https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:48:59 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-13251 bdu:2025-13251 https://cve.radiocsirt.org/vuln/bdu:2025-13251 https://cve.radiocsirt.org/vuln/bell-cve-2025-8869 <p><strong>Affected:</strong> Alpaquita:23: python3, BellSoft Hardened Containers:23: python3</p> <p><strong>Affected:</strong> Alpaquita:23: python3, BellSoft Hardened Containers:23: python3</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-8869 https://cve.radiocsirt.org/vuln/brew-azure-cli-cve-2025-8869 <p><strong>Affected:</strong> Homebrew: azure-cli</p> <p>When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&#39;t implement PEP 706. Note that upgrading pip to a &#34;fixed&#34; version for this vulnerability doesn&#39;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip&#39;s fallback implementation of tar extraction for Python versions that don&#39;t implement PEP 706 and therefore are not secure to all vulnerabilities in the Python &#39;tarfile&#39; module. If you&#39;re using a Python version that implements PEP 706 then pip doesn&#39;t use the &#34;vulnerable&#34; fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python &gt;=3.9.17, &gt;=3.10.12, &gt;=3.11.4, or &gt;=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.</p> <p><strong>Affected:</strong> Homebrew: azure-cli</p> <p>When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&#39;t implement PEP 706. Note that upgrading pip to a &#34;fixed&#34; version for this vulnerability doesn&#39;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip&#39;s fallback implementation of tar extraction for Python versions that don&#39;t implement PEP 706 and therefore are not secure to all vulnerabilities in the Python &#39;tarfile&#39; module. If you&#39;re using a Python version that implements PEP 706 then pip doesn&#39;t use the &#34;vulnerable&#34; fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python &gt;=3.9.17, &gt;=3.10.12, &gt;=3.11.4, or &gt;=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.</p> https://cve.radiocsirt.org/vuln/brew-azure-cli-cve-2025-8869 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0935 certfr-2025-avi-0935 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0935 https://cve.radiocsirt.org/vuln/cleanstart-2026-bz71423 <p><strong>Affected:</strong> CleanStart: k8s-sidecar</p> <p>Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: k8s-sidecar</p> <p>Security vulnerability affects the k8s-sidecar package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bz71423 https://cve.radiocsirt.org/vuln/euvd-2026-257493 EUVD-2026-257493 https://cve.radiocsirt.org/vuln/euvd-2026-257493 https://cve.radiocsirt.org/vuln/fkie_cve-2025-8869 <p>When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&#39;t implement PEP 706. Note that upgrading pip to a &#34;fixed&#34; version for this vulnerability doesn&#39;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.</p> <p>Note that this is a vulnerability in pip&#39;s fallback implementation of tar extraction for Python versions that don&#39;t implement PEP 706 and therefore are not secure to all vulnerabilities in the Python &#39;tarfile&#39; module. If you&#39;re using a Python version that implements PEP 706 then pip doesn&#39;t use the &#34;vulnerable&#34; fallback code.</p> <p>Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python &gt;=3.9.17, &gt;=3.10.12, &gt;=3.11.4, or &gt;=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.</p> <p>When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&#39;t implement PEP 706. Note that upgrading pip to a &#34;fixed&#34; version for this vulnerability doesn&#39;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.</p> <p>Note that this is a vulnerability in pip&#39;s fallback implementation of tar extraction for Python versions that don&#39;t implement PEP 706 and therefore are not secure to all vulnerabilities in the Python &#39;tarfile&#39; module. If you&#39;re using a Python version that implements PEP 706 then pip doesn&#39;t use the &#34;vulnerable&#34; fallback code.</p> <p>Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python &gt;=3.9.17, &gt;=3.10.12, &gt;=3.11.4, or &gt;=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-8869 https://cve.radiocsirt.org/vuln/ghsa-4xh5-x5gv-qwph <p><strong>Affected:</strong> PyPI: pip</p> <p>When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&#39;t implement PEP 706. Note that upgrading pip to a &#34;fixed&#34; version for this vulnerability doesn&#39;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip&#39;s fallback implementation of tar extraction for Python versions that don&#39;t implement PEP 706 and therefore are not secure to all vulnerabilities in the Python &#39;tarfile&#39; module. If you&#39;re using a Python version that implements PEP 706 then pip doesn&#39;t use the &#34;vulnerable&#34; fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python &gt;=3.9.17, &gt;=3.10.12, &gt;=3.11.4, or &gt;=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.</p> <p><strong>Affected:</strong> PyPI: pip</p> <p>When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&#39;t implement PEP 706. Note that upgrading pip to a &#34;fixed&#34; version for this vulnerability doesn&#39;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip&#39;s fallback implementation of tar extraction for Python versions that don&#39;t implement PEP 706 and therefore are not secure to all vulnerabilities in the Python &#39;tarfile&#39; module. If you&#39;re using a Python version that implements PEP 706 then pip doesn&#39;t use the &#34;vulnerable&#34; fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python &gt;=3.9.17, &gt;=3.10.12, &gt;=3.11.4, or &gt;=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.