OESA-2026-3787 python-pip security update

%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...

OESA-2026-3786 python-pip security update

%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...

OESA-2026-3785 python-pip security update

%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...

Astra Linux – Vulnerability in python-pip

When installing a package from a Mercurial VCS URL e.g., “pip install hg+…” using pip before version 23.3, the specified Mercurial revision could be used to inject arbitrary configuration options into the “hg clone” call e.g., “--config”. Controlling the Mercurial configuration allows modifying t...

Astra Linux – Vulnerability in python-pip

A flaw was discovered in python-pip regarding its handling of Unicode separators in git references. A remote attacker could potentially exploit this issue to install a different revision in a repository. The greatest threat posed by this vulnerability is to data integrity. This issue has been fix...

Astra Linux – Vulnerability in python-pip

The pip package before version 19.2 for Python allows Directory Traversal when a URL is provided in an install command. This is possible because the Content-Disposition header can contain "../ in the filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This behavior occurs...

Astra Linux – Vulnerability in python-pip

When extracting a tar archive, pip may not check symbolic links pointing into the extraction directory if the tarfile module does not implement PEP 706. Note that upgrading pip to a “fixed” version does not fix all vulnerabilities that are mitigated by using a Python version that implements PEP...

SUSE-SU-2026:4174-1 Security update for python39.SUSE_SLE-15-SP3_Update

This update for python39.SUSESLE-15-SP3Update fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1703: files may be extracted outside t...

CVE-2026-13346 affecting package python-pip for versions less than 24.2-10

CVE-2026-13346 affecting package python-pip for versions less than 24.2-10. A patched version of the package is available...

[SECURITY] Fedora 45 Update: python-pip-26.1.2-5.fc45

pip is a package management system used to install and manage software packag es written in Python. Many packages can be found in the Python Package Index PyPI. pip is a recursive acronym that can stand for either "Pip Installs Packages" or "Pip Installs Python"...

Fedora 45 : python-pip (2026-d083cbcc1a)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d083cbcc1a advisory. Security fix for CVE-2026-13346 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CLEANSTART-2026-RT26999 pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels

Multiple security vulnerabilities affect the k8s-sidecar package. pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. See references for individual vulnerability details...

Security update for python-pip

This update for python-pip fixes the following issue: Fixed patch for CVE-2026-1703 to work with python2 where os.path.commonpath doesn't exists bsc1257599 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:4104-1 Security update for python-pip

This update for python-pip fixes the following issue: - Fixed patch for CVE-2026-1703 to work with python2 where os.path.commonpath doesn't exists bsc1257599...

CVE-2026-87059

A flaw was found in olm-operator-konflux-sample. The bundle builder stage installs and upgrades Python packages using pip, a package installer, without verifying their versions or using hash verification. This allows a malicious or compromised package to be introduced into the build process...

Security update for python

This update for python fixes the following issues: Security issues fixed: CVE-2026-13346: pip: arbitrary file installation via malicious package indexes bsc1273091. Non security issue fixed: Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl Patch Instructions: To install this SUSE upda...

SUSE-SU-2026:4061-1 Security update for python

This update for python fixes the following issues: Security issues fixed: - CVE-2026-13346: pip: arbitrary file installation via malicious package indexes bsc1273091. Non security issue fixed: - Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl...

EulerOS 2.0 SP12 : python-pip (EulerOS-SA-2026-3301)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...

EulerOS 2.0 SP12 : python-pip (EulerOS-SA-2026-3376)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...

ROS-20260908-73-0021

The vulnerability in python-pip is related to an incorrect restriction on the path name of the directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...