Red Hat Product Errata RHSA-2026:4168 - Security Advisory
Issued:
2026-03-10
Updated:
2026-03-10

RHSA-2026:4168 - Security Advisory

Synopsis

Moderate: python3.9 security update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for python3.9 is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • cpython: IMAP command injection in user-controlled commands (CVE-2025-15366)
  • cpython: POP3 command injection in user-controlled commands (CVE-2025-15367)
  • cpython: email header injection due to unquoted newlines (CVE-2026-1299)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 9 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x

Fixes

  • BZ - 2431368 - CVE-2025-15366 cpython: IMAP command injection in user-controlled commands
  • BZ - 2431373 - CVE-2025-15367 cpython: POP3 command injection in user-controlled commands
  • BZ - 2432437 - CVE-2026-1299 cpython: email header injection due to unquoted newlines

Red Hat Enterprise Linux for x86_64 9

SRPM
python3.9-3.9.25-3.el9_7.1.src.rpm SHA-256: 709407d45a96801a59c63a902b341a07acfb91cb0f58a43ee123d3cd1128ff30
x86_64
python-unversioned-command-3.9.25-3.el9_7.1.noarch.rpm SHA-256: f0b982bd1aef79c7389814cf16dbfe64737be8692bd9f9ae2f0a8618e397bdd6
python3-3.9.25-3.el9_7.1.x86_64.rpm SHA-256: d21de06ad0b98cdc04021a37330071758a71fb712a808f82e4ae715727f5f639
python3-devel-3.9.25-3.el9_7.1.i686.rpm SHA-256: ca25c91896d0bd94db4d2ccbd2ca15a5332d748b552ae957381fc594c1002ced
python3-devel-3.9.25-3.el9_7.1.x86_64.rpm SHA-256: 55648beaf394ed152eaf1e40c8d326b94b1ca812d0566d926a6ad3199b62400b
python3-libs-3.9.25-3.el9_7.1.i686.rpm SHA-256: 9ba961ac096262d37a47eac8226d322bc876e5219624929553964a2b90a473f4
python3-libs-3.9.25-3.el9_7.1.x86_64.rpm SHA-256: c371182b9b33f245737e82ffef539f9fbd9adc0a0f1c7fab0fda24459e4e4695
python3-tkinter-3.9.25-3.el9_7.1.x86_64.rpm SHA-256: 278518f45a1a050140d83d19da7e94ab9af3813f4bfe35bfb23181710ca8097b
python3.9-debuginfo-3.9.25-3.el9_7.1.i686.rpm SHA-256: b4bfd250d42c3b2872ea1ac63c4a23b841739ba49e2793fad801d90c7dbe613d
python3.9-debuginfo-3.9.25-3.el9_7.1.i686.rpm SHA-256: b4bfd250d42c3b2872ea1ac63c4a23b841739ba49e2793fad801d90c7dbe613d
python3.9-debuginfo-3.9.25-3.el9_7.1.x86_64.rpm SHA-256: a44e3b275a30ae4dbbfcc8784f2dfd8377637086858f81f6d677f0813988f160
python3.9-debuginfo-3.9.25-3.el9_7.1.x86_64.rpm SHA-256: a44e3b275a30ae4dbbfcc8784f2dfd8377637086858f81f6d677f0813988f160
python3.9-debugsource-3.9.25-3.el9_7.1.i686.rpm SHA-256: fb2045147e72fa3a3e8c7503a711204633e8254278deacecbac9527629c3b810
python3.9-debugsource-3.9.25-3.el9_7.1.i686.rpm SHA-256: fb2045147e72fa3a3e8c7503a711204633e8254278deacecbac9527629c3b810
python3.9-debugsource-3.9.25-3.el9_7.1.x86_64.rpm SHA-256: a8ddea03365775bd398e713a666e3870b4343afb2910907b0e839b1c1f49f7c8
python3.9-debugsource-3.9.25-3.el9_7.1.x86_64.rpm SHA-256: a8ddea03365775bd398e713a666e3870b4343afb2910907b0e839b1c1f49f7c8

