{"id":"CVE-2026-13346","aliases":["AZL-94335","AZL-94353","BELL-CVE-2026-13346","CLSA-2026-1790060501","DEBIAN-CVE-2026-13346","EUVD-2026-50467","GHSA-qwm4-qh6w-59xr","OESA-2026-3785","OESA-2026-3786","OESA-2026-3787","OESA-2026-3788","OESA-2026-3941","PYSEC-2026-3721","RHSA-2026:48788","SUSE-SU-2026:23319-1","SUSE-SU-2026:3588-1","SUSE-SU-2026:3589-1","SUSE-SU-2026:3846-1","SUSE-SU-2026:3969-1","SUSE-SU-2026:4030-1","SUSE-SU-2026:4060-1","SUSE-SU-2026:4061-1","SUSE-SU-2026:4174-1","SUSE-SU-2026:4580-1","SUSE-SU-2026:4581-1","SUSE-SU-2026:4582-1","SUSE-SU-2026:4583-1","SUSE-SU-2026:4584-1","SUSE-SU-2026:4585-1","SUSE-SU-2026:4743-1","SUSE-SU-2026:4754-1","UBUNTU-CVE-2026-13346","openSUSE-SU-2026:11451-1","openSUSE-SU-2026:11690-1","openSUSE-SU-2026:21643-1"],"status":"published","title":"pip absolute path traversal during download from malicious package indexes","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.","severity":{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00292,"percentile":0.22011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-36"],"published":"2026-07-29T18:33:50Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"PyPI","package":"pip","fixed_in":["26.2.0","26.2"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"python-pip","fixed_in":["24.2-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-virtualenv","fixed_in":["20.36.1-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"py3-pip","fixed_in":["22.3.1-r6"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"py3-pip","fixed_in":["25.1.1-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-pip","fixed_in":["26.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"py3-pip","fixed_in":["22.3.1-r6"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"py3-pip","fixed_in":["25.1.1-r3"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"py3-pip","fixed_in":["26.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-pip","fixed_in":["26.2.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-pip","fixed_in":["20.2.2-21.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-pip","fixed_in":["21.3.1-20.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-pip","fixed_in":["23.3.1-14.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"python-pip","fixed_in":["23.3.1-14.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-pip","fixed_in":["23.3.1-14.oe2403sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-pip","fixed_in":["25.0.1-160000.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-pip","fixed_in":["25.0.1-160000.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python3-pip","fixed_in":["20.0.2-150400.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python3-pip-wheel","fixed_in":["20.0.2-150400.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-pip","fixed_in":["22.3.1-150400.17.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-pip","fixed_in":["22.3.1-150400.17.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python36-pip","fixed_in":["20.2.4-8.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python313-pip","fixed_in":["24.2-150700.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-pip","fixed_in":["26.2-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-pip","fixed_in":["25.0.1-160000.6.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-virtualenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.36.1-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"py3-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.3.1-r2"},{"fixed":"22.3.1-r6"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"py3-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.1.1-r0"},{"fixed":"25.1.1-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.3.1-r2"},{"fixed":"26.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"py3-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.3.1-r2"},{"fixed":"22.3.1-r6"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"py3-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.1.1-r0"},{"fixed":"25.1.1-r3"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"py3-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.3.1-r2"},{"fixed":"26.2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0"},{"fixed":"9.0.0.post3+tuxcare"}]}],"versions":["9.0","9.0.0.post2+tuxcare","9.0.post1+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.0.1+dfsg-1","23.1.2+dfsg-1","23.1.2+dfsg-2","23.2+dfsg-1","23.2.1+dfsg-1","23.3+dfsg-1","24.0+dfsg-1","24.0+dfsg-2","24.1+dfsg-1","24.1.1+dfsg-1","24.2+dfsg-1","24.3.1+dfsg-1","25.0+dfsg-1","25.0.1+dfsg-1","25.1+dfsg-1","25.1.1+dfsg-1","25.2+dfsg-1","25.3+dfsg-1","26.0+dfsg-1","26.0.1+dfsg-1","26.1.1+dfsg-1","26.1.2+dfsg-1","26.1.2+dfsg-2","26.2.2+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.1.1+dfsg-1","25.2+dfsg-1","25.3+dfsg-1","26.0+dfsg-1","26.0.1+dfsg-1","26.1.1+dfsg-1","26.1.2+dfsg-1","26.1.2+dfsg-2","26.2.2+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.2+dfsg-1"}]}],"versions":["25.1.1+dfsg-1","25.2+dfsg-1","25.3+dfsg-1","26.0+dfsg-1","26.0.1+dfsg-1","26.1.1+dfsg-1","26.1.2+dfsg-1","26.1.2+dfsg-2"]},{"source":"osv","ecosystem":"PyPI","package":"pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.0"}]}],"versions":["0.2","0.2.1","0.3","0.3.1","0.4","0.5","0.5.1","0.6","0.6.1","0.6.2","0.6.3","0.7","0.7.1","0.7.2","0.8","0.8.1","0.8.2","0.8.3","1.0","1.0.1","1.0.2","1.1","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","10.0.0","10.0.0b1","10.0.0b2","10.0.1","18.0","18.1","19.0","19.0.1","19.0.2","19.0.3","19.1","19.1.1","19.2","19.2.1","19.2.2","19.2.3","19.3","19.3.1","20.0","20.0.1","20.0.2","20.1","20.1.1","20.1b1","20.2","20.2.1","20.2.2","20.2.3","20.2.4","20.2b1","20.3","20.3.1","20.3.2","20.3.3","20.3.4","20.3b1","21.0","21.0.1","21.1","21.1.1","21.1.2","21.1.3","21.2","21.2.1","21.2.2","21.2.3","21.2.4","21.3","21.3.1","22.0","22.0.1","22.0.2","22.0.3","22.0.4","22.1","22.1.1","22.1.2","22.1b1","22.2","22.2.1","22.2.2","22.3","22.3.1","23.0","23.0.1","23.1","23.1.1","23.1.2","23.2","23.2.1","23.3","23.3.1","23.3.2","24.0","24.1","24.1.1","24.1.2","24.1b1","24.1b2","24.2","24.3","24.3.1","25.0","25.0.1","25.1","25.1.1","25.2","25.3","26.0","26.0.1","26.1","26.1.1","26.1.2","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.1.0","6.1.1","7.0.0","7.0.1","7.0.2","7.0.3","7.1.0","7.1.1","7.1.2","8.0.0","8.0.1","8.0.2","8.0.3","8.1.0","8.1.1","8.1.2","9.0.0","9.0.1","9.0.2","9.0.3"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.2.2-21.