Release date:
2026-09-01 18:50:07 UTC
Description:
- CVE-2024-6345: replace os.system() shell strings with subprocess argv lists
in PackageIndex VCS downloads, closing a command injection via crafted
git/hg URLs
- CVE-2025-47273: sanitise the download filename derived from a URL so a
percent-encoded absolute path can no longer escape the temporary directory
Updated packages:
-
alt-python312-setuptools-69.0.2-4.el8.noarch.rpm
sha:e2938928688697ada272b9e715826d4f5c75de8f375c8d80933d64c73cba8aed
-
alt-python312-setuptools-wheel-69.0.2-4.el8.noarch.rpm
sha:5503c4445deb41b13e35b39f2efabbe9696ccedf236ea7f6e93083cb53c85c70
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