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
python3.9-3.9.25-3.el9_7.1.src.rpm SHA-256: 709407d45a96801a59c63a902b341a07acfb91cb0f58a43ee123d3cd1128ff30
s390x
python-unversioned-command-3.9.25-3.el9_7.1.noarch.rpm SHA-256: f0b982bd1aef79c7389814cf16dbfe64737be8692bd9f9ae2f0a8618e397bdd6
python3-3.9.25-3.el9_7.1.s390x.rpm SHA-256: 189fc08337a19a4571c604d68eeeb5292d2a5b8c992618447d1ce8d1304c11d1
python3-devel-3.9.25-3.el9_7.1.s390x.rpm SHA-256: 30c1655be9561935a81719fdecbf585756370186bfed02733918de9ed17b58ef
python3-libs-3.9.25-3.el9_7.1.s390x.rpm SHA-256: ae9b15b36841c05898becad3ad9762efb8dd5f6062dee1603e16e669cc6135e0
python3-tkinter-3.9.25-3.el9_7.1.s390x.rpm SHA-256: 0c8ba5c1318dd71e05772bb7fcddae8e6780a3dec803fb63567892119cfe579b
python3.9-debuginfo-3.9.25-3.el9_7.1.s390x.rpm SHA-256: bacbe658843496bcf43533dd360deca16332a1c009b945a3a89eab08d9a98fdd
python3.9-debuginfo-3.9.25-3.el9_7.1.s390x.rpm SHA-256: bacbe658843496bcf43533dd360deca16332a1c009b945a3a89eab08d9a98fdd
python3.9-debugsource-3.9.25-3.el9_7.1.s390x.rpm SHA-256: 30a0970c0a0db4eb88feece4c13da9ba7399c241046b34193fd3a926e812833a
python3.9-debugsource-3.9.25-3.el9_7.1.s390x.rpm SHA-256: 30a0970c0a0db4eb88feece4c13da9ba7399c241046b34193fd3a926e812833a

Red Hat Enterprise Linux for Power, little endian 9

SRPM
python3.9-3.9.25-3.el9_7.1.src.rpm SHA-256: 709407d45a96801a59c63a902b341a07acfb91cb0f58a43ee123d3cd1128ff30
ppc64le
python-unversioned-command-3.9.25-3.el9_7.1.noarch.rpm SHA-256: f0b982bd1aef79c7389814cf16dbfe64737be8692bd9f9ae2f0a8618e397bdd6
python3-3.9.25-3.el9_7.1.ppc64le.rpm SHA-256: 16b01ac5723f154af8e28e3ec509d02e0004d33d94f88a32ba500fd8b706ee6c
python3-devel-3.9.25-3.el9_7.1.ppc64le.rpm SHA-256: 5710c3328db669629d22f66c2f7e4d31b17241d7d1162a8bf086b614ac3a2859
python3-libs-3.9.25-3.el9_7.1.ppc64le.rpm SHA-256: f8c56d080571593094bd605b61043327f2c0f1b3c4e86e00b19d38e7d55e5e7b
python3-tkinter-3.9.25-3.el9_7.1.ppc64le.rpm SHA-256: 13979a8b55116f9350a1799e00fe02bc9e3cce200689247250ce0ba85526d8c5
python3.9-debuginfo-3.9.25-3.el9_7.1.ppc64le.rpm SHA-256: b024e6acd21db48033f6123315b044d869d9707f0ffc6df3f51212ba7bd277a0
python3.9-debuginfo-3.9.25-3.el9_7.1.ppc64le.rpm SHA-256: b024e6acd21db48033f6123315b044d869d9707f0ffc6df3f51212ba7bd277a0
python3.9-debugsource-3.9.25-3.el9_7.1.ppc64le.rpm SHA-256: c8b2949145a3e6fe7aff1c27f612e78e6ed41f0f5aff6a0b4eed3ea1d35d14b1
python3.9-debugsource-3.9.25-3.el9_7.1.ppc64le.rpm SHA-256: c8b2949145a3e6fe7aff1c27f612e78e6ed41f0f5aff6a0b4eed3ea1d35d14b1

