Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

SUSE: Python Performance Issues & ZIP Bug CVE-2025-6075 2025:4389-1

suse
Calendar Grey December 12, 2025
Dist Suse Esm H88
SUSE update for python addresses performance issues and ZIP archive inconsistencies. Detailed patch instructions provided.
* bsc#1251305 * bsc#1252974 Cross-References: * CVE-2025-6075

Summary

## This update for python fixes the following issues: * CVE-2025-6075: quadratic complexity in `os.path.expandvars()` can lead to performance degradation when values passed to it are user-controlled (bsc#1252974). * CVE-2025-8291: lack of validity checks on the ZIP64 End of Central Directory (EOCD) record allows for the creation of ZIP archives that are processed inconsistently by the `zipfile` module (bsc#1251305). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-4389=1 * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-4389=1

Topics%20covered

Topics Covered

security advisory python low OpenSUSE performance degradation zip archive issue

References

* bsc#1251305

* bsc#1252974

Cross-

* CVE-2025-6075

* CVE-2025-8291

CVSS scores:

* CVE-2025-6075 ( SUSE ): 1.8

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

* CVE-2025-6075 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

* CVE-2025-6075 ( NVD ): 1.8

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

* CVE-2025-8291 ( SUSE ): 4.8

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

* CVE-2025-8291 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Severity
low
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2025:4389-1
Release Date: 2025-12-12T13:49:32Z
Rating: low

Topics%20covered

Topics Covered

security advisory python low OpenSUSE performance degradation zip archive issue

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here