Ubuntu

Security Advisory

Python Regression & Email Header- Ubuntu Security Updates Patch Now 

Summary: USN-8018-1 fixed vulnerabilities in python3. That update introduced regressions. The patches for CVE-2025-15366 and CVE-2025-15367 caused behavior regressions in IMAP and POP3 handling, which upstream chose to avoid by not backporting them. 

OEM Python 
Severity Medium 
CVSS Score 6.5 
CVEs CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 
POC Available No 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

Python is a widely used high-level programming language that powers many enterprise applications, automation frameworks, DevOps pipelines, web platforms and email-processing services. Many Linux distributions – Ubuntu provide Python runtime packages as core system components. 

Ubuntu released USN-8018-2 to address regressions introduced in the previous security update USN-8018-1. The earlier update attempted to fix vulnerabilities related to email header parsing and input validation but unintentionally introduced compatibility issues affecting IMAP, POP3, and WSGI header processing. 

The new advisory prioritizes the fix for CVE-2026-0865, while also addressing issues related to CVE-2025-15366 and CVE-2025-15367.  

      Vulnerability Name CVE ID Product Affected Severity CVSS Score Fixed Version 
WSGI Header Parsing Regression Vulnerability CVE-2026-0865 Python Medium 6.5 Updated Python packages 
Email Header Injection Vulnerability CVE-2025-15366 Python Medium 5.9 Updated Python packages 
Improper Email Header Parsing Vulnerability CVE-2025-15367 Python Medium 5.9 Updated Python packages 

Technical Summary 

These vulnerabilities affect multiple Python versions distributed within Ubuntu systems. 

The original security update introduced patches intended to address email header parsing vulnerabilities. However, those fixes resulted in unintended behavioural regressions. 

The CVE-2026-0865 patch incorrectly rejected horizontal tab characters in WSGI headers, potentially causing web applications relying on Python frameworks to malfunction. 

Additionally, patches for CVE-2025-15366 and CVE-2025-15367 affected IMAP and POP3 email processing behavior, which allow upstream developers to avoid backporting those changes due to compatibility concerns. 

Ubuntu released updated packages to resolve these regressions while maintaining protection against the underlying vulnerabilities. 

CVE ID System Affected Vulnerability Details Impact 
CVE-2026-0865 Python (multiple Ubuntu packages) Incorrect rejection of horizontal tabs in WSGI headers after patch Web application compatibility issues 
CVE-2025-15366 Python email parsing library Improper parsing allowing email header injection Email spoofing or message manipulation 
CVE-2025-15367 Python email processing modules Improper validation of message headers Header manipulation in email processing 

Affected Packages 

The following Python packages are affected – 

python3.4  python3.5  python3.6  python3.7  python3.8 

python3.10  python3.12  python3.13  python3.14 

Remediation:  

Apply the latest Ubuntu security updates immediately- 

Fixed Package Versions 

Ubuntu Release Fixed Package Version 
Ubuntu 25.10 python3.13 – 3.13.7-1ubuntu0.4 / python3.14 – 3.14.0-1ubuntu0.3 
Ubuntu 24.04 LTS python3.12 – 3.12.3-1ubuntu0.12 
Ubuntu 22.04 LTS python3.10 – 3.10.12-1 22.04.15 
Ubuntu 20.04 LTS python3.8 – 3.8.10-0ubuntu1 20.04.18 
Ubuntu 18.04 LTS Updated ESM packages 
Ubuntu 16.04 LTS Updated ESM packages 
Ubuntu 14.04 LTS Updated ESM packages 

If immediate patching is not possible, apply the following temporary mitigations- 

  1. Restrict access to email-processing services where Python handles inbound messages. 
  1. Validate and sanitize email headers within application logic. 
  1. Monitor logs for abnormal IMAP/POP3 parsing errors. 
  1. Test Python-based web applications to detect WSGI header parsing issues. 

