{"id":168710,"date":"2026-04-14T17:12:53","date_gmt":"2026-04-14T15:12:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-python-bibliotekah-lzma-bz2-i-gzip-potenczialno-privodyashhaya-k-vypolneniyu-koda"},"modified":"2026-04-14T17:12:53","modified_gmt":"2026-04-14T15:12:53","slug":"uyazvimost-v-python-bibliotekah-lzma-bz2-i-gzip-potenczialno-privodyashhaya-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-python-bibliotekah-lzma-bz2-i-gzip-potenczialno-privodyashhaya-k-vypolneniyu-koda","title":{"rendered":"En s\u00e5rbarhed i Python-bibliotekerne lzma, bz2 og gzip, som potentielt kan f\u00f8re til kodeudf\u00f8relse.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I de medf\u00f8lgende CPython-klasser til udpakkede data i formaterne lzma, bz2 og gzip (lzma.LZMADecompressor, bz2.BZ2Decompressor og gzip.GzipFile) er der opdaget en s\u00e5rbarhed (CVE-2026-6100), der f\u00f8rer til adgang til hukommelse efter frigivelse. Problemet er vurderet som kritisk (9.1 ud af 10) - i tilf\u00e6lde af succesfuld udnyttelse kan s\u00e5rbarheden f\u00f8re til l\u00e6kage af information fra procesens hukommelse eller udf\u00f8relse af den angribendes kode under udpakkning af specifikt designede data. En l\u00f8sning er endnu tilg\u00e6ngelig i form af en patch. <\/p>\n

Problemet opst\u00e5r efter afslutningen af en hukommelsesallokeringsoperation med en fejl, der opst\u00e5r ved utilstr\u00e6kkelig hukommelse (for at s\u00e5rbarheden kan udnyttes, skal angriberen skabe betingelser for udt\u00f8mning af den tilg\u00e6ngelige proceshukommelse). Adgang til allerede frigivet hukommelse forekommer i applikationer, der genbruger en objektinstans efter tilbagevenden af en fejl under udpakkning. Applikationer, der opretter en ny instans af objektet ved hver opkald, er ikke p\u00e5virket af s\u00e5rbarheden.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 CPython \u043a\u043b\u0430\u0441\u0441\u0430\u0445 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0438 \u0441\u0436\u0430\u0442\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445 lzma, bz2 \u0438 gzip (lzma.LZMADecompressor, bz2.BZ2Decompressor \u0438 gzip.GzipFile) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-6100), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.1 \u0438\u0437 10) — \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u0437 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-168710","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i Python-bibliotekerne lzma, bz2 og gzip, der potentielt kan f\u00f8re til udf\u00f8relse af kode | ProHoster","description":"I de medf\u00f8lgende CPython-klasser til udpaksning af komprimerede data i formaterne lzma, bz2 og gzip (lzma.LZMADecompressor, bz2.BZ2Decompressor og gzip.GzipFile) er der opdaget en s\u00e5rbarhed (CVE-2026-6100), der f\u00f8rer til adgang til.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-python-bibliotekah-lzma-bz2-i-gzip-potenczialno-privodyashhaya-k-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Python-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 lzma, bz2 \u0438 gzip, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 CPython \u043a\u043b\u0430\u0441\u0441\u0430\u0445 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0438 \u0441\u0436\u0430\u0442\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445 lzma, bz2 \u0438 gzip (lzma.LZMADecompressor, bz2.BZ2Decompressor \u0438 gzip.GzipFile) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-6100), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u043a.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-python-bibliotekah-lzma-bz2-i-gzip-potenczialno-privodyashhaya-k-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-04-14T15:12:53+00:00","article:modified_time":"2026-04-14T15:12:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/168710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=168710"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/168710\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=168710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=168710"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=168710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}