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.3.1-20.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.1-14.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.1-14.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.1-14.oe2403sp3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2"}]}],"versions":["0.2","0.2.1","0.3","0.3.1","0.4","0.5","0.5.1","0.6","0.6.1","0.6.2","0.6.3","0.7","0.7.1","0.7.2","0.8","0.8.1","0.8.2","0.8.3","1.0","1.0.1","1.0.2","1.1","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","10.0.0","10.0.0b1","10.0.0b2","10.0.1","18.0","18.1","19.0","19.0.1","19.0.2","19.0.3","19.1","19.1.1","19.2","19.2.1","19.2.2","19.2.3","19.3","19.3.1","20.0","20.0.1","20.0.2","20.1","20.1.1","20.1b1","20.2","20.2.1","20.2.2","20.2.3","20.2.4","20.2b1","20.3","20.3.1","20.3.2","20.3.3","20.3.4","20.3b1","21.0","21.0.1","21.1","21.1.1","21.1.2","21.1.3","21.2","21.2.1","21.2.2","21.2.3","21.2.4","21.3","21.3.1","22.0","22.0.1","22.0.2","22.0.3","22.0.4","22.1","22.1.1","22.1.2","22.1b1","22.2","22.2.1","22.2.2","22.3","22.3.1","23.0","23.0.1","23.1","23.1.1","23.1.2","23.2","23.2.1","23.3","23.3.1","23.3.2","24.0","24.1","24.1.1","24.1.2","24.1b1","24.1b2","24.2","24.3","24.3.1","25.0","25.0.1","25.1","25.1.1","25.2","25.3","26.0","26.0.1","26.1","26.1.1","26.1.2","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.1.0","6.1.1","7.0.0","7.0.1","7.0.2","7.0.3","7.1.0","7.1.1","7.1.2","8.0.0","8.0.1","8.0.2","8.0.3","8.1.0","8.1.1","8.1.2","9.0.0","9.0.1","9.0.2","9.0.3"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.2-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python-pip-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.2-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.2-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-160000.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-160000.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python3-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.2-150400.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python3-pip-wheel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.2-150400.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3.1-150400.17.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3.1-150400.17.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python36-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.2.4-8.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.126.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.126.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python313-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-150700.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-25.194.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python3-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-25.194.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-33.85.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-33.85.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-33.85.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python39","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.25-150300.4.109.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python39-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.25-150300.4.109.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python39","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.25-150300.4.109.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python39-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.25-150300.4.109.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cssselect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-editables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-flit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatchling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-100002.1.9.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyopenssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.0-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyparsing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.2-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-websocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-100002.1.13.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-10","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-10","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-10","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-10","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-100002.1.13.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-80002.4.15.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-80002.3.6.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-80002.4.15.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-80002.3.6.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cssselect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-80002.3.6.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-editables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5-80002.3.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-80002.3.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-80002.3.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-flit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-80002.3.3.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatchling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10-80002.3.6.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-80002.3.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-80002.5.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-80002.3.9.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyopenssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.0-80002.3.9.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyparsing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.2-80002.4.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-80002.4.12.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-websocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-80002.3.12.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-80002.3.15.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-80002.3.15.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-80002.5.22.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-80002.3.12.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-80002.3.15.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-80002.3.15.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-80002.5.22.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-90002.4.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-90002.3.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-90002.4.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-90002.3.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cssselect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-90002.3.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-editables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5-90002.3.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-90002.3.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-90002.3.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-flit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatchling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10-90002.3.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-90002.3.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-90002.5.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-90002.3.9.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyopenssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.0-90002.3.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyparsing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.2-90002.4.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-90002.4.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-websocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-90002.3.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-90002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-90002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-90002.5.22.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-90002.3.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-90002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-90002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-90002.5.22.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-70002.3.12.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-70002.4.15.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-70002.3.6.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-70002.4.15.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-70002.3.6.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cssselect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-70002.3.6.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-editables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5-70002.3.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-70002.3.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-70002.3.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-flit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatchling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10-70002.3.6.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-70002.3.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-70002.5.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-70002.3.9.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyopenssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.0-70002.3.9.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyparsing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.2-70002.4.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-70002.4.12.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-websocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-70002.3.15.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-70002.3.12.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-70002.5.22.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-70002.3.12.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-70002.3.15.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-70002.3.12.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-70002.5.22.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-120002.3.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-120002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-120002.3.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-120002.3.18.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-120002.5.22.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.2-150002.3.19.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.10-150002.4.27.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-150002.3.15.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python36","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-125.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"python36-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-125.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python36","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-125.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python36-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-125.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python3-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-150300.10.129.1"}]}],"bundled":26},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1-2","1.5.4-1","1.5.4-1ubuntu1","1.5.4-1ubuntu3","1.5.4-1ubuntu4","1.5.4-1ubuntu4+esm1","1.5.4-1ubuntu4+esm2","1.5.4-1ubuntu4+esm3","1.5.4-1ubuntu4+esm4","1.5.4-1ubuntu4+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6-7ubuntu1","1.5.6-7ubuntu2","8.0.2-7","8.0.3-1","8.0.3-2","8.1.0-1","8.1.0-2","8.1.1-1","8.1.1-2","8.1.1-2ubuntu0.1","8.1.1-2ubuntu0.2","8.1.1-2ubuntu0.4","8.1.1-2ubuntu0.6","8.1.1-2ubuntu0.6+esm2","8.1.1-2ubuntu0.6+esm3","8.1.1-2ubuntu0.6+esm4","8.1.1-2ubuntu0.6+esm5","8.1.1-2ubuntu0.6+esm6","8.1.1-2ubuntu0.6+esm8","8.1.1-2ubuntu0.6+esm10","8.1.1-2ubuntu0.6+esm11","8.1.1-2ubuntu0.6+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.1-2","9.0.1-2.3~ubuntu1","9.0.1-2.3~ubuntu1.18.04.1","9.0.1-2.3~ubuntu1.18.04.2","9.0.1-2.3~ubuntu1.18.04.3","9.0.1-2.3~ubuntu1.18.04.4","9.0.1-2.3~ubuntu1.18.04.5","9.0.1-2.3~ubuntu1.18.04.5+esm2","9.0.1-2.3~ubuntu1.18.04.5+esm3","9.0.1-2.3~ubuntu1.18.04.6","9.0.1-2.3~ubuntu1.18.04.6+esm1","9.0.1-2.3~ubuntu1.18.04.7","9.0.1-2.3~ubuntu1.18.04.7+esm1","9.0.1-2.3~ubuntu1.18.04.8","9.0.1-2.3~ubuntu1.18.04.8+esm1","9.0.1-2.3~ubuntu1.18.04.8+esm2","9.0.1-2.3~ubuntu1.18.04.8+esm4","9.0.1-2.3~ubuntu1.18.04.8+esm6","9.0.1-2.3~ubuntu1.18.04.8+esm7","9.0.1-2.3~ubuntu1.18.04.8+esm8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pipenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.1-5","18.1-5build1","18.1-5ubuntu1","20.0.2-2","20.0.2-4","20.0.2-5","20.0.2-5ubuntu1","20.0.2-5ubuntu1.1","20.0.2-5ubuntu1.3","20.0.2-5ubuntu1.4","20.0.2-5ubuntu1.5","20.0.2-5ubuntu1.6","20.0.2-5ubuntu1.7","20.0.2-5ubuntu1.8","20.0.2-5ubuntu1.9","20.0.2-5ubuntu1.10","20.0.2-5ubuntu1.10+esm2","20.0.2-5ubuntu1.11","20.0.2-5ubuntu1.11+esm2","20.0.2-5ubuntu1.11+esm3","20.0.2-5ubuntu1.11+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pipenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.9.0-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.3.4-4","21.3.1+dfsg-3","22.0.2+dfsg-1","22.0.2+dfsg-1ubuntu0.1","22.0.2+dfsg-1ubuntu0.2","22.0.2+dfsg-1ubuntu0.3","22.0.2+dfsg-1ubuntu0.4","22.0.2+dfsg-1ubuntu0.5","22.0.2+dfsg-1ubuntu0.6","22.0.2+dfsg-1ubuntu0.7","22.0.2+dfsg-1ubuntu0.7+esm1","22.0.2+dfsg-1ubuntu0.7+esm2","22.0.2+dfsg-1ubuntu0.7+esm3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pipenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2023.7.23+ds-1","2023.10.3+ds-1","2023.10.24+ds-1","2023.11.15+ds-1","2023.12.1+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.2+dfsg-1","23.3+dfsg-1","24.0+dfsg-1","24.0+dfsg-1ubuntu1","24.0+dfsg-1ubuntu1.1","24.0+dfsg-1ubuntu1.2","24.0+dfsg-1ubuntu1.3","24.0+dfsg-1ubuntu1.3+esm1","24.0+dfsg-1ubuntu1.3+esm2","24.0+dfsg-1ubuntu1.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pipenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2024.0.1+ds-4","2026.0.3+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.1.1+dfsg-1ubuntu2","26.1.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pipenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2024.0.1+ds-3","2024.0.1+ds-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.1.1+dfsg-1ubuntu2","25.1.1+dfsg-1ubuntu2+esm1","25.1.1+dfsg-1ubuntu2+esm2","25.1.1+dfsg-1ubuntu2+esm3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.20-10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-160000.6.1"}]}]}],"products":[{"vendor":"pip maintainers","product":"pip"},{"vendor":"pypa","product":"pip"},{"vendor":"python packaging authority","product":"pip"}],"references":[{"url":"https://github.com/pypa/pip/pull/14110","tags":["patch","Issue Tracking","Patch","fix","web","article","report"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/","tags":["vendor-advisory","Mailing List","Third Party Advisory","advisory","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/29/7","tags":["Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13346","tags":["web","advisory"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX","tags":["web"]},{"url":"https://github.com/pypa/pip/commit/10dfb6b9005484578b386f64b9f36982e3dc6679","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-3721.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qwm4-qh6w-59xr","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-13346","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13346.json","tags":["advisory"]},{"url":"https://github.com/pypa/pip","tags":["package"]},{"url":"https://pypi.org/project/pip","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-13346","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3785","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3786","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3787","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3788","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3941","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48788","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13346","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6357","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48788.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463234","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6357","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6357","tags":["advisory"]},{"url":"https://github.com/pypa/pip/pull/13923","tags":["article"]},{"url":"https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/#security-fixes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508514","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13346","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623319-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273090","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13346","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263588-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263589-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263846-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263969-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