Bug 2448746 (CVE-2026-3479)

Summary: CVE-2026-3479 python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bbrownin, dfreiber, drow, jburrell, jkoehler, lphiri, sdawley, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Python's `pkgutil.get_data()` function, which is used to retrieve data from packages. This function did not properly validate the `resource` argument, allowing a local attacker to perform path traversal attacks. Path traversal enables an attacker to access files and directories stored outside the intended root directory, potentially leading to information disclosure or unintended file access.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2449250, 2449251, 2449253, 2449254, 2449255, 2449256, 2449257, 2449258, 2449259, 2449260, 2449261, 2449262    
Bug Blocks:    

Description OSIDB Bzimport 2026-03-18 19:02:53 UTC
pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.