Linux · AlmaLinux · Security advisory · December 17, 2025

ALSA-2025:23530: Security update for 49 packages

ALSA-2025:23530, released December 17, 2025, fixes 12 CVEs across 49 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
12
None rated Critical
Exploited
0
None reported
Highest CVSS
9.4
Base score, 0 to 10
Highest EPSS
0.0155
75th percentile

Priority of the 12 CVEs

Patch now 0 Urgent 0 High 12 Routine 0

Fixed package versions

ProductReleaseFixed in
python39almalinux 83.9.25-2.module_el8.10.0+4083+53cad1fb
python39-Cythonalmalinux 80.29.21-5.module_el8.6.0+2780+a40f65e1
python39-PyMySQLalmalinux 80.10.1-2.module_el8.6.0+2780+a40f65e1
python39-attrsalmalinux 820.3.0-2.module_el8.6.0+2780+a40f65e1
python39-cffialmalinux 81.14.3-2.module_el8.6.0+2780+a40f65e1
python39-chardetalmalinux 83.0.4-19.module_el8.6.0+2780+a40f65e1
python39-cryptographyalmalinux 83.3.1-3.module_el8.10.0+3765+2f9a457d
python39-debugalmalinux 83.9.25-2.module_el8.10.0+4083+53cad1fb
python39-develalmalinux 83.9.25-2.module_el8.10.0+4083+53cad1fb
python39-idlealmalinux 83.9.25-2.module_el8.10.0+4083+53cad1fb
python39-idnaalmalinux 82.10-4.module_el8.10.0+3849+a48d89aa
python39-iniconfigalmalinux 81.1.1-2.module_el8.6.0+2780+a40f65e1
python39-libsalmalinux 83.9.25-2.module_el8.10.0+4083+53cad1fb
python39-lxmlalmalinux 84.6.5-1.module_el8.6.0+2780+a40f65e1
python39-mod_wsgialmalinux 84.7.1-7.module_el8.10.0+3989+a618fe15.1
python39-more-itertoolsalmalinux 88.5.0-2.module_el8.6.0+2780+a40f65e1
python39-numpyalmalinux 81.19.4-3.module_el8.6.0+2780+a40f65e1
python39-numpy-docalmalinux 81.19.4-3.module_el8.6.0+2780+a40f65e1
python39-numpy-f2pyalmalinux 81.19.4-3.module_el8.6.0+2780+a40f65e1
python39-packagingalmalinux 820.4-4.module_el8.6.0+2780+a40f65e1
python39-pipalmalinux 820.2.4-9.module_el8.10.0+3765+2f9a457d
python39-pip-wheelalmalinux 820.2.4-9.module_el8.10.0+3765+2f9a457d
python39-pluggyalmalinux 80.13.1-3.module_el8.6.0+2780+a40f65e1
python39-plyalmalinux 83.11-10.module_el8.6.0+2780+a40f65e1
python39-psutilalmalinux 85.8.0-4.module_el8.6.0+2780+a40f65e1
python39-psycopg2almalinux 82.8.6-3.module_el8.10.0+3765+2f9a457d
python39-psycopg2-docalmalinux 82.8.6-3.module_el8.10.0+3765+2f9a457d
python39-psycopg2-testsalmalinux 82.8.6-3.module_el8.10.0+3765+2f9a457d
python39-pyalmalinux 81.10.0-1.module_el8.6.0+2780+a40f65e1
python39-pybind11almalinux 82.7.1-1.module_el8.6.0+2780+a40f65e1
python39-pybind11-develalmalinux 82.7.1-1.module_el8.6.0+3248+c431e88c
python39-pycparseralmalinux 82.20-3.module_el8.6.0+2780+a40f65e1
python39-pyparsingalmalinux 82.4.7-5.module_el8.6.0+2780+a40f65e1
python39-pysocksalmalinux 81.7.1-4.module_el8.6.0+2780+a40f65e1
python39-pytestalmalinux 86.0.2-2.module_el8.6.0+2780+a40f65e1
python39-pyyamlalmalinux 85.4.1-1.module_el8.6.0+2780+a40f65e1
python39-requestsalmalinux 82.25.0-3.module_el8.9.0+3634+fb2a896c
python39-rpm-macrosalmalinux 83.9.25-2.module_el8.10.0+4083+53cad1fb
python39-scipyalmalinux 81.5.4-5.module_el8.9.0+3634+fb2a896c
python39-setuptoolsalmalinux 850.3.2-7.module_el8.10.0+4040+9207bbc0
python39-setuptools-wheelalmalinux 850.3.2-7.module_el8.10.0+4040+9207bbc0
python39-sixalmalinux 81.15.0-3.module_el8.6.0+2780+a40f65e1
python39-testalmalinux 83.9.25-2.module_el8.10.0+4083+53cad1fb
python39-tkinteralmalinux 83.9.25-2.module_el8.10.0+4083+53cad1fb
python39-tomlalmalinux 80.10.1-5.module_el8.6.0+2780+a40f65e1
python39-urllib3almalinux 81.25.10-5.module_el8.10.0+3765+2f9a457d
python39-wcwidthalmalinux 80.2.5-3.module_el8.6.0+2780+a40f65e1
python39-wheelalmalinux 81:0.35.1-4.module_el8.6.0+2780+a40f65e1
python39-wheel-wheelalmalinux 81:0.35.1-4.module_el8.6.0+2780+a40f65e1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2025-0938 URL parser allowed square brackets in domain names7.6 0.0155 None reported
High CVE-2025-4138 Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory7.6 0.0149 None reported
High CVE-2025-4517 Arbitrary writes via tarfile realpath overflow9.4 0.0148 None reported
High CVE-2025-4330 Extraction filter bypass for linking outside extraction directory7.6 0.0097 None reported
High CVE-2024-5642 Buffer overread when using an empty list with SSLContext.set_npn_protocols()7.6 0.0074 None reported
High CVE-2024-11168 Improper validation of IPv6 and IPvFuture addresses7.6 0.0066 None reported
High CVE-2024-9287 Virtual environment (venv) activation scripts don't quote paths7.8 0.0065 None reported
High CVE-2025-4435 Tarfile extracts filtered members when errorlevel=07.6 0.0062 None reported
High CVE-2025-6069 HTMLParser quadratic complexity when processing malformed inputs7.6 0.0060 None reported
High CVE-2025-8291 ZIP64 End of Central Directory (EOCD) Locator record offset not checked7.6 0.0047 None reported
High CVE-2025-4516 Use-after-free in "unicode_escape" decoder with error handler7.6 0.0023 None reported
High CVE-2025-6075 Quadratic complexity in os.path.expandvars() with user-controlled template8.1 0.0015 None reported
Showing 1 to 12 of 12 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.