{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"Medium"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"pylint security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for pylint is now available for openEuler-24.03-LTS-SP3",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"Pylint is a Python source code analyzer which looks for programming errors, helps enforcing a coding standard and sniffs for some code smells (as defined in Martin Fowler's Refactoring book). Pylint can be seen as another PyChecker since nearly all tests you can do with PyChecker can also be done with Pylint. However, Pylint offers some more features, like checking length of lines of code, checking if variable names are well-formed according to your coding standard, or checking if declared interfaces are truly implemented, and much more. Additionally, it is possible to write plugins to add your own checks.\n\nSecurity Fix(es):\n\nPylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.(CVE-2026-114608)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for pylint is now available for openEuler-24.03-LTS-SP3.\n\nopenEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"Medium",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"pylint",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2026-4701",
				"category":"self",
				"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4701"
			},
			{
				"summary":"CVE-2026-114608",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-114608&packageName=pylint"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114608"
			},
			{
				"summary":"openEuler-SA-2026-4701 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-4701.json"
			}
		],
		"title":"An update for pylint is now available for openEuler-24.03-LTS-SP3",
		"tracking":{
			"initial_release_date":"2026-11-09T09:27:12+08:00",
			"revision_history":[
				{
					"date":"2026-11-09T09:27:12+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				}
			],
			"generator":{
				"date":"2026-11-09T09:27:12+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2026-11-09T09:27:12+08:00",
			"id":"openEuler-SA-2026-4701",
			"version":"1.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"openEuler-24.03-LTS-SP3",
									"name":"openEuler-24.03-LTS-SP3"
								},
								"name":"openEuler-24.03-LTS-SP3",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"noarch",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"pylint-3.0.3-3.oe2403sp3.noarch.rpm",
									"name":"pylint-3.0.3-3.oe2403sp3.noarch.rpm"
								},
								"name":"pylint-3.0.3-3.oe2403sp3.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"python3-pylint-3.0.3-3.oe2403sp3.noarch.rpm",
									"name":"python3-pylint-3.0.3-3.oe2403sp3.noarch.rpm"
								},
								"name":"python3-pylint-3.0.3-3.oe2403sp3.noarch.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"pylint-3.0.3-3.oe2403sp3.src.rpm",
									"name":"pylint-3.0.3-3.oe2403sp3.src.rpm"
								},
								"name":"pylint-3.0.3-3.oe2403sp3.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"pylint-3.0.3-3.oe2403sp3.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:pylint-3.0.3-3.oe2403sp3.noarch",
					"name":"pylint-3.0.3-3.oe2403sp3.noarch as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"python3-pylint-3.0.3-3.oe2403sp3.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:python3-pylint-3.0.3-3.oe2403sp3.noarch",
					"name":"python3-pylint-3.0.3-3.oe2403sp3.noarch as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"pylint-3.0.3-3.oe2403sp3.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:pylint-3.0.3-3.oe2403sp3.src",
					"name":"pylint-3.0.3-3.oe2403sp3.src as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2026-114608",
			"notes":[
				{
					"text":"Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS-SP3:pylint-3.0.3-3.oe2403sp3.noarch",
					"openEuler-24.03-LTS-SP3:python3-pylint-3.0.3-3.oe2403sp3.noarch",
					"openEuler-24.03-LTS-SP3:pylint-3.0.3-3.oe2403sp3.src"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS-SP3:pylint-3.0.3-3.oe2403sp3.noarch",
						"openEuler-24.03-LTS-SP3:python3-pylint-3.0.3-3.oe2403sp3.noarch",
						"openEuler-24.03-LTS-SP3:pylint-3.0.3-3.oe2403sp3.src"
					],
					"details":"pylint security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4701"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":5.4,
						"vectorString":"CVSS:3.1/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS-SP3:pylint-3.0.3-3.oe2403sp3.noarch",
						"openEuler-24.03-LTS-SP3:python3-pylint-3.0.3-3.oe2403sp3.noarch",
						"openEuler-24.03-LTS-SP3:pylint-3.0.3-3.oe2403sp3.src"
					]
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2026-114608"
		}
	]
}