You can follow the recommendations below as a best practice- 

  • Maintain regular patch management for system packages. 
  • Monitor Python runtime libraries for security advisories. 
  • Implement secure email validation mechanisms within applications. 
  • Use application security testing tools to detect input-validation weaknesses. 
  • Monitor logs for abnormal email header patterns or parsing failures. 

Conclusion: 
The vulnerabilities addressed in USN-8018-2 highlight the risks associated with improper email header parsing and regression issues in widely used programming libraries such as Python. The primary concern, CVE-2026-0865, affects WSGI header handling and could disrupt web applications, while CVE-2025-15366 and CVE-2025-15367 relate to email header parsing weaknesses. 

Organizations using Python-based applications or email processing services should prioritize updating affected Ubuntu packages to ensure both security and application stability. 

References:  

Security Advisory

12-Year-Old Sudo Vulnerability & Chroot Flaw Enable Privilege Escalation  

Summary : Security Advisory: Two critical vulnerabilities CVE-2025-32462 and CVE-2025-32463 have been identified in the widely used Sudo utility, enabling local privilege escalation to root. System administrators rely on Sudo to enforce the principle of least privilege and maintain an audit trail of administrative actions.

The flaw, present in Sudo’s codebase for over 12 years, was discovered by Rich Mirch of the Stratascale Cyber Research Unit and affects both stable (v1.9.0–1.9.17) and legacy (v1.8.8–1.8.32) versions of Sudo.

Severity Critical 
CVSS Score 9.3 
CVEs CVE-2025-32463, CVE-2025-32462 
POC Available Yes 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

These flaws affect both legacy and modern versions of Sudo and impact Linux and Unix-like systems, including Ubuntu and macOS. One vulnerability (CVE-2025-32462)remained undiscovered for over 12 years. Both have been fixed in Sudo version 1.9.17p1. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Chroot Option Arbitrary Code Execution vulnerability  CVE-2025-32463 Sudo  Critical  1.9.17p1 
Host Option Privilege Escalation vulnerability  CVE-2025-32462 Sudo   Low  1.9.17p1 

Technical Summary 

CVE-2025-32463 – Chroot Privilege Escalation via Path Confusion 

Introduced in Sudo version 1.9.14, this vulnerability abuses the –chroot (-R) feature, allowing attackers to run commands as root even if not permitted in the sudoers file.

The flaw arises because Sudo began resolving paths inside the chroot environment before validating permissions. This allowed attackers to trick Sudo into referencing malicious configuration files (e.g., fake /etc/nsswitch.conf) and loading arbitrary shared libraries (e.g.-libnss_/woot1337.so.2) during the privilege escalation process. 

CVE-2025-32462 – Host Option Bypass 

CVE-2025-32462 exploits improper handling of the –host (-h) option in Sudo, allowing users to bypass hostname-based access restrictions and execute commands as root. 

CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-32463 Stable 1.9.0 – 1.9.17  Exploits the -R chroot option to load attacker-controlled shared libraries, leading to root access even when user lacks necessary permissions.  Arbitrary code execution as root 
CVE-2025-32462 Stable 1.9.0 – 1.9.17 Legacy 1.8.8 – 1.8.32  Allows local users to abuse the -h option to bypass Host or Host_Alias restrictions and execute commands as root across unintended systems.  Local privilege escalation to root 

Remediation: 

Upgrade Sudo to version 1.9.17p1 or later or the appropriate patched package version provided by your Linux distribution. 

Conclusion: 
These Sudo vulnerabilities, especially CVE-2025-32463 with a CVSS score of 9.3, represent a serious threat to system integrity. Exploitable without complex tooling and with a public Proof-of-Concept (PoC) already available, this vulnerability underscores the risks posed by long-standing design flaws in foundational system utilities.

Administrators are strongly advised.

Update Sudo to version 1.9.17p1 or later on all systems. Organizations must act swiftly to patch affected systems, audit privileged access, and secure their Sudo configurations.

This incident reinforces the urgent need for continuous security reviews even for the most trusted and widely deployed open-source components and prevent unauthorized privilege escalation on affected systems.

References: 

Scroll to top