ALAS2-2026-3228

Amazon Linux 2 Security Advisory: ALAS2-2026-3228
Advisory Released Date: 2026-04-14
Advisory Updated Date: 2026-04-14
Severity: Important
Issue Overview:

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations. (CVE-2025-13462)

pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals. (CVE-2026-3479)

The webbrowser.open() API would accept leading dashes in the URL which
could be handled as command line options for certain web browsers. New
behavior rejects leading dashes. Users are recommended to sanitize URLs
prior to passing to webbrowser.open(). (CVE-2026-4519)


Affected Packages:

python3


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update python3 or yum update --advisory ALAS2-2026-3228 to update your system.

New Packages:
aarch64:
    python3-3.7.16-1.amzn2.0.25.aarch64
    python3-libs-3.7.16-1.amzn2.0.25.aarch64
    python3-devel-3.7.16-1.amzn2.0.25.aarch64
    python3-tools-3.7.16-1.amzn2.0.25.aarch64
    python3-tkinter-3.7.16-1.amzn2.0.25.aarch64
    python3-test-3.7.16-1.amzn2.0.25.aarch64
    python3-debug-3.7.16-1.amzn2.0.25.aarch64
    python3-debuginfo-3.7.16-1.amzn2.0.25.aarch64

i686:
    python3-3.7.16-1.amzn2.0.25.i686
    python3-libs-3.7.16-1.amzn2.0.25.i686
    python3-devel-3.7.16-1.amzn2.0.25.i686
    python3-tools-3.7.16-1.amzn2.0.25.i686
    python3-tkinter-3.7.16-1.amzn2.0.25.i686
    python3-test-3.7.16-1.amzn2.0.25.i686
    python3-debug-3.7.16-1.amzn2.0.25.i686
    python3-debuginfo-3.7.16-1.amzn2.0.25.i686

src:
    python3-3.7.16-1.amzn2.0.25.src

x86_64:
    python3-3.7.16-1.amzn2.0.25.x86_64
    python3-libs-3.7.16-1.amzn2.0.25.x86_64
    python3-devel-3.7.16-1.amzn2.0.25.x86_64
    python3-tools-3.7.16-1.amzn2.0.25.x86_64
    python3-tkinter-3.7.16-1.amzn2.0.25.x86_64
    python3-test-3.7.16-1.amzn2.0.25.x86_64
    python3-debug-3.7.16-1.amzn2.0.25.x86_64
    python3-debuginfo-3.7.16-1.amzn2.0.25.x86_64

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2025-13462, CVE-2026-3479, CVE-2026-4519

Mitre: CVE-2025-13462, CVE-2026-3479, CVE-2026-4519