Release date:
2026-07-29 14:32:35 UTC
Description:
- CVE-2023-5752: Mercurial revision option injection via VCS URL
- CVE-2025-8869: tar extraction misses symlink target check (no PEP 706 fallback)
- CVE-2026-1703: path traversal via os.path.commonprefix containment check
- CVE-2026-3219: tar/ZIP polyglot archive interpretation conflict
- CVE-2026-6357: post-install self-version check could import malicious wheel content
- Restore el7 byte-compile path (regression from 21.3.1-3): double the
backslashes in the __os_install_post sed capture group so the rewrite
to the alt-python interpreter survives rpm macro expansion on el7
Updated packages:
-
alt-python39-pip-21.3.1-4.el9.noarch.rpm
sha:665b12b5c7bf72c1dda9686248289e53d6196ec45215cdcbacc64073deb87eee
-
alt-python39-pip-wheel-21.3.1-4.el9.noarch.rpm
sha:442d4881b23e92b61becac6684de4107a58a811374b52223bc423520770d1090
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
