Rocky Linux 8.6 [CIQ] Security Update: python39-pip / python39-pip-wheel (ciqsa-2026_0233)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260233 advisory. This advisory aggregates security fixes for the python3x-pip SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2021-28861. Tenable has extracted the preceding...

Rocky Linux 8.6 [CIQ] Security Update: python38-pip / python38-pip-wheel Multiple Vulnerabilities (ciqsa-2026_0210)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260210 advisory. This advisory aggregates security fixes for the python3x-pip SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2015-20107, CVE-2020-10735, CVE-2021-28861,...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11-pip / python3.11-pip-wheel (ALMALINUX9.2:CLSA-2025:1765376235)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1765376235 advisory. - Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote...

SUSE-SU-2026:4174-1 Security update for python39.SUSE_SLE-15-SP3_Update

This update for python39.SUSESLE-15-SP3Update fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1703: files may be extracted outside t...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-pip: python-pip-wheel-26.2-0.1.hum1 noarch python3-pip-26.2-0.1.hum1 noarch python-pip-26.2-0.1.hum1.src src Security Fixes: python-pip: CVE-2026-13346...

Important: Red Hat Security Advisory: python3.14-pip security update

An update for python3.14-pip is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite

A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to wri...

python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite

A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to wri...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-pip: python-pip-wheel-26.1.1-3.hum1 noarch python3-pip-26.1.1-3.hum1 noarch python-pip-26.1.1-3.hum1.src src...

Amazon Linux 2023 : python3.12-pip, python3.12-pip-wheel (ALAS2023-2026-1666)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1666 advisory. pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such...

Fedora 44 : pypy (2026-130f7539d3)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-130f7539d3 advisory. Security fix for CVE-2026-3219 in the bundled pip wheel Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

Fedora 43 : pypy (2026-3505a95524)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3505a95524 advisory. Security fix for CVE-2026-3219 in the bundled pip wheel Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2026-1689)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1689 advisory. pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferr...

Fedora 45 : pypy (2026-b58cd376d6)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b58cd376d6 advisory. Automatic update for pypy-7.3.22-2.fc45. Changelog Tue May 5 2026 Charalampos Stratakis - 7.3.22-2 - Security fix for CVE-2026-3219 in the bundled pip wheel ...

GHSA-58QW-9MGM-455V vulnerabilities

Vulnerabilities for packages: request-1276, localstack, nemo, ansible-operator, azure-functions-host, pypy-3.11, nemo-rl-cuda-13.0, ansible-operator-fips, nvidia-nsight-compute-13.1, py3-hashin, py3-pip-wheel-bootstrap, tensorflow-gpu-jupyter, kubeflow-katib, py3-virtualenv, py3.14-virtualenv,...

CVE-2026-3219 vulnerabilities

Vulnerabilities for packages: request-1276, localstack, nemo, ansible-operator, azure-functions-host, pypy-3.11, nemo-rl-cuda-13.0, ansible-operator-fips, nvidia-nsight-compute-13.1, py3-hashin, py3-pip-wheel-bootstrap, tensorflow-gpu-jupyter, kubeflow-katib, py3-virtualenv, py3.14-virtualenv,...

CVE-2026-3219 vulnerabilities

Vulnerabilities for packages: pypy-3.11, datadog-agent, kubeflow-katib, py3-virtualenv, py3-pip, py3-cassandra-medusa, py3.14-virtualenv, pypy-3.10, py3-pip-wheel-bootstrap...

Amazon Linux 2023 : python3.13-pip, python3.13-pip-wheel (ALAS2023-2026-1490)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1490 advisory. When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation...

AZL-76593 CVE-2026-1703 affecting package python-pip for versions less than 24.2-6

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations...

AZL-76499 CVE-2026-1703 affecting package python3 3.9.19-19

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations...