CVE-2026-3479
ADVISORY - nistSummary
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.
pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
Common Weakness Enumeration (CWE)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Docker
CVE-2026-3479
-
| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| python | dhi | - | - | <3.13.13 | 3.13.13 |
| alpine/python-3.10 | apk | alpine | 3.23 | <3.13.13 | 3.13.13 |
| alpine/python-3.10 | apk | alpine | 3.23 | >=3.14.0-alpha1,<3.14.4 | 3.14.4 |
| alpine/python-3.10 | apk | alpine | 3.23 | >=3.15.0-alpha1,<3.15.0-alpha8 | 3.15.0-alpha8 |
| alpine/python-3.11 | apk | alpine | 3.23 | <3.13.13 | 3.13.13 |
| alpine/python-3.11 | apk | alpine | 3.23 | >=3.14.0-alpha1,<3.14.4 | 3.14.4 |
| alpine/python-3.11 | apk | alpine | 3.23 | >=3.15.0-alpha1,<3.15.0-alpha8 | 3.15.0-alpha8 |
| alpine/python-3.12 | apk | alpine | 3.23 | <3.13.13 | 3.13.13 |
| alpine/python-3.12 | apk | alpine | 3.23 | >=3.14.0-alpha1,<3.14.4 | 3.14.4 |
| alpine/python-3.12 | apk | alpine | 3.23 | >=3.15.0-alpha1,<3.15.0-alpha8 | 3.15.0-alpha8 |
| alpine/python-3.13 | apk | alpine | 3.23 | <3.13.13 | 3.13.13 |
| alpine/python-3.13 | apk | alpine | 3.23 | >=3.14.0-alpha1,<3.14.4 | 3.14.4 |
| alpine/python-3.13 | apk | alpine | 3.23 | >=3.15.0-alpha1,<3.15.0-alpha8 | 3.15.0-alpha8 |
| alpine/python-3.14 | apk | alpine | 3.23 | <3.13.13 | 3.13.13 |
| alpine/python-3.14 | apk | alpine | 3.23 | >=3.14.0-alpha1,<3.14.4 | 3.14.4 |
| alpine/python-3.14 | apk | alpine | 3.23 | >=3.15.0-alpha1,<3.15.0-alpha8 | 3.15.0-alpha8 |
| python | dhi | - | - | >=3.14.0-alpha1,<3.14.4 | 3.14.4 |
| python | dhi | - | - | >=3.15.0-alpha1,<3.15.0-alpha8 | 3.15.0-alpha8 |
Severity and metrics
No CVSS data available from this advisory.
NIST
-
Debian
-
CVSS SCORE
N/AlowUbuntu
-
CVSS SCORE
N/AmediumBitnami
BIT-libpython-2026-3479
-
CVSS SCORE
2.1lowBitnami
BIT-python-2026-3479
-
CVSS SCORE
2.1lowBitnami
BIT-python-min-2026-3479
-
CVSS SCORE
2.1lowRed Hat
1.8
CVSS SCORE
3.3lowChainguard
CGA-g3hc-7hgr-hfv4
-
minimos
MINI-7q7x-rxp3-2ppf
-
minimos
MINI-8cv8-pf76-4gj2
-
minimos
MINI-c8r3-rcw9-8mq2
-
minimos
MINI-fvg5-6r76-6g9x
-
minimos
MINI-j2cp-79jc-95mq
-