Refresh RPM lockfiles [SECURITY]

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

File Dockerfiles/konflux/rpms.in.yaml:

Package	Change
python-unversioned-command	3.9.25-7.el9_8.2 -> 3.9.25-7.el9_8.3
python3	3.9.25-7.el9_8.2 -> 3.9.25-7.el9_8.3
python3-libs	3.9.25-7.el9_8.2 -> 3.9.25-7.el9_8.3

---

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

CVE-2026-11940

More information

Details

A flaw was found in the tarfile.extractall() function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-11940
• https://bugzilla.redhat.com/show_bug.cgi?id=2491848
• https://www.cve.org/CVERecord?id=CVE-2026-11940
• https://nvd.nist.gov/vuln/detail/CVE-2026-11940
• https://github.com/python/cpython/issues/151558
• https://github.com/python/cpython/pull/151559
• https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@red-hat-konflux-kflux-prd-rh02[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-platform-compliance	46d3626	link	true	/test e2e-aws-openshift-platform-compliance
ci/prow/e2e-aws-openshift-node-compliance	46d3626	link	false	/test e2e-aws-openshift-node-compliance
ci/prow/4.20-images	dfcfa5d	link	true	/test 4.20-images

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.