273091","tags":["report"]},{"url":"https://bugzilla.suse.com/1276903","tags":["report"]},{"url":"https://bugzilla.suse.com/1277271","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3219","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264030-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264060-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264061-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264174-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1211301","tags":["report"]},{"url":"https://bugzilla.suse.com/1262429","tags":["report"]},{"url":"https://bugzilla.suse.com/1267581","tags":["report"]},{"url":"https://bugzilla.suse.com/1267821","tags":["report"]},{"url":"https://bugzilla.suse.com/1269066","tags":["report"]},{"url":"https://bugzilla.suse.com/1269788","tags":["report"]},{"url":"https://bugzilla.suse.com/1269959","tags":["report"]},{"url":"https://bugzilla.suse.com/1271192","tags":["report"]},{"url":"https://bugzilla.suse.com/1273094","tags":["report"]},{"url":"https://bugzilla.suse.com/1274743","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7774","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264580-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218722","tags":["report"]},{"url":"https://bugzilla.suse.com/1252286","tags":["report"]},{"url":"https://bugzilla.suse.com/1254400","tags":["report"]},{"url":"https://bugzilla.suse.com/1257151","tags":["report"]},{"url":"https://bugzilla.suse.com/1257599","tags":["report"]},{"url":"https://bugzilla.suse.com/1259989","tags":["report"]},{"url":"https://bugzilla.suse.com/1261969","tags":["report"]},{"url":"https://bugzilla.suse.com/1261970","tags":["report"]},{"url":"https://bugzilla.suse.com/1262098","tags":["report"]},{"url":"https://bugzilla.suse.com/1262319","tags":["report"]},{"url":"https://bugzilla.suse.com/1262492","tags":["report"]},{"url":"https://bugzilla.suse.com/1262654","tags":["report"]},{"url":"https://bugzilla.suse.com/1262803","tags":["report"]},{"url":"https://bugzilla.suse.com/1263254","tags":["report"]},{"url":"https://bugzilla.suse.com/1263442","tags":["report"]},{"url":"https://bugzilla.suse.com/1263822","tags":["report"]},{"url":"https://bugzilla.suse.com/1263823","tags":["report"]},{"url":"https://bugzilla.suse.com/1264962","tags":["report"]},{"url":"https://bugzilla.suse.com/1265267","tags":["report"]},{"url":"https://bugzilla.suse.com/1265268","tags":["report"]},{"url":"https://bugzilla.suse.com/1265413","tags":["report"]},{"url":"https://bugzilla.suse.com/1266481","tags":["report"]},{"url":"https://bugzilla.suse.com/1266669","tags":["report"]},{"url":"https://bugzilla.suse.com/1267261","tags":["report"]},{"url":"https://bugzilla.suse.com/1267980","tags":["report"]},{"url":"https://bugzilla.suse.com/1268325","tags":["report"]},{"url":"https://bugzilla.suse.com/1268395","tags":["report"]},{"url":"https://bugzilla.suse.com/1268396","tags":["report"]},{"url":"https://bugzilla.suse.com/1268397","tags":["report"]},{"url":"https://bugzilla.suse.com/1268649","tags":["report"]},{"url":"https://bugzilla.suse.com/1268755","tags":["report"]},{"url":"https://bugzilla.suse.com/1268977","tags":["report"]},{"url":"https://bugzilla.suse.com/1270033","tags":["report"]},{"url":"https://bugzilla.suse.com/1270285","tags":["report"]},{"url":"https://bugzilla.suse.com/1270398","tags":["report"]},{"url":"https://bugzilla.suse.com/1270399","tags":["report"]},{"url":"https://bugzilla.suse.com/1271428","tags":["report"]},{"url":"https://bugzilla.suse.com/1271613","tags":["report"]},{"url":"https://bugzilla.suse.com/1273144","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8643","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264581-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264582-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264583-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230949","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264584-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264585-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262187","tags":["report"]},{"url":"https://bugzilla.suse.com/1263330","tags":["report"]},{"url":"https://bugzilla.suse.com/1265525","tags":["report"]},{"url":"https://bugzilla.suse.com/1265763","tags":["report"]},{"url":"https://bugzilla.suse.com/1266608","tags":["report"]},{"url":"https://bugzilla.suse.com/1267528","tags":["report"]},{"url":"https://bugzilla.suse.com/1267534","tags":["report"]},{"url":"https://bugzilla.suse.com/1267538","tags":["report"]},{"url":"https://bugzilla.suse.com/1268868","tags":["report"]},{"url":"https://bugzilla.suse.com/1269841","tags":["report"]},{"url":"https://bugzilla.suse.com/1269856","tags":["report"]},{"url":"https://bugzilla.suse.com/1269966","tags":["report"]},{"url":"https://bugzilla.suse.com/1270711","tags":["report"]},{"url":"https://bugzilla.suse.com/1271330","tags":["report"]},{"url":"https://bugzilla.suse.com/1271557","tags":["report"]},{"url":"https://bugzilla.suse.com/1272008","tags":["report"]},{"url":"https://bugzilla.suse.com/1272102","tags":["report"]},{"url":"https://bugzilla.suse.com/1272328","tags":["report"]},{"url":"https://bugzilla.suse.com/1272427","tags":["report"]},{"url":"https://bugzilla.suse.com/1274217","tags":["report"]},{"url":"https://bugzilla.suse.com/1274221","tags":["report"]},{"url":"https://bugzilla.suse.com/1275205","tags":["report"]},{"url":"https://bugzilla.suse.com/1275206","tags":["report"]},{"url":"https://bugzilla.suse.com/1275207","tags":["report"]},{"url":"https://bugzilla.suse.com/1275934","tags":["report"]},{"url":"https://bugzilla.suse.com/1276426","tags":["report"]},{"url":"https://bugzilla.suse.com/1276658","tags":["report"]},{"url":"https://bugzilla.suse.com/1276973","tags":["report"]},{"url":"https://bugzilla.suse.com/1277025","tags":["report"]},{"url":"https://bugzilla.suse.com/1278307","tags":["report"]},{"url":"https://bugzilla.suse.com/1278322","