[<prev] [next>] [day] [month] [year] [list]
Message-ID: <bb431f15-e168-4ea1-b7fb-51b6ac368250@oracle.com>
Date: Thu, 5 Mar 2026 08:34:25 -0800
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Fwd: [CVE-2026-2297] SourcelessFileLoader does not use
io.open_code()
-------- Forwarded Message --------
Subject: [Security-announce][CVE-2026-2297] SourcelessFileLoader does not use io.open_code()
Date: Wed, 4 Mar 2026 22:42:49 +0000
From: Seth Larson <seth@...hon.org>
Reply-To: security-sig@...hon.org
To: security-announce@...hon.org
There is a MEDIUM severity vulnerability affecting CPython.
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
Please see the linked CVE ID for the latest information on affected versions:
* https://www.cve.org/CVERecord?id=CVE-2026-2297
* https://github.com/python/cpython/pull/145507
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
