chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
python3.12	3.12.13-3.el8_10 -> 3.12.14-1.el8_10
python3.12-libs	3.12.13-3.el8_10 -> 3.12.14-1.el8_10
curl	7.61.1-34.el8_10.11 -> 7.61.1-34.el8_10.13
kernel-headers	4.18.0-553.156.1.el8_10 -> 4.18.0-553.157.1.el8_10
libcurl	7.61.1-34.el8_10.11 -> 7.61.1-34.el8_10.13
libcurl-devel	7.61.1-34.el8_10.11 -> 7.61.1-34.el8_10.13
sqlite-libs	3.26.0-20.el8_10 -> 3.26.0-21.el8_10

---

python: Python Tarfile: Unexpected file ownership when extracting hardlinks

CVE-2026-4360

More information

Details

A flaw was found in the Python Tarfile.extract() function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leading to unauthorized modifications or privilege issues on the system.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-4360
• https://bugzilla.redhat.com/show_bug.cgi?id=2494987
• https://www.cve.org/CVERecord?id=CVE-2026-4360
• https://nvd.nist.gov/vuln/detail/CVE-2026-4360
• https://github.com/python/cpython/issues/151987
• https://github.com/python/cpython/pull/151988
• https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/

---

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

CVE-2026-11940

More information

Details

A flaw was found in the tarfile.extractall() function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-11940
• https://bugzilla.redhat.com/show_bug.cgi?id=2491848
• https://www.cve.org/CVERecord?id=CVE-2026-11940
• https://nvd.nist.gov/vuln/detail/CVE-2026-11940
• https://github.com/python/cpython/issues/151558
• https://github.com/python/cpython/pull/151559
• https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/

---

python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module

CVE-2026-6019

More information

Details

A flaw was found in Python's http.cookies module. The Morsel.js_output() function, responsible for generating JavaScript output for cookies, does not properly neutralize the </script> HTML sequence. This oversight could allow a remote attacker to inject malicious script into a web page, potentially leading to Cross-Site Scripting (XSS) attacks. Such an attack could result in information disclosure or arbitrary code execution within the user's browser.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-6019
• https://bugzilla.redhat.com/show_bug.cgi?id=2460869
• https://www.cve.org/CVERecord?id=CVE-2026-6019
• https://nvd.nist.gov/vuln/detail/CVE-2026-6019
• https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104
• https://github.com/python/cpython/issues/90309
• https://github.com/python/cpython/pull/148848
• https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/

---

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

CVE-2026-15308

More information

Details

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-15308
• https://bugzilla.redhat.com/show_bug.cgi?id=2498608
• https://www.cve.org/CVERecord?id=CVE-2026-15308
• https://nvd.nist.gov/vuln/detail/CVE-2026-15308
• https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
• https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
• https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606
• https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd
• https://github.com/python/cpython/issues/153030
• https://github.com/python/cpython/pull/153031
• https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/

---

python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode

CVE-2026-11972

More information

Details

A flaw was found in the Python tarfile module. When processing a specially crafted tar archive opened in 'streaming mode' (mode='r|'), the module does not properly handle the end-of-file (EOF) condition. This can cause the tarfile module to enter an infinite loop, leading to a Denial of Service (DoS) for applications processing such archives.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-11972
• https://bugzilla.redhat.com/show_bug.cgi?id=2492050
• https://www.cve.org/CVERecord?id=CVE-2026-11972
• https://nvd.nist.gov/vuln/detail/CVE-2026-11972
• https://github.com/python/cpython/issues/151981
• https://github.com/python/cpython/pull/151982
• https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/

---

python: Python: Performance degradation in XML processing due to quadratic time complexity

CVE-2026-6879

More information

Details

A flaw was found in Python's xml.etree.ElementPath component. This vulnerability can lead to a denial of service (DoS) when processing specially crafted XML documents. Specifically, certain XPath index predicates used with functions like Element.findall() and Element.iterfind() can cause the processing time to increase quadratically with the size of the input, making the system unresponsive. A remote attacker could exploit this by providing a malicious XML file, potentially disrupting service availability.

Severity

Low

References

• https://access.redhat.com/security/cve/CVE-2026-6879
• https://bugzilla.redhat.com/show_bug.cgi?id=2508122
• https://www.cve.org/CVERecord?id=CVE-2026-6879
• https://nvd.nist.gov/vuln/detail/CVE-2026-6879
• https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0
• https://github.com/python/cpython/issues/152674
• https://github.com/python/cpython/pull/152676
• https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/

---

cpython: python: Extraction filter bypass for linking outside extraction directory

CVE-2025-4330

More information

Details

A flaw was found in CPython's tarfile module. This vulnerability allows bypassing of extraction filters, enabling symlink traversal outside the intended extraction directory and potential modification of file metadata via malicious tar archives using TarFile.extractall() or TarFile.extract() with the filter="data" or filter="tar" parameters. This issue leads to potentially overwriting or modifying system files and metadata.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-4330
• https://bugzilla.redhat.com/show_bug.cgi?id=2370014
• https://www.cve.org/CVERecord?id=CVE-2025-4330
• https://nvd.nist.gov/vuln/detail/CVE-2025-4330
• https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f
• https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a
• https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a
• https://github.com/python/cpython/issues/135034
• https://github.com/python/cpython/pull/135037
• https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/

---

curl: curl: Insecure connection establishment due to TLS configuration mismatch

CVE-2026-8286

More information

Details

A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-8286
• https://bugzilla.redhat.com/show_bug.cgi?id=2496763
• https://www.cve.org/CVERecord?id=CVE-2026-8286
• https://nvd.nist.gov/vuln/detail/CVE-2026-8286
• https://curl.se/docs/CVE-2026-8286.html
• https://curl.se/docs/CVE-2026-8286.json
• https://hackerone.com/reports/3718195

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.61%. Comparing base (00a9c56) to head (db21cfb).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@              Coverage Diff              @@
##           release-3.23    #3360   +/-   ##
=============================================
  Coverage         27.61%   27.61%           
=============================================
  Files                96       96           
  Lines              5424     5424           
  Branches           2523     2523           
=============================================
  Hits               1498     1498           
  Misses             3214     3214           
  Partials            712      712           

Flag	Coverage Δ
collector-unit-tests	27.61% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.