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9029","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264743-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259735","tags":["report"]},{"url":"https://bugzilla.suse.com/1267974","tags":["report"]},{"url":"https://bugzilla.suse.com/1273148","tags":["report"]},{"url":"https://bugzilla.suse.com/1274683","tags":["report"]},{"url":"https://bugzilla.suse.com/1276223","tags":["report"]},{"url":"https://bugzilla.suse.com/1276226","tags":["report"]},{"url":"https://bugzilla.suse.com/1276227","tags":["report"]},{"url":"https://bugzilla.suse.com/1277111","tags":["report"]},{"url":"https://bugzilla.suse.com/1280459","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9669","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264754-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262467","tags":["report"]},{"url":"https://bugzilla.suse.com/1263083","tags":["report"]},{"url":"https://bugzilla.suse.com/1263443","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-13346","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-13346","title":"pip absolute path traversal during download from malicious package indexes","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.","status":"published","published":"2026-07-29T18:33:50.82Z","modified":"2026-07-29T20:21:34.281Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T14:19:50.24628Z"}],"euvd":[{"id":"EUVD-2026-50467","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.","status":"published","published":"2026-07-29T18:33:50Z","modified":"2026-07-29T20:21:34Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:29.367786Z"}],"ghsa":[{"id":"GHSA-qwm4-qh6w-59xr","title":"pip would incorrectly handle doubly-encoded package URLs from indexes","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.","status":"published","published":"2026-07-29T21:30:59Z","modified":"2026-09-01T18:57:44Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T14:41:08.980668Z"}],"nvd":[{"id":"CVE-2026-13346","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.","status":"published","published":"2026-07-29T19:16:44.267Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T14:12:33.629616Z"}],"osv":[{"id":"BELL-CVE-2026-13346","status":"published","published":"2026-07-31T06:02:53.447451Z","modified":"2026-09-09T07:15:04.529539016Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-13346","title":"pip absolute path traversal during download from malicious package indexes","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.","status":"published","published":"2026-07-29T18:33:50.82Z","modified":"2026-10-28T02:30:56.816134433Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T15:44:57.354194Z"},{"id":"DEBIAN-CVE-2026-13346","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.     This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.","status":"published","published":"2026-07-29T19:16:44.267Z","modified":"2026-10-25T09:47:36.00037699Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"GHSA-qwm4-qh6w-59xr","title":"pip would incorrectly handle doubly-encoded package URLs from indexes","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.","status":"published","published":"2026-07-29T21:30:59Z","modified":"2026-09-10T03:50:52.923367736Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"OESA-2026-3785","title":"python-pip security update","description":"%changelog * Thu May 14 2026 markeryang \u0026amp;lt;747675909@qq.com\u0026amp;gt; - 23.3.1-11 - Fix CVE-2026-3219\r\n\r\nSecurity Fix(es):\n\npip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running pip download with the --only-binary option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.(CVE-2026-13346)","status":"published","published":"2026-09-14T16:34:20Z","modified":"2026-09-13T16:45:39.222898075Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3786","title":"python-pip security update","description":"%changelog * Thu May 14 2026 markeryang \u0026amp;lt;747675909@qq.com\u0026amp;gt; - 23.3.1-11 - Fix CVE-2026-3219\r\n\r\nSecurity Fix(es):\n\npip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running pip download with the --only-binary option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.(CVE-2026-13346)","status":"published","published":"2026-09-14T16:34:20Z","modified":"2026-09-13T16:45:39.412592958Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3787","title":"python-pip security update","description":"%changelog * Thu May 14 2026 markeryang \u0026amp;lt;747675909@qq.com\u0026amp;gt; - 23.3.1-11 - Fix CVE-2026-3219\r\n\r\nSecurity Fix(es):\n\npip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running pip download with the --only-binary option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.(CVE-2026-13346)","status":"published","published":"2026-09-14T16:34:21Z","modified":"2026-09-13T16:45:40.089652652Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3788","title":"python-pip security update","description":"%changelog * Thu May 14 2026 markeryang \u0026amp;lt;747675909@qq.com\u0026amp;gt; - 23.3.1-11 - Fix CVE-2026-3219\r\n\r\nSecurity Fix(es):\n\npip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running pip download with the --only-binary option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.(CVE-2026-13346)","status":"published","published":"2026-09-14T16:34:23Z","modified":"2026-09-13T16:45:40.098225102Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3941","title":"python-pip security update","description":"%changelog * Thu May 14 2026 markeryang \u0026amp;lt;747675909@qq.com\u0026amp;gt; - 23.3.1-11 - Fix CVE-2026-3219\r\n\r\nSecurity Fix(es):\n\npip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running pip download with the --only-binary option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.