ALAS2-2026-3227

Amazon Linux 2 Security Advisory: ALAS2-2026-3227
Advisory Released Date: 2026-04-14
Advisory Updated Date: 2026-04-14
Severity: Important
Issue Overview:

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations. (CVE-2025-13462)

pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals. (CVE-2026-3479)

The webbrowser.open() API would accept leading dashes in the URL which
could be handled as command line options for certain web browsers. New
behavior rejects leading dashes. Users are recommended to sanitize URLs
prior to passing to webbrowser.open(). (CVE-2026-4519)


Affected Packages:

python


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update python or yum update --advisory ALAS2-2026-3227 to update your system.

New Packages:
aarch64:
    python-2.7.18-1.amzn2.0.18.aarch64
    python-libs-2.7.18-1.amzn2.0.18.aarch64
    python-devel-2.7.18-1.amzn2.0.18.aarch64
    python-tools-2.7.18-1.amzn2.0.18.aarch64
    tkinter-2.7.18-1.amzn2.0.18.aarch64
    python-test-2.7.18-1.amzn2.0.18.aarch64
    python-debug-2.7.18-1.amzn2.0.18.aarch64
    python-debuginfo-2.7.18-1.amzn2.0.18.aarch64

i686:
    python-2.7.18-1.amzn2.0.18.i686
    python-libs-2.7.18-1.amzn2.0.18.i686
    python-devel-2.7.18-1.amzn2.0.18.i686
    python-tools-2.7.18-1.amzn2.0.18.i686
    tkinter-2.7.18-1.amzn2.0.18.i686
    python-test-2.7.18-1.amzn2.0.18.i686
    python-debug-2.7.18-1.amzn2.0.18.i686
    python-debuginfo-2.7.18-1.amzn2.0.18.i686

src:
    python-2.7.18-1.amzn2.0.18.src

x86_64:
    python-2.7.18-1.amzn2.0.18.x86_64
    python-libs-2.7.18-1.amzn2.0.18.x86_64
    python-devel-2.7.18-1.amzn2.0.18.x86_64
    python-tools-2.7.18-1.amzn2.0.18.x86_64
    tkinter-2.7.18-1.amzn2.0.18.x86_64
    python-test-2.7.18-1.amzn2.0.18.x86_64
    python-debug-2.7.18-1.amzn2.0.18.x86_64
    python-debuginfo-2.7.18-1.amzn2.0.18.x86_64

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2025-13462, CVE-2026-3479, CVE-2026-4519

Mitre: CVE-2025-13462, CVE-2026-3479, CVE-2026-4519