[CLSA-2026:1788290297] Fix CVE(s): CVE-2024-6345, CVE-2025-47273

Type:

security

Severity:

Important

Release date:

2026-09-01 19:18:29 UTC

Description:

   * SECURITY UPDATE: command injection in PackageIndex VCS downloads
     - debian/patches/CVE-2024-6345.patch: pass argv lists to
       subprocess.check_call() instead of interpolating the URL and revision
       into an os.system() shell string (CWE-78).
     - CVE-2024-6345
   * SECURITY UPDATE: path traversal in the download filename
     - debian/patches/CVE-2025-47273.patch: sanitise the name derived from the
       URL so a percent-encoded absolute path cannot escape tmpdir (CWE-22).
     - CVE-2025-47273

CVEs fixed:

CVE-2024-6345
CVE-2025-47273

Updated packages:

alt-python27-setuptools_36.3.0-8_all.deb
sha:6a95df1fc975abe97884026ec1409467b77cbbc3

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.