https://www.openwall.com/lists/oss-security/2025/05/16/4
 https://github.com/python/cpython/pull/129648
  https://github.com/python/cpython/pull/129648/commits/be5d80cec9650a9ea252537d5050fa9f984c486f

The last is a patch - rather big; but it says at the top 3 commits.

Assignee: bugsquad => python

python3-3.13.3-2.mga10 solves that issue for Cauldron.

Whiteboard: MGA9TOO => (none)
Source RPM: python3-3.13.3-1.mga10.src.rpm, python3-3.10.11-1.3.mga9.src.rpm => python3-3.10.11-1.3.mga9.src.rpm
Version: Cauldron => 9

Fedora has issued an advisory on June 13:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUW6UXZQE7B4PPK3PK3NZAWP5PVOU5L3/

All those CVEs are fixed in 3.13.4 so only Mageia 9 is affected.

CVE: CVE-2025-4516 => CVE-2025-4516, CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517
Summary: python3 new security issue CVE-2025-4516 => python3 new security issues CVE-2025-4516, CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517

Another reference:
https://www.openwall.com/lists/oss-security/2025/06/24/1

CVE-2025-8194 was announced here: https://www.openwall.com/lists/oss-security/2025/07/28/1

CVE: CVE-2025-4516, CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517 => CVE-2025-4516, CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517, CVE-2025-8194
Summary: python3 new security issues CVE-2025-4516, CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517 => python3 new security issues CVE-2025-4516, CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517, CVE-2025-8194

Suggested advisory:
========================

The updated packages fix security vulnerabilities:

URL parser allowed square brackets in domain names. (CVE-2025-0938)

Mishandling of comma during folding and unicode-encoding of email headers. (CVE-2025-1795)

Virtual environment (venv) activation scripts don't quote paths. (CVE-2024-9287)

Use-after-free in "unicode_escape" decoder with error handler. (CVE-2025-4516)

Bypass extraction filter to modify file metadata outside extraction directory. (CVE-2024-12718)

Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory. (CVE-2025-4138)

Extraction filter bypass for linking outside extraction directory. (CVE-2025-4330)

Tarfile extracts filtered members when errorlevel=0. (CVE-2025-4435)

Arbitrary writes via tarfile realpath overflow. (CVE-2025-4517)

Tarfile infinite loop during parsing with negative member offset. (CVE-2025-8194)

References:
https://bugs.mageia.org/show_bug.cgi?id=34007
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4FRAYUVWW2DYX7RTRPVFLFADRHABRVQN/
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NNC4GZYGFZ76A7NUZ5BG2CMGVR32LXCG/
https://ubuntu.com/security/notices/USN-7488-1
https://www.openwall.com/lists/oss-security/2025/05/16/4
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUW6UXZQE7B4PPK3PK3NZAWP5PVOU5L3/
https://www.openwall.com/lists/oss-security/2025/06/24/1
https://www.openwall.com/lists/oss-security/2025/07/28/1
========================

Updated packages in core/updates_testing:
========================
lib(64)python3-devel-3.10.18-1.4.mga9
lib(64)python3.10-3.10.18-1.4.mga9
lib(64)python3.10-stdlib-3.10.18-1.4.mga9
lib(64)python3.10-testsuite-3.10.18-1.4.mga9
python3-3.10.18-1.4.mga9
python3-docs-3.10.18-1.4.mga9
tkinter3-3.10.18-1.4.mga9
tkinter3-apps-3.10.18-1.4.mga9

from SRPM:
python3-3.10.18-1.4.mga9.src.rpm

CVE: CVE-2025-4516, CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517, CVE-2025-8194 => CVE-2025-0938, CVE-2025-1795, CVE-2024-9287, CVE-2025-4516, CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517, CVE-2025-8194
Status: NEW => ASSIGNED
Assignee: python => qa-bugs

installing lib64python3.10-stdlib-3.10.18-1.4.mga9.x86_64.rpm lib64python3.10-3.10.18-1.4.mga9.x86_64.rpm tkinter3-3.10.18-1.4.mga9.x86_64.rpm python3-3.10.18-1.4.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ####################################################################################################
      1/4: python3               ####################################################################################################
      2/4: lib64python3.10       ####################################################################################################
      3/4: lib64python3.10-stdlib
                                 ####################################################################################################
      4/4: tkinter3              ####################################################################################################
      1/4: removing tkinter3-3.10.11-1.3.mga9.x86_64
                                 ####################################################################################################
      2/4: removing lib64python3.10-stdlib-3.10.11-1.3.mga9.x86_64
                                 ####################################################################################################
      3/4: removing python3-3.10.11-1.3.mga9.x86_64
                                 ####################################################################################################
      4/4: removing lib64python3.10-3.10.11-1.3.mga9.x86_64
                                 ####################################################################################################

LC_ALL=C urpmi python3-pyparsing
Package python3-pyparsing-3.0.9-2.mga9.noarch is already installed

 python3 /usr/share/doc/python3-pyparsing/examples/SimpleCalc.py
Type in the string to be parsed or 'quit' to exit the program
>4-5
-1
> 200/3
66.66666666666667
> 5^2
25

Looks good to me

Whiteboard: (none) => MGA9-64-OK

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0280.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED