Amazon Linux 2023 : python3.13-virtualenv (ALAS2023-2026-3296)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3296 advisory. virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download...

Amazon Linux 2023 : python3-virtualenv (ALAS2023-2026-3295)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3295 advisory. virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download...

Important: python-virtualenv

Issue Overview: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the...

Important: python3.13-virtualenv

Issue Overview: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the...

EUVD-2026-105260

virtualenv: Downloaded wheel selection and caching precede verification...

SUSE CVE-2026-113714

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

Linux Distros Unpatched Vulnerability : CVE-2026-113714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusabl...

DEBIAN-CVE-2026-113714

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

AZL-112583 CVE-2026-113714 affecting package python-virtualenv 20.36.1-11

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

CVE-2026-113714

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

CVE-2026-113714 virtualenv: Downloaded wheel selection and caching precede verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

CVE-2026-113714

The virtualenv tool, versions 21.14.8 through 21.14.9 , contains a vulnerability in the download_wheel() function. The root cause is that downloaded package-index data is written directly into the reusable wheel/house cache before the verification target is selected from pip's textual output. If ...

CVE-2026-113714

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

CVE-2026-113714 virtualenv: Downloaded wheel selection and caching precede verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

CVE-2026-113714

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

Python Packaging Authority virtualenv encryption vulnerability

The Python Packaging Authority virtualenv version 21.14.8 has a security vulnerability. This vulnerability stems from downloadwheel, which downloads the package index into a reusable cache before validating the target based on the Saved output from pip. Due to a flaw in the digest comparison, a...

Linux Distros Unpatched Vulnerability : CVE-2026-102930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for...

EUVD-2026-89462

virtualenv: Downloaded seed wheels pip/setuptools are not integrity-checked before use...

Resources Downloaded over Insecure Protocol

Overview Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol via the downloadwheel function in src/virtualenv/seed/wheels/acquire.py, which invokes pip download to fetch seed wheels without subsequently verifying the downloaded wheel's SHA-256 digest...

CVE-2026-102930

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...