Release date:
2026-09-02 06:00:24 UTC
Description:
- CVE-2024-6345: replace os.system() shell strings with subprocess argv lists
in PackageIndex VCS downloads, closing a command injection via crafted
git/hg URLs
- CVE-2025-47273: sanitise the download filename derived from a URL so a
percent-encoded absolute path can no longer escape the temporary directory
Updated packages:
-
alt-python313-setuptools-69.0.2-4.el9.noarch.rpm
sha:1b5c68687169cd22dd34067780b54437ddc75a4258f7ca735e8be53e4a5d4ff9
-
alt-python313-setuptools-wheel-69.0.2-4.el9.noarch.rpm
sha:e7fe363ee7fbbbb8aa074631f9a3091f765b85bd9d09bc94df67d94072b3fda1
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
