrade!

As always, upgrading is highly recommended to all users of affected
versions.


Enjoy the new releases

Thanks to all of the many volunteers who help make Python development
and these releases possible! Please consider supporting our efforts by
volunteering yourself or through organisation contributions to the
Python Software Foundation.


Regards from a dark and windy Helsinki,

Your certified release team,
Hugo van Kemenade @hugovk

Thomas Wouters @thomas

Pablo Galindo Salgado @pablogsal

Ned Deily @nad

Steve Dower @steve.dower

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================