{
  "document": {
    "aggregate_severity": {
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      },
      {
        "category": "details",
        "text": "CVE-2026-3446: base64 decoder silently discarded data after the first padded\n  quad in binascii.a2b_base64(), which backs base64.b64decode()",
        "title": "Details"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1788183228",
        "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1788183228"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_alt_python/el8/advisories/2026/clsa-2026_1788183228.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-08-31T13:34:30Z",
      "generator": {
        "date": "2026-08-31T13:34:30Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CLSA-2026:1788183228",
      "initial_release_date": "2026-08-31T13:34:30Z",
      "revision_history": [
        {
          "date": "2026-08-31T13:34:30Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    },
    "title": "alt-python312: Fix of CVE-2026-3446"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Community Enterprise Operating System 8",
                "product": {
                  "name": "Community Enterprise Operating System 8",
                  "product_id": "CentOS-8",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:centos:centos:8:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Community Enterprise Operating System"
          }
        ],
        "category": "vendor",
        "name": "Cloud Linux Software, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "alt-python312-devel-0:3.12.14-2.el8.x86_64",
                "product": {
                  "name": "alt-python312-devel-0:3.12.14-2.el8.x86_64",
                  "product_id": "alt-python312-devel-0:3.12.14-2.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python312-devel@3.12.14-2.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python312-libs-0:3.12.14-2.el8.x86_64",
                "product": {
                  "name": "alt-python312-libs-0:3.12.14-2.el8.x86_64",
                  "product_id": "alt-python312-libs-0:3.12.14-2.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python312-libs@3.12.14-2.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python312-idle-0:3.12.14-2.el8.x86_64",
                "product": {
                  "name": "alt-python312-idle-0:3.12.14-2.el8.x86_64",
                  "product_id": "alt-python312-idle-0:3.12.14-2.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python312-idle@3.12.14-2.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python312-debug-0:3.12.14-2.el8.x86_64",
                "product": {
                  "name": "alt-python312-debug-0:3.12.14-2.el8.x86_64",
                  "product_id": "alt-python312-debug-0:3.12.14-2.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python312-debug@3.12.14-2.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python312-0:3.12.14-2.el8.x86_64",
                "product": {
                  "name": "alt-python312-0:3.12.14-2.el8.x86_64",
                  "product_id": "alt-python312-0:3.12.14-2.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python312@3.12.14-2.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python312-test-0:3.12.14-2.el8.x86_64",
                "product": {
                  "name": "alt-python312-test-0:3.12.14-2.el8.x86_64",
                  "product_id": "alt-python312-test-0:3.12.14-2.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python312-test@3.12.14-2.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python312-tkinter-0:3.12.14-2.el8.x86_64",
                "product": {
                  "name": "alt-python312-tkinter-0:3.12.14-2.el8.x86_64",
                  "product_id": "alt-python312-tkinter-0:3.12.14-2.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python312-tkinter@3.12.14-2.el8?arch=x86_64&os_name=centos&os_version=8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python312-devel-0:3.12.14-2.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python312-devel-0:3.12.14-2.el8.x86_64"
        },
        "product_reference": "alt-python312-devel-0:3.12.14-2.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python312-libs-0:3.12.14-2.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python312-libs-0:3.12.14-2.el8.x86_64"
        },
        "product_reference": "alt-python312-libs-0:3.12.14-2.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python312-idle-0:3.12.14-2.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python312-idle-0:3.12.14-2.el8.x86_64"
        },
        "product_reference": "alt-python312-idle-0:3.12.14-2.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python312-debug-0:3.12.14-2.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python312-debug-0:3.12.14-2.el8.x86_64"
        },
        "product_reference": "alt-python312-debug-0:3.12.14-2.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python312-0:3.12.14-2.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python312-0:3.12.14-2.el8.x86_64"
        },
        "product_reference": "alt-python312-0:3.12.14-2.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python312-test-0:3.12.14-2.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python312-test-0:3.12.14-2.el8.x86_64"
        },
        "product_reference": "alt-python312-test-0:3.12.14-2.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python312-tkinter-0:3.12.14-2.el8.x86_64 as a component of Community Enterprise Operating System 8",
          "product_id": "CentOS-8:alt-python312-tkinter-0:3.12.14-2.el8.x86_64"
        },
        "product_reference": "alt-python312-tkinter-0:3.12.14-2.el8.x86_64",
        "relates_to_product_reference": "CentOS-8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-3446",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "notes": [
        {
          "category": "description",
          "text": "When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use \"validate=True\" to enable stricter processing of base64 data.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "CentOS-8:alt-python312-0:3.12.14-2.el8.x86_64",
          "CentOS-8:alt-python312-debug-0:3.12.14-2.el8.x86_64",
          "CentOS-8:alt-python312-devel-0:3.12.14-2.el8.x86_64",
          "CentOS-8:alt-python312-idle-0:3.12.14-2.el8.x86_64",
          "CentOS-8:alt-python312-libs-0:3.12.14-2.el8.x86_64",
          "CentOS-8:alt-python312-test-0:3.12.14-2.el8.x86_64",
          "CentOS-8:alt-python312-tkinter-0:3.12.14-2.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-3446"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474",
          "url": "https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0e",
          "url": "https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0e"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fa",
          "url": "https://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fa"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/145264",
          "url": "https://github.com/python/cpython/issues/145264"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/145267",
          "url": "https://github.com/python/cpython/pull/145267"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/"
        }
      ],
      "release_date": "2026-04-10T19:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T13:33:50.180279Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1788183228",
          "product_ids": [
            "CentOS-8:alt-python312-0:3.12.14-2.el8.x86_64",
            "CentOS-8:alt-python312-debug-0:3.12.14-2.el8.x86_64",
            "CentOS-8:alt-python312-devel-0:3.12.14-2.el8.x86_64",
            "CentOS-8:alt-python312-idle-0:3.12.14-2.el8.x86_64",
            "CentOS-8:alt-python312-libs-0:3.12.14-2.el8.x86_64",
            "CentOS-8:alt-python312-test-0:3.12.14-2.el8.x86_64",
            "CentOS-8:alt-python312-tkinter-0:3.12.14-2.el8.x86_64"
          ],
          "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1788183228"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}