Release date:
2026-07-29 14:28:02 UTC
Description:
- CVE-2023-5752: Mercurial revision option injection via VCS URL
- CVE-2025-8869: tar extraction misses symlink target check (no PEP 706 fallback)
- CVE-2026-1703: path traversal via os.path.commonprefix containment check
- CVE-2026-3219: tar/ZIP polyglot archive interpretation conflict
- CVE-2026-6357: post-install self-version check could import malicious wheel content
- Restore el7 byte-compile path (regression from 21.3.1-3): double the
backslashes in the __os_install_post sed capture group so the rewrite
to the alt-python interpreter survives rpm macro expansion on el7
Updated packages:
-
alt-python39-pip-21.3.1-4.el8.noarch.rpm
sha:cda1f17719920f9644b700241d8f0dc615bef19df22b72bc17ee3f781050b59e
-
alt-python39-pip-wheel-21.3.1-4.el8.noarch.rpm
sha:d990873027bb14a57e074ea860c188386c5e455fc8f69d866591fa4b47540f14
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
