Skip to content

[CVE-2026-3479] Documented pkgutil.get_data() restrictions are not enforced #146121

Closed
Closed
[CVE-2026-3479] Documented pkgutil.get_data() restrictions are not enforced#146121
Assignees
StanFromIreland
Labels
3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixesrelease-blockerstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Description

@StanFromIreland
StanFromIreland
opened on Mar 18, 2026

Please see PR for more information.

The PSRT has decided to treat this as a security issue since this was a documented restriction.

Linked PRs

Activity

  1. StanFromIreland
    self-assigned this
    on Mar 18, 2026
  2. StanFromIreland
    added
    type-securityA security issue
    stdlibStandard Library Python modules in the Lib/ directory
    3.11only security fixes
    3.10 (EOL)end of life
    3.12only security fixes
    3.13only security fixes
    3.14bugs and security fixes
    3.15bugs and security fixes
    on Mar 18, 2026
  3. FFY00
    added a commit that references this issue on Mar 18, 2026

    gh-146121: `pkgutil.get_data()` reject invalid resource arguments (#1…

    bcdf231
  4. miss-islington
    added 5 commits that reference this issue on Mar 18, 2026

    pythongh-146121: `pkgutil.get_data()` reject invalid resource argumen…

    e21d57f

    pythongh-146121: `pkgutil.get_data()` reject invalid resource argumen…

    777bb8a

    pythongh-146121: `pkgutil.get_data()` reject invalid resource argumen…

    b99e2bf

    pythongh-146121: `pkgutil.get_data()` reject invalid resource argumen…

    7614ae8

    pythongh-146121: `pkgutil.get_data()` reject invalid resource argumen…

    b238b78

  5. 9 remaining items

  6. encukou
    added a commit that references this issue on Apr 7, 2026

    gh-146121: Clarify security model of pkgutil.getdata; revert checks (G…

    cf59bf7
  7. miss-islington
    added a commit that references this issue on Apr 7, 2026

    pythongh-146121: Clarify security model of pkgutil.getdata; revert ch…

    5fc3a10
  8. Yhg1s
    added a commit that references this issue on Apr 7, 2026

    [3.13] gh-146121: Clarify security model of pkgutil.getdata; revert c…

    5af6ce3
  9. encukou
    added a commit that references this issue on Apr 7, 2026

    [3.14] gh-146121: Clarify security model of pkgutil.getdata (GH-148197)…

    d786d59
  10. encukou
    closed this as completedon Apr 7, 2026
  11. github-project-automation
    moved this from Todo to Done in Release and Deferred blockers 🚫on Apr 7, 2026
  12. bmwiedemann
    added a commit that references this issue on Apr 15, 2026

    Update python311 to version 3.11.15 / rev 68 via SR 1345247

    d07c87a
  13. ljfp
    added 2 commits that reference this issue on Apr 25, 2026

    pythongh-146121: `pkgutil.get_data()` reject invalid resource argumen…

    1714462

    pythongh-146121: Clarify security model of pkgutil.getdata; revert ch…

    15a222b
  14. mcepl
    added 3 commits that reference this issue on Sep 18, 2026

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    4c2ff50

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    2bb1462

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    39b46f3
  15. mcepl
    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    7675d25

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    144c5b6

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    f1e1e54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixesrelease-blockerstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions