CVE-2026-23949 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2026-23949 Interim 1 1 2026-03-05T00:16:36Z current 2026-03-05T00:16:36Z 2026-03-05T00:16:36Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2026-23949 jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`. Version 6.1.0 contains a patch for the issue. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2026-January/023954.html E-Mail link for SUSE-SU-2026:20139-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Container suse/sl-micro/6.1/base-os-container:2.2.1-5.10 Image SL-Micro Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise Server for SAP applications 16.0 openSUSE Leap 15.6 openSUSE Leap 16.0 openSUSE Tumbleweed libzypp-17.37.11-slfo.1.1_1.1 python-jaraco.context python311-jaraco.context python311-jaraco.context-6.1.0-1.1 python312-jaraco.context-6.1.0-1.1 python313-jaraco.context-5.3.0-160000.3.1 python313-jaraco.context-6.1.0-1.1 libzypp-17.37.11-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/base-os-container:latest libzypp-17.37.11-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/toolbox:latest libzypp-17.37.11-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.1/base-os-container:2.2.1-5.10 libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SL-Micro libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SL-Micro-Azure libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SL-Micro-BYOS-Azure libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SL-Micro-BYOS-EC2 libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SL-Micro-BYOS-GCE libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SL-Micro-EC2 libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SLE-Micro libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SLE-Micro-Azure libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-Azure libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-EC2 libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-GCE libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SLE-Micro-EC2 libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SLE-Micro-GCE libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SUSE-Multi-Linux-Manager-Server-Azure-llc libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SUSE-Multi-Linux-Manager-Server-Azure-ltd libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SUSE-Multi-Linux-Manager-Server-EC2-llc libzypp-17.37.11-slfo.1.1_1.1 as a component of Image SUSE-Multi-Linux-Manager-Server-EC2-ltd python313-jaraco.context-5.3.0-160000.3.1 as a component of SUSE Linux Enterprise Server 16.0 python313-jaraco.context-5.3.0-160000.3.1 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 python313-jaraco.context-5.3.0-160000.3.1 as a component of openSUSE Leap 16.0 python311-jaraco.context-6.1.0-1.1 as a component of openSUSE Tumbleweed python312-jaraco.context-6.1.0-1.1 as a component of openSUSE Tumbleweed python313-jaraco.context-6.1.0-1.1 as a component of openSUSE Tumbleweed python313-jaraco.context-5.3.0-160000.3.1 as a component of SUSE Linux Enterprise Server 16.0 python311-jaraco.context as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS python-jaraco.context as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS python311-jaraco.context as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS python-jaraco.context as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS python311-jaraco.context as a component of SUSE Linux Enterprise Module for Python 3 15 SP7 python-jaraco.context as a component of SUSE Linux Enterprise Module for Python 3 15 SP7 python311-jaraco.context as a component of SUSE Linux Enterprise Server 15 SP4-LTSS python-jaraco.context as a component of SUSE Linux Enterprise Server 15 SP4-LTSS python311-jaraco.context as a component of SUSE Linux Enterprise Server 15 SP5-LTSS python-jaraco.context as a component of SUSE Linux Enterprise Server 15 SP5-LTSS python311-jaraco.context as a component of SUSE Linux Enterprise Server 15 SP6-LTSS python-jaraco.context as a component of SUSE Linux Enterprise Server 15 SP6-LTSS python-jaraco.context as a component of SUSE Linux Enterprise Server Teradata 15 SP4 python311-jaraco.context as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 python-jaraco.context as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 