</p> https://cve.radiocsirt.org/vuln/ghsa-4xh5-x5gv-qwph https://cve.radiocsirt.org/vuln/msrc_cve-2025-8869 msrc_CVE-2025-8869 https://cve.radiocsirt.org/vuln/msrc_cve-2025-8869 https://cve.radiocsirt.org/vuln/oesa-2025-2714 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: python-pip</p> <p>pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes. %global bashcompdir %(b=$(pkg-config --variable=completionsdir bash-completion 2&amp;amp;gt;/dev/null); echo ${b:-/bash_completion.d}) Name: python-pip Version: 20.2.2 Release: 4 Summary: A tool for installing and managing Python packages License: MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD) URL: http://www.pip-installer.org Source0: https://files.pythonhosted.org/packages/source/p/pip/pip-.tar.gz BuildArch: noarch Patch1: allow-stripping-given-prefix-from-wheel-RECORD-files. Patch2: emit-a-warning-when-running-with-root-privileges.patch Patch3: remove-existing-dist-only-if-path-conflicts.patch Patch6000: dummy-certifi.patch Patch6001: backport-CVE-2021-3572.patch Security Fix(es):</p> <p>When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&amp;apos;t implement PEP 706. Note that upgrading pip to a &amp;quot;fixed&amp;quot; version for this vulnerability doesn&amp;apos;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.</p> <p>Note that this is a vulnerability in pip&amp;apos;s fallback implementation of tar extraction for Python versions that don&amp;apos;t implement PEP 706 and therefore are not secure to all vulnerabilities in…</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: python-pip</p> <p>pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes. %global bashcompdir %(b=$(pkg-config --variable=completionsdir bash-completion 2&amp;amp;gt;/dev/null); echo ${b:-/bash_completion.d}) Name: python-pip Version: 20.2.2 Release: 4 Summary: A tool for installing and managing Python packages License: MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD) URL: http://www.pip-installer.org Source0: https://files.pythonhosted.org/packages/source/p/pip/pip-.tar.gz BuildArch: noarch Patch1: allow-stripping-given-prefix-from-wheel-RECORD-files. Patch2: emit-a-warning-when-running-with-root-privileges.patch Patch3: remove-existing-dist-only-if-path-conflicts.patch Patch6000: dummy-certifi.patch Patch6001: backport-CVE-2021-3572.patch Security Fix(es):</p> <p>When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&amp;apos;t implement PEP 706. Note that upgrading pip to a &amp;quot;fixed&amp;quot; version for this vulnerability doesn&amp;apos;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.</p> <p>Note that this is a vulnerability in pip&amp;apos;s fallback implementation of tar extraction for Python versions that don&amp;apos;t implement PEP 706 and therefore are not secure to all vulnerabilities in…</p> https://cve.radiocsirt.org/vuln/oesa-2025-2714 https://cve.radiocsirt.org/vuln/pysec-2026-1795 <p><strong>Affected:</strong> PyPI: pip</p> <p>When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&#39;t implement PEP 706. Note that upgrading pip to a &#34;fixed&#34; version for this vulnerability doesn&#39;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip&#39;s fallback implementation of tar extraction for Python versions that don&#39;t implement PEP 706 and therefore are not secure to all vulnerabilities in the Python &#39;tarfile&#39; module. If you&#39;re using a Python version that implements PEP 706 then pip doesn&#39;t use the &#34;vulnerable&#34; fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python &gt;=3.9.17, &gt;=3.10.12, &gt;=3.11.4, or &gt;=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.</p> <p><strong>Affected:</strong> PyPI: pip</p> <p>When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&#39;t implement PEP 706. Note that upgrading pip to a &#34;fixed&#34; version for this vulnerability doesn&#39;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip&#39;s fallback implementation of tar extraction for Python versions that don&#39;t implement PEP 706 and therefore are not secure to all vulnerabilities in the Python &#39;tarfile&#39; module. If you&#39;re using a Python version that implements PEP 706 then pip doesn&#39;t use the &#34;vulnerable&#34; fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python &gt;=3.9.17, &gt;=3.10.12, &gt;=3.11.4, or &gt;=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1795 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-8869 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-pip</p> <p>When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&#39;t implement PEP 706. Note that upgrading pip to a &#34;fixed&#34; version for this vulnerability doesn&#39;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip&#39;s fallback implementation of tar extraction for Python versions that don&#39;t implement PEP 706 and therefore are not secure to all vulnerabilities in the Python &#39;tarfile&#39; module. If you&#39;re using a Python version that implements PEP 706 then pip doesn&#39;t use the &#34;vulnerable&#34; fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python &gt;=3.9.17, &gt;=3.10.12, &gt;=3.11.4, or &gt;=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-pip</p> <p>When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn&#39;t implement PEP 706. Note that upgrading pip to a &#34;fixed&#34; version for this vulnerability doesn&#39;t fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip&#39;s fallback implementation of tar extraction for Python versions that don&#39;t implement PEP 706 and therefore are not secure to all vulnerabilities in the Python &#39;tarfile&#39; module. If you&#39;re using a Python version that implements PEP 706 then pip doesn&#39;t use the &#34;vulnerable&#34; fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python &gt;=3.9.17, &gt;=3.10.12, &gt;=3.11.4, or &gt;=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-8869 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1210 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1210