Linux · Oracle Linux · Security advisory · December 23, 2025

ELSA-2025-23530: Security update for 49 packages

ELSA-2025-23530, released December 23, 2025, fixes 12 CVEs across 49 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
12
None rated Critical
Exploited
0
None reported
Highest CVSS
9.4
Base score, 0 to 10
Highest EPSS
0.0155
75th percentile

Priority of the 12 CVEs

Patch now 0 Urgent 0 High 12 Routine 0

Fixed package versions

ProductReleaseFixed in
python39ol 80:3.9.25-2.module+el8.10.0+90733+27f37730
python39-Cythonol 80:0.29.21-5.module+el8.9.0+90016+9c2d6573
python39-PyMySQLol 80:0.10.1-2.module+el8.9.0+90016+9c2d6573
python39-attrsol 80:20.3.0-2.module+el8.9.0+90016+9c2d6573
python39-cffiol 80:1.14.3-2.module+el8.9.0+90016+9c2d6573
python39-chardetol 80:3.0.4-19.module+el8.9.0+90016+9c2d6573
python39-cryptographyol 80:3.3.1-3.0.1.module+el8.10.0+90269+2fa22b99
python39-debugol 80:3.9.25-2.module+el8.10.0+90733+27f37730
python39-develol 80:3.9.25-2.module+el8.10.0+90733+27f37730
python39-idleol 80:3.9.25-2.module+el8.10.0+90733+27f37730
python39-idnaol 80:2.10-4.module+el8.10.0+90341+71ca88f4
python39-iniconfigol 80:1.1.1-2.module+el8.9.0+90016+9c2d6573
python39-libsol 80:3.9.25-2.module+el8.10.0+90733+27f37730
python39-lxmlol 80:4.6.5-1.module+el8.9.0+90016+9c2d6573
python39-mod_wsgiol 80:4.7.1-7.module+el8.10.0+90647+49247197.1
python39-more-itertoolsol 80:8.5.0-2.module+el8.9.0+90016+9c2d6573
python39-numpyol 80:1.19.4-3.module+el8.9.0+90016+9c2d6573
python39-numpy-docol 80:1.19.4-3.module+el8.9.0+90016+9c2d6573
python39-numpy-f2pyol 80:1.19.4-3.module+el8.9.0+90016+9c2d6573
python39-packagingol 80:20.4-4.module+el8.9.0+90016+9c2d6573
python39-pipol 80:20.2.4-9.module+el8.10.0+90269+2fa22b99
python39-pip-wheelol 80:20.2.4-9.module+el8.10.0+90269+2fa22b99
python39-pluggyol 80:0.13.1-3.module+el8.9.0+90016+9c2d6573
python39-plyol 80:3.11-10.module+el8.9.0+90016+9c2d6573
python39-psutilol 80:5.8.0-4.module+el8.9.0+90016+9c2d6573
python39-psycopg2ol 80:2.8.6-3.module+el8.10.0+90269+2fa22b99
python39-psycopg2-docol 80:2.8.6-3.module+el8.10.0+90269+2fa22b99
python39-psycopg2-testsol 80:2.8.6-3.module+el8.10.0+90269+2fa22b99
python39-pyol 80:1.10.0-1.module+el8.9.0+90016+9c2d6573
python39-pybind11ol 80:2.7.1-1.module+el8.9.0+90016+9c2d6573
python39-pybind11-develol 80:2.7.1-1.module+el8.9.0+90016+9c2d6573
python39-pycparserol 80:2.20-3.module+el8.9.0+90016+9c2d6573
python39-pyparsingol 80:2.4.7-5.module+el8.9.0+90016+9c2d6573
python39-pysocksol 80:1.7.1-4.module+el8.9.0+90016+9c2d6573
python39-pytestol 80:6.0.2-2.module+el8.9.0+90016+9c2d6573
python39-pyyamlol 80:5.4.1-1.module+el8.9.0+90016+9c2d6573
python39-requestsol 80:2.25.0-3.module+el8.9.0+90016+9c2d6573
python39-rpm-macrosol 80:3.9.25-2.module+el8.10.0+90733+27f37730
python39-scipyol 80:1.5.4-5.module+el8.9.0+90016+9c2d6573
python39-setuptoolsol 80:50.3.2-7.module+el8.10.0+90647+49247197
python39-setuptools-wheelol 80:50.3.2-7.module+el8.10.0+90647+49247197
python39-sixol 80:1.15.0-3.module+el8.9.0+90016+9c2d6573
python39-testol 80:3.9.25-2.module+el8.10.0+90733+27f37730
python39-tkinterol 80:3.9.25-2.module+el8.10.0+90733+27f37730
python39-tomlol 80:0.10.1-5.module+el8.9.0+90016+9c2d6573
python39-urllib3ol 80:1.25.10-5.module+el8.10.0+90269+2fa22b99
python39-wcwidthol 80:0.2.5-3.module+el8.9.0+90016+9c2d6573
python39-wheelol 81:0.35.1-4.module+el8.9.0+90016+9c2d6573
python39-wheel-wheelol 81:0.35.1-4.module+el8.9.0+90016+9c2d6573

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2025-0938 URL parser allowed square brackets in domain names7.6 0.0155 None reported
High CVE-2025-4138 Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory7.6 0.0149 None reported
High CVE-2025-4517 Arbitrary writes via tarfile realpath overflow9.4 0.0148 None reported
High CVE-2025-4330 Extraction filter bypass for linking outside extraction directory7.6 0.0097 None reported
High CVE-2024-5642 Buffer overread when using an empty list with SSLContext.set_npn_protocols()7.6 0.0074 None reported
High CVE-2024-11168 Improper validation of IPv6 and IPvFuture addresses7.6 0.0066 None reported
High CVE-2024-9287 Virtual environment (venv) activation scripts don't quote paths7.8 0.0065 None reported
High CVE-2025-4435 Tarfile extracts filtered members when errorlevel=07.6 0.0062 None reported
High CVE-2025-6069 HTMLParser quadratic complexity when processing malformed inputs7.6 0.0060 None reported
High CVE-2025-8291 ZIP64 End of Central Directory (EOCD) Locator record offset not checked7.6 0.0047 None reported
High CVE-2025-4516 Use-after-free in "unicode_escape" decoder with error handler7.6 0.0023 None reported
High CVE-2025-6075 Quadratic complexity in os.path.expandvars() with user-controlled template8.1 0.0015 None reported
Showing 1 to 12 of 12 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.