[CVE-2026-3479] Documented pkgutil.get_data() restrictions are not enforced #146121

Activity

1. StanFromIreland

   changed the title [-]Documented `pkgutil.get_data()` restrictions are not enforced[/-] [+][CVE-2026-3479] Documented `pkgutil.get_data()` restrictions are not enforced[/+] on Mar 18, 2026
2. encukou commented on Mar 19, 2026

   

   encukou

   on Mar 19, 2026

   Member

   More actions

   Sorry for finding this late. Please hold off on the backports for a bit of PSRT discussion.
3. mcepl commented on Mar 30, 2026

   

   mcepl

   on Mar 30, 2026

   Contributor

   More actions

   Sorry for finding this late. Please hold off on the backports for a bit of PSRT discussion.

   @encukou Still? We have it as CVE, so it should be fixed promptly.
4. encukou

   added

   release-blocker

   on Apr 7, 2026
5. github-project-automation

   added this to Release and Deferred blockers 🚫on Apr 7, 2026
6. github-project-automation

   moved this to Todo in Release and Deferred blockers 🚫on Apr 7, 2026
7. encukou

   added a commit that references this issue on Apr 7, 2026

   Revert "pythongh-146121: `pkgutil.get_data()` reject invalid resource…

   ...

   8376908
8. encukou commented on Apr 7, 2026

   

   encukou

   on Apr 7, 2026

   Member

   More actions

   It'll be a disputed CVE shortly.
   pkgutil.get_data() has the same security model as open().
9. encukou commented on Apr 7, 2026

   

   encukou

   on Apr 7, 2026

   Member

   More actions

   (Sorry for the delay -- PSRT is rather busy nowadays)
10. encukou

    added a commit that references this issue on Apr 7, 2026

    gh-146121: Clarify security model of pkgutil.getdata; revert checks (G…

    ...

    cf59bf7
11. miss-islington

    added a commit that references this issue on Apr 7, 2026

    pythongh-146121: Clarify security model of pkgutil.getdata; revert ch…

    ...

    5fc3a10
12. Yhg1s

    added a commit that references this issue on Apr 7, 2026

    [3.13] gh-146121: Clarify security model of pkgutil.getdata; revert c…

    ...

    5af6ce3
13. encukou

    added a commit that references this issue on Apr 7, 2026

    [3.14] gh-146121: Clarify security model of pkgutil.getdata (GH-148197)…

    ...

    d786d59
14. encukou

    closed this as completedon Apr 7, 2026
15. github-project-automation

    moved this from Todo to Done in Release and Deferred blockers 🚫on Apr 7, 2026
16. bmwiedemann

    added a commit that references this issue on Apr 15, 2026

    Update python311 to version 3.11.15 / rev 68 via SR 1345247

    ...

    d07c87a
17. ljfp

    added 2 commits that reference this issue on Apr 25, 2026

    pythongh-146121: `pkgutil.get_data()` reject invalid resource argumen…

    ...

    1714462

    pythongh-146121: Clarify security model of pkgutil.getdata; revert ch…

    ...

    15a222b
18. mcepl

    added 3 commits that reference this issue on Sep 18, 2026

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    ...

    4c2ff50

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    ...

    2bb1462

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    ...

    39b46f3
19. mcepl

    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    ...

    7675d25

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    ...

    144c5b6

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    ...

    f1e1e54