{
  "document": {
    "aggregate_severity": {
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      },
      {
        "category": "details",
        "text": "CVE-2026-13346: pip Link.filename decoded doubly-encoded package URLs twice, allowing path traversal on install",
        "title": "Details"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1789137152",
        "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1789137152"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_alt_python/el10/advisories/2026/clsa-2026_1789137152.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-09-11T15:54:06Z",
      "generator": {
        "date": "2026-09-11T15:54:06Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CLSA-2026:1789137152",
      "initial_release_date": "2026-09-11T14:33:06Z",
      "revision_history": [
        {
          "date": "2026-09-11T14:33:06Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-11T15:54:06Z",
          "number": "2",
          "summary": "Update document"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "alt-python38-pip: Fix of CVE-2026-13346"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Community Enterprise Operating System 10",
                "product": {
                  "name": "Community Enterprise Operating System 10",
                  "product_id": "CentOS-10",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:centos:centos:10:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Community Enterprise Operating System"
          }
        ],
        "category": "vendor",
        "name": "Cloud Linux Software, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "alt-python38-pip-0:22.2.1-6.el10.noarch",
                "product": {
                  "name": "alt-python38-pip-0:22.2.1-6.el10.noarch",
                  "product_id": "alt-python38-pip-0:22.2.1-6.el10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python38-pip@22.2.1-6.el10?arch=noarch&os_name=centos&os_version=10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "alt-python38-pip-wheel-0:22.2.1-6.el10.noarch",
                "product": {
                  "name": "alt-python38-pip-wheel-0:22.2.1-6.el10.noarch",
                  "product_id": "alt-python38-pip-wheel-0:22.2.1-6.el10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/alt-python38-pip-wheel@22.2.1-6.el10?arch=noarch&os_name=centos&os_version=10"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python38-pip-0:22.2.1-6.el10.noarch as a component of Community Enterprise Operating System 10",
          "product_id": "CentOS-10:alt-python38-pip-0:22.2.1-6.el10.noarch"
        },
        "product_reference": "alt-python38-pip-0:22.2.1-6.el10.noarch",
        "relates_to_product_reference": "CentOS-10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "alt-python38-pip-wheel-0:22.2.1-6.el10.noarch as a component of Community Enterprise Operating System 10",
          "product_id": "CentOS-10:alt-python38-pip-wheel-0:22.2.1-6.el10.noarch"
        },
        "product_reference": "alt-python38-pip-wheel-0:22.2.1-6.el10.noarch",
        "relates_to_product_reference": "CentOS-10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13346",
      "cwe": {
        "id": "CWE-36",
        "name": "Absolute Path Traversal"
      },
      "notes": [
        {
          "category": "description",
          "text": "pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "CentOS-10:alt-python38-pip-0:22.2.1-6.el10.noarch",
          "CentOS-10:alt-python38-pip-wheel-0:22.2.1-6.el10.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-13346"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/pip/pull/14110",
          "url": "https://github.com/pypa/pip/pull/14110"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/07/29/7",
          "url": "http://www.openwall.com/lists/oss-security/2026/07/29/7"
        }
      ],
      "release_date": "2026-07-29T19:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T14:32:34.743757Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1789137152",
          "product_ids": [
            "CentOS-10:alt-python38-pip-0:22.2.1-6.el10.noarch",
            "CentOS-10:alt-python38-pip-wheel-0:22.2.1-6.el10.noarch"
          ],
          "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1789137152"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    },
    {
      "cve": "CVE-2026-8643",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
      },
      "notes": [
        {
          "category": "description",
          "text": "pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "CentOS-10:alt-python38-pip-0:22.2.1-6.el10.noarch",
          "CentOS-10:alt-python38-pip-wheel-0:22.2.1-6.el10.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els-alt-python/cve/CVE-2026-8643"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/pip/pull/14000",
          "url": "https://github.com/pypa/pip/pull/14000"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/06/01/5",
          "url": "http://www.openwall.com/lists/oss-security/2026/06/01/5"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:33313",
          "url": "https://access.redhat.com/errata/RHSA-2026:33313"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34374",
          "url": "https://access.redhat.com/errata/RHSA-2026:34374"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34456",
          "url": "https://access.redhat.com/errata/RHSA-2026:34456"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34739",
          "url": "https://access.redhat.com/errata/RHSA-2026:34739"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34740",
          "url": "https://access.redhat.com/errata/RHSA-2026:34740"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34741",
          "url": "https://access.redhat.com/errata/RHSA-2026:34741"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34748",
          "url": "https://access.redhat.com/errata/RHSA-2026:34748"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34749",
          "url": "https://access.redhat.com/errata/RHSA-2026:34749"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34750",
          "url": "https://access.redhat.com/errata/RHSA-2026:34750"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34752",
          "url": "https://access.redhat.com/errata/RHSA-2026:34752"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34756",
          "url": "https://access.redhat.com/errata/RHSA-2026:34756"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34758",
          "url": "https://access.redhat.com/errata/RHSA-2026:34758"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34760",
          "url": "https://access.redhat.com/errata/RHSA-2026:34760"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34765",
          "url": "https://access.redhat.com/errata/RHSA-2026:34765"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34772",
          "url": "https://access.redhat.com/errata/RHSA-2026:34772"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34773",
          "url": "https://access.redhat.com/errata/RHSA-2026:34773"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34774",
          "url": "https://access.redhat.com/errata/RHSA-2026:34774"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34775",
          "url": "https://access.redhat.com/errata/RHSA-2026:34775"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34776",
          "url": "https://access.redhat.com/errata/RHSA-2026:34776"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34777",
          "url": "https://access.redhat.com/errata/RHSA-2026:34777"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34778",
          "url": "https://access.redhat.com/errata/RHSA-2026:34778"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34780",
          "url": "https://access.redhat.com/errata/RHSA-2026:34780"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:34891",
          "url": "https://access.redhat.com/errata/RHSA-2026:34891"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:36193",
          "url": "https://access.redhat.com/errata/RHSA-2026:36193"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:36315",
          "url": "https://access.redhat.com/errata/RHSA-2026:36315"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:37275",
          "url": "https://access.redhat.com/errata/RHSA-2026:37275"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:37283",
          "url": "https://access.redhat.com/errata/RHSA-2026:37283"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:42078",
          "url": "https://access.redhat.com/errata/RHSA-2026:42078"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:42079",
          "url": "https://access.redhat.com/errata/RHSA-2026:42079"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:42132",
          "url": "https://access.redhat.com/errata/RHSA-2026:42132"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:42144",
          "url": "https://access.redhat.com/errata/RHSA-2026:42144"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:42644",
          "url": "https://access.redhat.com/errata/RHSA-2026:42644"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:50479",
          "url": "https://access.redhat.com/errata/RHSA-2026:50479"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:54760",
          "url": "https://access.redhat.com/errata/RHSA-2026:54760"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:56347",
          "url": "https://access.redhat.com/errata/RHSA-2026:56347"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/errata/RHSA-2026:60520",
          "url": "https://access.redhat.com/errata/RHSA-2026:60520"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2026-8643",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8643"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2460927",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460927"
        },
        {
          "category": "external",
          "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json",
          "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8643.json"
        }
      ],
      "release_date": "2026-06-01T17:17:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T14:32:34.743757Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1789137152",
          "product_ids": [
            "CentOS-10:alt-python38-pip-0:22.2.1-6.el10.noarch",
            "CentOS-10:alt-python38-pip-wheel-0:22.2.1-6.el10.noarch"
          ],
          "url": "https://cve.tuxcare.com/els-alt-python/releases/CLSA-2026:1789137152"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}