{"id":168710,"date":"2026-04-14T17:12:53","date_gmt":"2026-04-14T15:12:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-python-bibliotekah-lzma-bz2-i-gzip-potenczialno-privodyashhaya-k-vypolneniyu-koda"},"modified":"2026-04-14T17:12:53","modified_gmt":"2026-04-14T15:12:53","slug":"uyazvimost-v-python-bibliotekah-lzma-bz2-i-gzip-potenczialno-privodyashhaya-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-python-bibliotekah-lzma-bz2-i-gzip-potenczialno-privodyashhaya-k-vypolneniyu-koda","title":{"rendered":"Haavatavus Python'i raamatukogudes lzma, bz2 ja gzip, mis v\u00f5ib potentsiaalselt viia koodi t\u00e4itmisele","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

CPython'i pakkimoodulites, mis k\u00e4sitlevad kokku pakitud andmeid formaatides lzma, bz2 ja gzip (lzma.LZMADecompressor, bz2.BZ2Decompressor ja gzip.GzipFile), tuvastati haavatavus (CVE-2026-6100), mis viib m\u00e4lu juurde p\u00e4\u00e4semiseni p\u00e4rast selle vabastamist. Probleemile on m\u00e4\u00e4ratud kriitiline ohtlikkuse tase (9.1 skaalal 10st) \u2014 juhul, kui haavatavust on edukalt \u00e4ra kasutatud, v\u00f5ib see viia teabe lekke protsessi m\u00e4lust v\u00f5i r\u00fcndaja koodi t\u00e4itmiseni spetsiaalselt vormindatud andmete lahtipakkimise korral. Parandus on praegu saadaval plaastri kujul. <\/p>\n

Probleem avaldub p\u00e4rast m\u00e4lu eraldamise toimingu l\u00f5petamist, mis tekib m\u00e4lu nappuse t\u00f5ttu (haavatavuse edukaks \u00e4ra kasutamiseks peab r\u00fcndaja looma tingimused, mis viivad protsessile vabastatud m\u00e4lu ammendumiseni). Juba vabastatud m\u00e4lule p\u00e4\u00e4semine toimub rakendustes, mis kasutavad objekti eksemplari uuesti p\u00e4rast vea tagastamist lahti pakkimise protsessis. Rakendused, mis igal kutsungil loovad uue objekti eksemplari, ei ole haavatavad.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 CPython \u043a\u043b\u0430\u0441\u0441\u0430\u0445 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0438 \u0441\u0436\u0430\u0442\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445 lzma, bz2 \u0438 gzip (lzma.LZMADecompressor, bz2.BZ2Decompressor \u0438 gzip.GzipFile) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-6100), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.1 \u0438\u0437 10) — \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u0437 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-168710","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Python raamatukogudes lzma, bz2 ja gzip, mis v\u00f5ib potentsiaalselt viia koodi t\u00e4itmiseni | ProHoster","description":"CPython'i pakettides, mis sisaldavad lzma, bz2 ja gzip andmete dekompressimise klasse (lzma.LZMADecompressor, bz2.BZ2Decompressor ja gzip.GzipFile), on tuvastatud haavatavus (CVE-2026-6100), mis toob kaasa juurdep\u00e4\u00e4su vabastatud m\u00e4lu piirkondadele. Probleemile on antud kriitiline ohutaseme hinnang (9.1 skaalal 10-st) - haavatavuse edukas kasutamine v\u00f5ib p\u00f5hjustada teabe leket protsessi m\u00e4lu kaudu v\u00f5i koodi t\u00e4itmist.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-python-bibliotekah-lzma-bz2-i-gzip-potenczialno-privodyashhaya-k-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Python-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 lzma, bz2 \u0438 gzip, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 CPython \u043a\u043b\u0430\u0441\u0441\u0430\u0445 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0438 \u0441\u0436\u0430\u0442\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445 lzma, bz2 \u0438 gzip (lzma.LZMADecompressor, bz2.BZ2Decompressor \u0438 gzip.GzipFile) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-6100), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.1 \u0438\u0437 10) - \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u0437 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-python-bibliotekah-lzma-bz2-i-gzip-potenczialno-privodyashhaya-k-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-04-14T15:12:53+00:00","article:modified_time":"2026-04-14T15:12:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/168710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=168710"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/168710\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=168710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=168710"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=168710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}