Linux · Rocky Linux · Security advisory · December 18, 2025

RLSA-2025:23530: Security update for 33 packages

RLSA-2025:23530, released December 18, 2025, fixes 12 CVEs across 33 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
12
None rated Critical
Exploited
0
None reported
Highest CVSS
9.4
Base score, 0 to 10
Highest EPSS
0.0155
75th percentile

Priority of the 12 CVEs

Patch now 0 Urgent 0 High 12 Routine 0

Fixed package versions

ProductReleaseFixed in
Cythonrocky 80:0.29.21-5.module+el8.10.0+1582+bc278001
PyYAMLrocky 80:5.4.1-1.module+el8.10.0+1860+afcc1c71
mod_wsgirocky 80:4.7.1-7.module+el8.10.0+1978+d4f111ba.1
numpyrocky 80:1.19.4-3.module+el8.10.0+1582+bc278001
pybind11rocky 80:2.7.1-1.module+el8.9.0+1357+a3b80af7
pytestrocky 80:6.0.2-2.module+el8.10.0+1860+afcc1c71
python-PyMySQLrocky 80:0.10.1-2.module+el8.10.0+1910+234ad790
python-attrsrocky 80:20.3.0-2.module+el8.10.0+1582+bc278001
python-cffirocky 80:1.14.3-2.module+el8.10.0+1860+afcc1c71
python-chardetrocky 80:3.0.4-19.module+el8.10.0+1582+bc278001
python-cryptographyrocky 80:3.3.1-3.module+el8.10.0+1697+7e517775
python-idnarocky 80:2.10-4.module+el8.10.0+1860+afcc1c71
python-iniconfigrocky 80:1.1.1-2.module+el8.9.0+1332+dd574197
python-lxmlrocky 80:4.6.5-1.module+el8.10.0+1582+bc278001
python-more-itertoolsrocky 80:8.5.0-2.module+el8.10.0+1582+bc278001
python-packagingrocky 80:20.4-4.module+el8.10.0+1860+afcc1c71
python-pluggyrocky 80:0.13.1-3.module+el8.10.0+1582+bc278001
python-plyrocky 80:3.11-10.module+el8.9.0+1418+f0d66789
python-psutilrocky 80:5.8.0-4.module+el8.9.0+1357+a3b80af7
python-psycopg2rocky 80:2.8.6-3.module+el8.10.0+1660+b5b6f004
python-pyrocky 80:1.10.0-1.module+el8.10.0+1860+afcc1c71
python-pycparserrocky 80:2.20-3.module+el8.10.0+1582+bc278001
python-pysocksrocky 80:1.7.1-4.module+el8.9.0+1418+f0d66789
python-requestsrocky 80:2.25.0-3.module+el8.10.0+1860+afcc1c71
python-tomlrocky 80:0.10.1-5.module+el8.9.0+1332+dd574197
python-urllib3rocky 80:1.25.10-5.module+el8.10.0+1860+afcc1c71
python-wcwidthrocky 80:0.2.5-3.module+el8.10.0+1860+afcc1c71
python-wheelrocky 81:0.35.1-4.module+el8.10.0+1582+bc278001
python3x-piprocky 80:20.2.4-9.module+el8.10.0+1721+e52d6351
python3x-pyparsingrocky 80:2.4.7-5.module+el8.10.0+1860+afcc1c71
python3x-setuptoolsrocky 80:50.3.2-7.module+el8.10.0+2057+30213a2b
python3x-sixrocky 80:1.15.0-3.module+el8.10.0+1582+bc278001
scipyrocky 80:1.5.4-5.module+el8.10.0+1860+afcc1c71

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2025-0938 URL parser allowed square brackets in domain names7.6 0.0155 None reported
High CVE-2025-4138 Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory7.6 0.0149 None reported
High CVE-2025-4517 Arbitrary writes via tarfile realpath overflow9.4 0.0148 None reported
High CVE-2025-4330 Extraction filter bypass for linking outside extraction directory7.6 0.0097 None reported
High CVE-2024-5642 Buffer overread when using an empty list with SSLContext.set_npn_protocols()7.6 0.0074 None reported
High CVE-2024-11168 Improper validation of IPv6 and IPvFuture addresses7.6 0.0066 None reported
High CVE-2024-9287 Virtual environment (venv) activation scripts don't quote paths7.8 0.0065 None reported
High CVE-2025-4435 Tarfile extracts filtered members when errorlevel=07.6 0.0062 None reported
High CVE-2025-6069 HTMLParser quadratic complexity when processing malformed inputs7.6 0.0060 None reported
High CVE-2025-8291 ZIP64 End of Central Directory (EOCD) Locator record offset not checked7.6 0.0047 None reported
High CVE-2025-4516 Use-after-free in "unicode_escape" decoder with error handler7.6 0.0023 None reported
High CVE-2025-6075 Quadratic complexity in os.path.expandvars() with user-controlled template8.1 0.0015 None reported
Showing 1 to 12 of 12 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.