(CVE-2026-13346)","status":"published","published":"2026-09-20T13:23:26Z","modified":"2026-09-20T13:30:27.37031122Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"PYSEC-2026-3721","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.","status":"published","published":"2026-07-29T19:16:44.267Z","modified":"2026-09-10T11:15:08.93944716Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:57.255153Z"},{"id":"RHSA-2026:48788","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-31T10:15:17Z","modified":"2026-10-16T10:18:55Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-13346","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.","status":"published","published":"2026-07-29T19:16:00Z","modified":"2026-10-17T12:58:45.201008121Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"AZL-94335","title":"CVE-2026-13346 affecting package python-pip for versions less than 24.2-10","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.","status":"published","published":"2026-07-29T19:16:44Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"AZL-94353","title":"CVE-2026-13346 affecting package python-virtualenv for versions less than 20.36.1-6","description":"pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.","status":"published","published":"2026-07-29T19:16:44Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"CLSA-2026-1790060501","title":"TuxCare security update for pip (3 CVEs)","description":"TuxCare rebuilt pip to address 3 CVEs. Fixed in 9.0.0.post3+tuxcare.","status":"published","published":"2026-09-22T07:01:41Z","modified":"2026-10-15T09:48:01.968028916Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"openSUSE-SU-2026:11451-1","title":"python311-pip-26.2-1.1 on GA media","description":"These are all security issues fixed in the python311-pip-26.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-04T00:00:00Z","modified":"2026-08-05T18:23:51.627750424Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11690-1","title":"python310-3.10.20-10.1 on GA media","description":"These are all security issues fixed in the python310-3.10.20-10.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:04.471140251Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21643-1","title":"Security update for python-pip","description":"This update for python-pip fixes the following issue:\n\n- CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to be installed\n  to arbitrary locations on disk (bsc#1273090).\n","status":"published","published":"2026-08-25T06:31:46Z","modified":"2026-08-27T18:23:13.179476784Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23319-1","title":"Security update for python-pip","description":"This update for python-pip fixes the following issue:\n\n- CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to be installed\n  to arbitrary locations on disk (bsc#1273090).\n","status":"published","published":"2026-08-25T06:31:46Z","modified":"2026-09-10T18:23:10.487708907Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3588-1","title":"Security update for python3-pip","description":"This update for python3-pip fixes the following issue:\n\n- CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to be installed\n  to arbitrary locations on disk (bsc#1273090).\n","status":"published","published":"2026-08-11T14:56:44Z","modified":"2026-08-12T10:45:06.783968527Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3589-1","title":"Security update for python-pip","description":"This update for python-pip fixes the following issue:\n\n- CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to be installed\n  to arbitrary locations on disk (bsc#1273090).\n","status":"published","published":"2026-08-11T14:57:16Z","modified":"2026-08-12T10:45:06.232675091Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3846-1","title":"Security update for python36-pip","description":"This update for python36-pip fixes the following issue:\n\n- CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to be installed\n  to arbitrary locations on disk (bsc#1273090).\n","status":"published","published":"2026-08-27T14:37:17Z","modified":"2026-09-04T18:23:12.002617177Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3969-1","title":"Security update for python","description":"This update for python fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-13346: pip: arbitrary file installation via malicious package indexes (bsc#1273091).\n\nNon security issue fixed:\n\n- Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl\n","status":"published","published":"2026-09-04T08:20:04Z","modified":"2026-09-13T18:23:12.603705632Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4030-1","title":"Security update for python313-pip","description":"This update for python313-pip fixes the following issue:\n\n- CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to be installed\n  to arbitrary locations on disk (bsc#1273090).\n","status":"published","published":"2026-09-07T07:45:56Z","modified":"2026-09-13T18:23:17.06211341Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4060-1","title":"Security update for python3","description":"This update for python3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-13346: arbitrary file installation via malicious package indexes (bsc#1273091).\n\nNon security issue fixed:\n\n- Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl\n","status":"published","published":"2026-09-08T07:00:39Z","modified":"2026-09-13T18:23:18.96481674Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4061-1","title":"Security update for python","description":"This update for python fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-13346: pip: arbitrary file installation via malicious package indexes (bsc#1273091).\n\nNon security issue fixed:\n\n- Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl\n","status":"published","published":"2026-09-08T07:00:56Z","modified":"2026-09-13T18:23:18.961933654Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4174-1","title":"Security update for python39.SUSE_SLE-15-SP3_Update","description":"This update for python39.SUSE_SLE-15-SP3_Update fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the\n  `configparser` module is used (bsc#1269066).