Most recent entries from all

ALSA-2026:36193 — Important: python3.14-pip security update

Affected: AlmaLinux:10: python3.14-pip, AlmaLinux:10: python3.14-pip-wheel

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (CVE-2026-8643)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-10841

BELL-CVE-2026-8643

Affected: Alpaquita:23: py3-pip, Alpaquita:25: py3-pip, Alpaquita:stream: py3-pip, BellSoft Hardened Containers:23: py3-pip, BellSoft Hardened Containers:25: py3-pip, BellSoft Hardened Containers:stream: py3-pip

BREW-azure-cli-CVE-2026-8643 — pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target direct…

Affected: Homebrew: azure-cli

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

certfr-2026-avi-0783 — De multiples vulnérabilités ont été découvertes dans Microsoft Azure. Elles permettent à un attaquant de provoquer une…

certfr-2026-avi-0783

Withdrawn: CLEANSTART-2026-FZ53018 — Security fixes in python3 3.12.13-r1

Withdrawn by the publisher.

Affected: CleanStart: python3

Package python3 version 3.12.13-r1 fixes 1 vulnerabilities: CVE-2026-8643

EUVD-2026-369279

fkie_cve-2026-8643

GHSA-wf93-45jw-7689 — pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target direct…

Affected: PyPI: pip

msrc_CVE-2026-8643 — pip can extract console_scripts and gui_scripts outside installation directory

msrc_CVE-2026-8643

OESA-2026-2544 — python-pip security update

Affected: openEuler:24.03-LTS-SP3: python-pip

%changelog * Thu May 14 2026 markeryang &lt;747675909@qq.com&gt; - 23.3.1-11 - Fix CVE-2026-3219 Security Fix(es):

When following cross-origin redirects for requests made using urllib3's high-level APIs, such as urllib3.request(), PoolManager.request(), and ProxyManager.request(), sensitive headers — Authorization, Cookie, and Proxy-Authorization (defined in Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT) — are stripped by default, as expected. However, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers.(CVE-2026-44431)

A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.(CVE-2026-8643)

openSUSE-SU-2026:10940-1 — python311-pip-26.1.2-1.1 on GA media

python311-pip-26.1.2-1.1 on GA media

PYSEC-2026-196

Affected: PyPI: pip

RHSA-2026:33313 — Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification libxslt: use-after-free with key data stored cross-RVT libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string image-size: image-size: Denial of Service due to infinite loop when processing specially crafted images. python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite nginx: ngx_http_rewrite_module: code execution and denial of service openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key libpng: libpng: Arbitrary code execution due to use-after-free vulnerability libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion vim: Command injection allows arbitrary code execution via malicious tag files urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3: urllib3: Denial of Service due to excessive HTTP response decompression

RLSA-2026:36193 — Important: python3.14-pip security update

Affected: Rocky Linux:10: python3.14-pip

Security Fix(es):

* python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (CVE-2026-8643)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:22300-1 — Security update for python-pip

Security update for python-pip

UBUNTU-CVE-2026-8643

Affected: Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:Pro:22.04:LTS: python-pip, Ubuntu:Pro:24.04:LTS: python-pip, Ubuntu:25.10: python-pip, Ubuntu:Pro:26.04:LTS: python-pip

WID-SEC-W-2026-2222 — Red Hat Enterprise Linux (python-pip): Schwachstelle ermöglicht Codeausführung

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um beliebige Dateien zu überschreiben und möglicherweise beliebigen Code auszuführen.