python311-jaraco.context as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 python-jaraco.context as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 python311-jaraco.context as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 python-jaraco.context as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 python311-jaraco.context as a component of openSUSE Leap 15.6 python-jaraco.context as a component of openSUSE Leap 15.6 jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`. Version 6.1.0 contains a patch for the issue. CVE-2026-23949 Container suse/sl-micro/6.0/base-os-container:latest:libzypp-17.37.11-slfo.1.1_1.1 Container suse/sl-micro/6.0/toolbox:latest:libzypp-17.37.11-slfo.1.1_1.1 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.10:libzypp-17.37.11-slfo.1.1_1.1 Image SL-Micro:libzypp-17.37.11-slfo.1.1_1.1 Image SL-Micro-Azure:libzypp-17.37.11-slfo.1.1_1.1 Image SL-Micro-BYOS-Azure:libzypp-17.37.11-slfo.1.1_1.1 Image SL-Micro-BYOS-EC2:libzypp-17.37.11-slfo.1.1_1.1 Image SL-Micro-BYOS-GCE:libzypp-17.37.11-slfo.1.1_1.1 Image SL-Micro-EC2:libzypp-17.37.11-slfo.1.1_1.1 Image SLE-Micro:libzypp-17.37.11-slfo.1.1_1.1 Image SLE-Micro-Azure:libzypp-17.37.11-slfo.1.1_1.1 Image SLE-Micro-BYOS:libzypp-17.37.11-slfo.1.1_1.1 Image SLE-Micro-BYOS-Azure:libzypp-17.37.11-slfo.1.1_1.1 Image SLE-Micro-BYOS-EC2:libzypp-17.37.11-slfo.1.1_1.1 Image SLE-Micro-BYOS-GCE:libzypp-17.37.11-slfo.1.1_1.1 Image SLE-Micro-EC2:libzypp-17.37.11-slfo.1.1_1.1 Image SLE-Micro-GCE:libzypp-17.37.11-slfo.1.1_1.1 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure:libzypp-17.37.11-slfo.1.1_1.1 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2:libzypp-17.37.11-slfo.1.1_1.1 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE:libzypp-17.37.11-slfo.1.1_1.1 Image SUSE-Multi-Linux-Manager-Server-Azure-llc:libzypp-17.37.11-slfo.1.1_1.1 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd:libzypp-17.37.11-slfo.1.1_1.1 Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure:libzypp-17.37.11-slfo.1.1_1.1 Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2:libzypp-17.37.11-slfo.1.1_1.1 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE:libzypp-17.37.11-slfo.1.1_1.1 Image SUSE-Multi-Linux-Manager-Server-EC2-llc:libzypp-17.37.11-slfo.1.1_1.1 Image SUSE-Multi-Linux-Manager-Server-EC2-ltd:libzypp-17.37.11-slfo.1.1_1.1 SUSE Linux Enterprise Server 16.0:python313-jaraco.context-5.3.0-160000.3.1 SUSE Linux Enterprise Server for SAP applications 16.0:python313-jaraco.context-5.3.0-160000.3.1 openSUSE Leap 16.0:python313-jaraco.context-5.3.0-160000.3.1 openSUSE Tumbleweed:python311-jaraco.context-6.1.0-1.1 openSUSE Tumbleweed:python312-jaraco.context-6.1.0-1.1 openSUSE Tumbleweed:python313-jaraco.context-6.1.0-1.1 SUSE Linux Enterprise Server 16.0:python313-jaraco.context-5.3.0-160000.3.1 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python-jaraco.context SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-jaraco.context SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python-jaraco.context SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-jaraco.context SUSE Linux Enterprise Module for Python 3 15 SP7:python-jaraco.context SUSE Linux Enterprise Module for Python 3 15 SP7:python311-jaraco.context SUSE Linux Enterprise Server 15 SP4-LTSS:python-jaraco.context SUSE Linux Enterprise Server 15 SP4-LTSS:python311-jaraco.context SUSE Linux Enterprise Server 15 SP5-LTSS:python-jaraco.context SUSE Linux Enterprise Server 15 SP5-LTSS:python311-jaraco.context SUSE Linux Enterprise Server 15 SP6-LTSS:python-jaraco.context SUSE Linux Enterprise Server 15 SP6-LTSS:python311-jaraco.context SUSE Linux Enterprise Server Teradata 15 SP4:python-jaraco.context SUSE Linux Enterprise Server for SAP Applications 15 SP4:python-jaraco.context SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-jaraco.context SUSE Linux Enterprise Server for SAP Applications 15 SP5:python-jaraco.context SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-jaraco.context SUSE Linux Enterprise Server for SAP Applications 15 SP6:python-jaraco.context SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-jaraco.context openSUSE Leap 15.6:python-jaraco.context openSUSE Leap 15.6:python311-jaraco.context important 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N