SB2026021715 - openEuler 24.03 LTS SP2 update for python3

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Type conversion (CVE-ID: CVE-2025-12781)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to a type conversion issue in b64decode(), standard_b64decode(), and urlsafe_b64decode() functions when parsing strings with "+" or "/" character. A remote attacker send specially crafted data to the application that can bypass implemented security restrictions.

2) POP3 command injection (CVE-ID: CVE-2025-15367)

The vulnerability allows a remote attacker to execute arbitrary POP3 commands.

The vulnerability exists due to insufficient input validation. A remote attacker can pass specially crafted data to the application and execute arbitrary POP3 commands on the server.

3) CRLF injection (CVE-ID: CVE-2026-0672)

The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of attacker-supplied data when using http.cookies.Morsel. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior leading to a spoofing attack.

4) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-0865)

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the application and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

5) CRLF injection (CVE-ID: CVE-2026-1299)

The vulnerability allows a remote attacker to inject arbitrary header into email messages.

The vulnerability exists due to insufficient validation of attacker-supplied data in "BytesGenerator" class. A remote attacker can pass specially crafted data to the application containing CR-LF characters and perform a spoofing attack.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-1358