← All notices | Source (USN-8744-1) | Text version

QSN-8744-1: Python vulnerabilities

September 10, 2026

Summary

Several security issues were fixed in Python.

Details

It was discovered that Python's http.cookies module incorrectly handled control characters in certain cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)

It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)

It was discovered that Python's tarfile module did not correctly apply the filter parameter when extracting hard links. An attacker could possibly use this issue to cause files to be extracted with an unexpected uid or gid, bypassing the restrictions requested via filter='data'. (CVE-2026-4360)

It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method. An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019)

It was discovered that Python's html.parser module incorrectly handled repeated unterminated markup declarations. An attacker could possibly use this issue to cause Python to consume excessive CPU resources, leading to a denial of service. (CVE-2026-15308)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTSlibpython3.10Internally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlibpython3.10-devInternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlibpython3.10-minimalExternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlibpython3.10-stdlibExternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.9.1.001Ubuntu 22.04 LTSpython3.10Internally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.9.1.001Ubuntu 22.04 LTSpython3.10-devInternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.9.1.001Ubuntu 22.04 LTSpython3.10-minimalExternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibpython3.10Internally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibpython3.10-devInternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibpython3.10-minimalExternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibpython3.10-stdlibExternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.9.0.464Ubuntu 22.04 LTSpython3.10Internally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.9.0.464Ubuntu 22.04 LTSpython3.10-devInternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.9.0.464Ubuntu 22.04 LTSpython3.10-minimalExternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.8.6.015Ubuntu 22.04 LTSlibpython3.10Internally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.8.6.015Ubuntu 22.04 LTSlibpython3.10-devInternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.8.6.015Ubuntu 22.04 LTSlibpython3.10-minimalExternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.8.6.015Ubuntu 22.04 LTSlibpython3.10-stdlibExternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.8.6.015Ubuntu 22.04 LTSpython3.10Internally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.8.6.015Ubuntu 22.04 LTSpython3.10-devInternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.8.6.015Ubuntu 22.04 LTSpython3.10-minimalExternally-facing3.10.12-1~22.04.183.10.12-1~22.04.18Fixed in this release
6.8.5.018Ubuntu 22.04 LTSlibpython3.10Internally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibpython3.10-devInternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibpython3.10-minimalExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibpython3.10-stdlibExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSpython3.10Internally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSpython3.10-devInternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSpython3.10-minimalExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibpython3.10Internally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibpython3.10-devInternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibpython3.10-minimalExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibpython3.10-stdlibExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSpython3.10Internally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSpython3.10-devInternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSpython3.10-minimalExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibpython3.10Internally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibpython3.10-devInternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibpython3.10-minimalExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibpython3.10-stdlibExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSpython3.10Internally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSpython3.10-devInternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSpython3.10-minimalExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibpython3.10Internally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibpython3.10-devInternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibpython3.10-minimalExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibpython3.10-stdlibExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSpython3.10Internally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSpython3.10-devInternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSpython3.10-minimalExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibpython3.10Internally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibpython3.10-devInternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibpython3.10-minimalExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibpython3.10-stdlibExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSpython3.10Internally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSpython3.10-devInternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSpython3.10-minimalExternally-facing3.10.12-1~22.04.163.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibpython3.10Internally-facing3.10.12-1~22.04.153.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibpython3.10-devInternally-facing3.10.12-1~22.04.153.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibpython3.10-minimalExternally-facing3.10.12-1~22.04.153.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibpython3.10-stdlibExternally-facing3.10.12-1~22.04.153.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSpython3.10Internally-facing3.10.12-1~22.04.153.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSpython3.10-devInternally-facing3.10.12-1~22.04.153.10.12-1~22.04.18Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSpython3.10-minimalExternally-facing3.10.12-1~22.04.153.10.12-1~22.04.18Fixed by QuantaStor security update

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-3644, CVE-2026-4360, CVE-2026-6019, CVE-2026-4224, CVE-2026-15308

References

https://ubuntu.com/security/notices/USN-8744-1

https://nvd.nist.gov/vuln/detail/CVE-2026-3644

https://nvd.nist.gov/vuln/detail/CVE-2026-4360

https://nvd.nist.gov/vuln/detail/CVE-2026-6019

https://nvd.nist.gov/vuln/detail/CVE-2026-4224

https://nvd.nist.gov/vuln/detail/CVE-2026-15308

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
bionicpython2.72.7.17-1~18.04ubuntu1.13+esm15
bionicpython3.63.6.9-1~18.04ubuntu1.13+esm10
bionicpython3.73.7.5-2ubuntu1~18.04.2+esm11
bionicpython3.83.8.0-3ubuntu1~18.04.2+esm11
Ubuntu 20.04 LTSpython2.72.7.18-1~20.04.7+esm10
Ubuntu 20.04 LTSpython3.83.8.10-0ubuntu1~20.04.18+esm7
Ubuntu 20.04 LTSpython3.93.9.5-3ubuntu0~20.04.1+esm11
Ubuntu 22.04 LTSpython2.72.7.18-13ubuntu1.5+esm9
Ubuntu 22.04 LTSpython3.103.10.12-1~22.04.18
Ubuntu 22.04 LTSpython3.113.11.0~rc1-1~22.04.1+esm2
Ubuntu 24.04 LTSpython3.123.12.3-1ubuntu0.17
resolutepython3.143.14.4-1ubuntu0.2
trustypython2.72.7.6-8ubuntu0.6+esm30
trustypython3.43.4.3-1ubuntu1~14.04.7+esm21
trustypython3.53.5.2-2ubuntu0~16.04.4~14.04.1+esm11
xenialpython2.72.7.12-1ubuntu0~16.04.18+esm22
xenialpython3.53.5.2-2ubuntu0~16.04.13+esm25