{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2026/cve-2026-59890-els_os-oraclelinux6els.json" } ], "tracking": { "current_release_date": "2026-10-27T08:08:35Z", "generator": { "date": "2026-10-27T08:08:35Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-59890-ELS_OS-ORACLELINUX6ELS", "initial_release_date": "2026-07-08T17:17:00Z", "revision_history": [ { "date": "2026-07-08T17:17:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-27T08:08:35Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2026-59890" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Linux 6", "product": { "name": "Oracle Linux 6", "product_id": "Oracle-Linux-6", "product_identification_helper": { "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Oracle Linux" }, { "branches": [ { "category": "product_version", "name": "python-setuptools-0:0.6.10-4.el6_9.noarch", "product": { "name": "python-setuptools-0:0.6.10-4.el6_9.noarch", "product_id": "python-setuptools-0:0.6.10-4.el6_9.noarch", "product_identification_helper": { "purl": "pkg:rpm/oracle/python-setuptools@0.6.10-4.el6_9?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Oracle Corporation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "python-setuptools-0:0.6.10-4.el6_9.tuxcare.els1.noarch", "product": { "name": "python-setuptools-0:0.6.10-4.el6_9.tuxcare.els1.noarch", "product_id": "python-setuptools-0:0.6.10-4.el6_9.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/python-setuptools@0.6.10-4.el6_9.tuxcare.els1?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "python-setuptools-0:0.6.10-4.el6_9.tuxcare.els1.noarch as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:python-setuptools-0:0.6.10-4.el6_9.tuxcare.els1.noarch" }, "product_reference": "python-setuptools-0:0.6.10-4.el6_9.tuxcare.els1.noarch", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "python-setuptools-0:0.6.10-4.el6_9.noarch as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:python-setuptools-0:0.6.10-4.el6_9.noarch" }, "product_reference": "python-setuptools-0:0.6.10-4.el6_9.noarch", "relates_to_product_reference": "Oracle-Linux-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-59890", "cwe": { "id": "CWE-176", "name": "Improper Handling of Unicode Encoding" }, "notes": [ { "category": "description", "text": "setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.", "title": "Vulnerability description" } ], "product_status": { "known_affected": [ "Oracle-Linux-6:python-setuptools-0:0.6.10-4.el6_9.noarch", "Oracle-Linux-6:python-setuptools-0:0.6.10-4.el6_9.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-59890" }, { "category": "external", "summary": "https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f", "url": "https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f" }, { "category": "external", "summary": "https://github.com/pypa/setuptools/releases/tag/v83.0.0", "url": "https://github.com/pypa/setuptools/releases/tag/v83.0.0" }, { "category": "external", "summary": "https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c", "url": "https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c" } ], "release_date": "2026-07-08T17:17:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-10-26T11:19:01.587764Z", "details": "This flaw only manifests during local, interactive creation of a Python source distribution on macOS APFS/HFS+, where an NFC/NFD filename mismatch can bypass MANIFEST.in exclusions; it does not affect package installation or runtime on Linux servers/VMs. Exploitation has no remote vector and primarily risks unintentionally including files in an sdist, with no availability impact. In centrally managed enterprise deployments that build on Linux or consume prebuilt artifacts rather than publishing sdists from macOS, the practical risk is low and this CVE can be deprioritized.", "product_ids": [ "Oracle-Linux-6:python-setuptools-0:0.6.10-4.el6_9.noarch", "Oracle-Linux-6:python-setuptools-0:0.6.10-4.el6_9.tuxcare.els1.noarch" ] } ] } ] }