Bug 2553131 (CVE-2026-79824)

Summary:	CVE-2026-79824 Hewlett Packard Enterprise HPE NonStop Python 3.x: directory traversal
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bbrownin, cahl, dfreiber, dkeler, drow, dschmidt, gbenhaim, ikhan, jburrell, jlanda, kshier, lbalhar, ljawale, msilmser, niyer, rbobbitt, rhel-process-autobot, simaishi, stcannon, suppawar, thason, twaugh, vkumar, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-15 09:32:10 UTC

A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.

Comment 1 Lumír Balhar 2026-10-21 15:37:56 UTC

This CVE seems to be just a newly assigned CVE number to an old bug CVE-2007-4559 for HPE NonStop Python - something we should not care about.