Red Hat Enterprise Linux for ARM 64 9

SRPM
python3.9-3.9.25-3.el9_7.1.src.rpm SHA-256: 709407d45a96801a59c63a902b341a07acfb91cb0f58a43ee123d3cd1128ff30
aarch64
python-unversioned-command-3.9.25-3.el9_7.1.noarch.rpm SHA-256: f0b982bd1aef79c7389814cf16dbfe64737be8692bd9f9ae2f0a8618e397bdd6
python3-3.9.25-3.el9_7.1.aarch64.rpm SHA-256: b0a5c7df41a0d5943242e92bcf1e6d11f9934afa3d7b2a4e357fc459f7b97676
python3-devel-3.9.25-3.el9_7.1.aarch64.rpm SHA-256: 0e1f1fc950df1d7c4e6497e4571e584f986f5a496184d3d380a9f03dacbdeeae
python3-libs-3.9.25-3.el9_7.1.aarch64.rpm SHA-256: f64cf789ff3f3fc687cfc347ff1741bb834be1556ecd461e07e524cb027e1d79
python3-tkinter-3.9.25-3.el9_7.1.aarch64.rpm SHA-256: 8eeeca978150d825812fa841e4f78d4d0d85f8b531985793d4d363d06efeef98
python3.9-debuginfo-3.9.25-3.el9_7.1.aarch64.rpm SHA-256: a65c8e9c7d3b812e3ab21a41c9559293605d7efc6710e73af28aef2ddb21e381
python3.9-debuginfo-3.9.25-3.el9_7.1.aarch64.rpm SHA-256: a65c8e9c7d3b812e3ab21a41c9559293605d7efc6710e73af28aef2ddb21e381
python3.9-debugsource-3.9.25-3.el9_7.1.aarch64.rpm SHA-256: 827819a09cfd1816f56919dab359d9c8c4b50e58e5296d99049b20360a07704b
python3.9-debugsource-3.9.25-3.el9_7.1.aarch64.rpm SHA-256: 827819a09cfd1816f56919dab359d9c8c4b50e58e5296d99049b20360a07704b

Red Hat CodeReady Linux Builder for x86_64 9

SRPM
x86_64
python3-3.9.25-3.el9_7.1.i686.rpm SHA-256: 6f0e8b6899fc41d7fd24b95f3012d888c7a46419744f1207138b931b5475c4fc
python3-debug-3.9.25-3.el9_7.1.i686.rpm SHA-256: 6b56ade9b38db0332c02fb4520da392758dd8e5bff2aa69196c3c464810dc987
python3-debug-3.9.25-3.el9_7.1.x86_64.rpm SHA-256: 9a6d5e5dd81d3bfe219ca04a8b2c9e1bf9bb67e07a91e7039f4889c02a667fb6
python3-idle-3.9.25-3.el9_7.1.i686.rpm SHA-256: d2e5ba728f78a27c3fffc820fb59c65625a719247a0a4277bf1a9fc97c2cdba4
python3-idle-3.9.25-3.el9_7.1.x86_64.rpm SHA-256: 3a09daaa17664b0c93cc8418cc8b31fc9c20cc4aa2497ff95733456a9a38c0fc
python3-test-3.9.25-3.el9_7.1.i686.rpm SHA-256: b3874f8f27f481d5bf2309fee93bec7a35dbe3d632767bbc218dc7cbb1b3b9b2
python3-test-3.9.25-3.el9_7.1.x86_64.rpm SHA-256: e87ccc2f50e2da791921c119f1d48d2edac07910ad1d2ff319a26259fdb00834
python3-tkinter-3.9.25-3.el9_7.1.i686.rpm SHA-256: 8f9fc87df09d125e4a81fb1a15879fd6cc4ec5b4f160143d77fa1c151916b402
python3.9-debuginfo-3.9.25-3.el9_7.1.i686.rpm SHA-256: b4bfd250d42c3b2872ea1ac63c4a23b841739ba49e2793fad801d90c7dbe613d
python3.9-debuginfo-3.9.25-3.el9_7.1.x86_64.rpm SHA-256: a44e3b275a30ae4dbbfcc8784f2dfd8377637086858f81f6d677f0813988f160
python3.9-debugsource-3.9.25-3.el9_7.1.i686.rpm SHA-256: fb2045147e72fa3a3e8c7503a711204633e8254278deacecbac9527629c3b810
python3.9-debugsource-3.9.25-3.el9_7.1.x86_64.rpm SHA-256: a8ddea03365775bd398e713a666e3870b4343afb2910907b0e839b1c1f49f7c8

