GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [CVE-2026-3479] Documented `pkgutil.get_data()` restrictions are not enforced · Issue #146121 · python/cpython

[CVE-2026-3479] Documented pkgutil.get_data() restrictions are not enforced #146121

New issue
Copy link
New issue
Copy link
Closed
Closed
[CVE-2026-3479] Documented pkgutil.get_data() restrictions are not enforced#146121
Copy link
Assignees
StanFromIreland
Labels
3.10 (EOL)end of lifeend of life3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixesrelease-blockerstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-securityA security issueA security issue

Description

@StanFromIreland
StanFromIreland
opened on Mar 18, 2026
Issue body actions

Please see PR for more information.

The PSRT has decided to treat this as a security issue since this was a documented restriction.

Linked PRs

  • gh-146121: pkgutil.get_data() reject invalid resource arguments #146122
  • [3.14] gh-146121: pkgutil.get_data() reject invalid resource arguments (GH-146122) #146133
  • [3.13] gh-146121: pkgutil.get_data() reject invalid resource arguments (GH-146122) #146134
  • [3.12] gh-146121: pkgutil.get_data() reject invalid resource arguments (GH-146122) #146135
  • [3.11] gh-146121: pkgutil.get_data() reject invalid resource arguments (GH-146122) #146136
  • [3.10] gh-146121: pkgutil.get_data() reject invalid resource arguments (GH-146122) #146137
  • gh-146121: Clarify security model of pkgutil.getdata; revert checks #148197
  • [3.13] gh-146121: Clarify security model of pkgutil.getdata; revert checks (GH-148197) #148205
  • [3.14] gh-146121: Clarify security model of pkgutil.getdata; revert checks (GH-148197) #148206

Activity

Next
  1. StanFromIreland
    self-assigned this
    on Mar 18, 2026
  2. StanFromIreland
    added
    type-securityA security issueA security issue
    stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory
    3.11only security fixesonly security fixes
    3.10 (EOL)end of lifeend of life
    3.12only security fixesonly security fixes
    3.13only security fixesonly security fixes
    3.14bugs and security fixesbugs and security fixes
    3.15bugs and security fixesbugs and security fixes
    on Mar 18, 2026
  3. FFY00
    added a commit that references this issue on Mar 18, 2026

    gh-146121: `pkgutil.get_data()` reject invalid resource arguments (#1…

    bcdf231
  4. miss-islington
    added 5 commits that reference this issue on Mar 18, 2026

    pythongh-146121: `pkgutil.get_data()` reject invalid resource argumen…

    e21d57f

    pythongh-146121: `pkgutil.get_data()` reject invalid resource argumen…

    777bb8a

    pythongh-146121: `pkgutil.get_data()` reject invalid resource argumen…

    b99e2bf

    pythongh-146121: `pkgutil.get_data()` reject invalid resource argumen…

    7614ae8

    pythongh-146121: `pkgutil.get_data()` reject invalid resource argumen…

    b238b78
  5. 9 remaining items

  6. encukou
    added a commit that references this issue on Apr 7, 2026

    gh-146121: Clarify security model of pkgutil.getdata; revert checks (G…

    cf59bf7
  7. miss-islington
    added a commit that references this issue on Apr 7, 2026

    pythongh-146121: Clarify security model of pkgutil.getdata; revert ch…

    5fc3a10
  8. Yhg1s
    added a commit that references this issue on Apr 7, 2026

    [3.13] gh-146121: Clarify security model of pkgutil.getdata; revert c…

    5af6ce3
  9. encukou
    added a commit that references this issue on Apr 7, 2026

    [3.14] gh-146121: Clarify security model of pkgutil.getdata (GH-148197)…

    d786d59
  10. encukou
    closed this as completedon Apr 7, 2026
  11. github-project-automation
    moved this from Todo to Done in Release and Deferred blockers 🚫on Apr 7, 2026
  12. bmwiedemann
    added a commit that references this issue on Apr 15, 2026

    Update python311 to version 3.11.15 / rev 68 via SR 1345247

    d07c87a
  13. ljfp
    added 2 commits that reference this issue on Apr 25, 2026

    pythongh-146121: `pkgutil.get_data()` reject invalid resource argumen…

    1714462

    pythongh-146121: Clarify security model of pkgutil.getdata; revert ch…

    15a222b
  14. mcepl
    added 3 commits that reference this issue on Sep 18, 2026

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    4c2ff50

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    2bb1462

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    39b46f3
  15. mcepl
    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    7675d25

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    144c5b6

    [CVE-2026-3479] `pkgutil.get_data()` reject invalid resource arguments

    f1e1e54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

  • @StanFromIreland
    StanFromIreland

Labels

3.10 (EOL)end of lifeend of life3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixesrelease-blockerstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-securityA security issueA security issue

Projects

  • Release and Deferred blockers 🚫
    Status
    Done
    Show more project fields

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.