Red Hat CodeReady Linux Builder for Power, little endian 9

SRPM
ppc64le
python3-debug-3.9.25-3.el9_7.1.ppc64le.rpm SHA-256: 2fa0f40207f1a893f315806afe74c30dc8f2d4bb8b5fb7fb7198a735dbe15491
python3-idle-3.9.25-3.el9_7.1.ppc64le.rpm SHA-256: 44d2548563bd97a0ddafd25545db250038988b6d02c191674b070880398f7b15
python3-test-3.9.25-3.el9_7.1.ppc64le.rpm SHA-256: d6d02b4c1656b4d4a31e90055019885f59b302387fa7adbc181b5c1f423a2fd1
python3.9-debuginfo-3.9.25-3.el9_7.1.ppc64le.rpm SHA-256: b024e6acd21db48033f6123315b044d869d9707f0ffc6df3f51212ba7bd277a0
python3.9-debugsource-3.9.25-3.el9_7.1.ppc64le.rpm SHA-256: c8b2949145a3e6fe7aff1c27f612e78e6ed41f0f5aff6a0b4eed3ea1d35d14b1

Red Hat CodeReady Linux Builder for ARM 64 9

SRPM
aarch64
python3-debug-3.9.25-3.el9_7.1.aarch64.rpm SHA-256: 9151b329856840a596ae57711ca9c486a8562c765f35c8de13c46ad94f87e4be
python3-idle-3.9.25-3.el9_7.1.aarch64.rpm SHA-256: ab1e30cd3b69850fd55d17efedf36bcf83524732eb0824775a1cc65195cccc3e
python3-test-3.9.25-3.el9_7.1.aarch64.rpm SHA-256: 9296bff1e7cb583bc334385cdb809fd9f085004906efdcbb93199c3b9af1cfd3
python3.9-debuginfo-3.9.25-3.el9_7.1.aarch64.rpm SHA-256: a65c8e9c7d3b812e3ab21a41c9559293605d7efc6710e73af28aef2ddb21e381
python3.9-debugsource-3.9.25-3.el9_7.1.aarch64.rpm SHA-256: 827819a09cfd1816f56919dab359d9c8c4b50e58e5296d99049b20360a07704b

Red Hat CodeReady Linux Builder for IBM z Systems 9

SRPM
s390x
python3-debug-3.9.25-3.el9_7.1.s390x.rpm SHA-256: 5dcbc585dc1f221b95a5ab027b69b50ddf9316409445f8e3e8c26f6251013104
python3-idle-3.9.25-3.el9_7.1.s390x.rpm SHA-256: f83b3519ddb83f44555456dbfddee54831b6029075805675d1ce563de43c29ac
python3-test-3.9.25-3.el9_7.1.s390x.rpm SHA-256: 3b9b5b6c51e7a9e19782f1fc454ef4f10554afdb1ed4c2a97c6a0485177af2a2
python3.9-debuginfo-3.9.25-3.el9_7.1.s390x.rpm SHA-256: bacbe658843496bcf43533dd360deca16332a1c009b945a3a89eab08d9a98fdd
python3.9-debugsource-3.9.25-3.el9_7.1.s390x.rpm SHA-256: 30a0970c0a0db4eb88feece4c13da9ba7399c241046b34193fd3a926e812833a

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.