\n- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously\n  crafted wheel archives (bsc#1274743).\n- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).\n- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted\n  Unicode input (bsc#1267581).\n- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting\n  hardlinks (bsc#1269959).\n- CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction directory\n  (bsc#1267821).\n- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS\n  (bsc#1269788).\n- CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).\n- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations\n  (bsc#1271192).\n\nNon security issues fixed:\n\n- crypto-policies: Extend the crypto-policies support for mozilla-nss, openjdk, krb5, bind, stunnel, openssh, libssh and\n  more packages (bsc#1211301).\n- Update bundled pip wheels to pip-20.0.2-py2.py3-none-any.whl\n","status":"published","published":"2026-09-14T10:26:52Z","modified":"2026-09-15T17:00:05.454566261Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4580-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nscap-security-guide was updated to version 0.1.79:\n\n- Version 0.1.79 (jsc#ECO-3319)\n  * Added SLE16 profiles to the build\n  * Create SLE16 HIPAA profile\n  * Create SLE16 PCI DSS 4 profile\n  * Use Sequoia in RHEL 10 instead of GPG\n  * New Profile for RHEL10: BSI\n  * Move RHEL Control files to product files\n  * Update RHEL 9 CCN profile\n  * Various updates for SLE 12/15\n\nspacecmd was updated to version 5.2.10:\n\n- Version 5.2.10:\n  * Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Version 5.2.9:\n  * Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:17:24Z","modified":"2026-10-08T19:15:04.85537922Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4581-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nscap-security-guide was updated to version 0.1.79:\n\n- Version 0.1.79 (jsc#ECO-3319)\n  * Added SLE16 profiles to the build\n  * Create SLE16 HIPAA profile\n  * Create SLE16 PCI DSS 4 profile\n  * Use Sequoia in RHEL 10 instead of GPG\n  * New Profile for RHEL10: BSI\n  * Move RHEL Control files to product files\n  * Update RHEL 9 CCN profile\n  * Various updates for SLE 12/15\n\nspacecmd was updated to version 5.2.10:\n\n- Version 5.2.10:\n  * Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Version 5.2.9:\n  * Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:18:32Z","modified":"2026-10-08T19:15:03.961471212Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4582-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nscap-security-guide was updated to version 0.1.79:\n\n- Version 0.1.79 (jsc#ECO-3319)\n  * Added SLE16 profiles to the build\n  * Create SLE16 HIPAA profile\n  * Create SLE16 PCI DSS 4 profile\n  * Use Sequoia in RHEL 10 instead of GPG\n  * New Profile for RHEL10: BSI\n  * Move RHEL Control files to product files\n  * Update RHEL 9 CCN profile\n  * Various updates for SLE 12/15\n\nspacecmd was updated to version 5.2.10:\n\n- Version 5.2.10:\n  * Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Version 5.2.9:\n  * Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:20:35Z","modified":"2026-10-08T19:15:03.958892205Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4583-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nmgr-push:\n\n- Version 5.2.5-0\n  * Remove token based authentication mechanism for package_push (bsc#1230949)\n\nspacecmd:\n\n- Version 5.2.10-0\n  * Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Version 5.2.9-0\n  * Update translation strings\n\nspacewalk-client-tools:\n\n- Version 5.2.7-0\n  * Update translation strings\n\nvenv-salt-minion:\n\n- CVE-2026-13346: Arbitrary file installation via malicious package indexes. Remove ensurepip with bundled .whl\n  files. (bsc#1273094)\n- CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in configparser (bsc#1269066, gh#python/cpython#143927)\n- CVE-2026-1502: reject CR/LF in HTTP tunnel request headers (bsc#1261969, gh#python/cpython#146211)\n- CVE-2026-3276: Fix O(n^2) canonical ordering in unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)\n- CVE-2026-4360: Pass filter_function to TarFile._extract_one() during .extract() (bsc#1269959,\n  gh#python/cpython#151987)\n- CVE-2026-4786: fix webbrowser %action substitution bypass of dash-prefix check (bsc#1262319,\n  gh#python/cpython#148169)\n- CVE-2026-6019: protect against HTML injection by Base64-encoding cookie values embedded in JS (bsc#1262654,\n  gh#python/cpython#90309)\n- CVE-2026-6100: prevent dangling pointer, which can end in the use-after-free error (bsc#1262098,\n  gh#python/cpython#148395)\n- CVE-2026-7210: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (bsc#1264962,\n  gh#python/cpython#149018)\n- CVE-2026-7774: tarfile.data_filter: validate written link target (bsc#1267821, gh#149486)\n- CVE-2026-8328: Make ftplib not trust the PASV response (bsc#1265268)\n- CVE-2026-11940: fix the symlink escape via tarfile hardlink-extraction fallback (bsc#1268977)\n- CVE-2026-11972: Make tarfile._Stream.seek break at EOF (bsc#1269788, gh#python/cpython#151981)\n- CVE-2026-15308: Fix quadratic complexity in incremental parsing in HTMLParser (bsc#1271192,\n  gh#python/cpython#153030)\n- CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file\n  overwrite (bsc#1266669)\n- CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442)\n- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)\n- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously\n  crafted wheel archives (bsc#1257599, gh#pypa/pip#13777)\n- CVE-2024-22195: Fix compiler error when checking if required blocks in parent templates are xmlattr filter does not\n  allow keys with spaces. (bsc#1218722)\n- CVE-2026-45409: Specially crafted inputs to idna.encode() can bypass earlier security fix (bsc#1265413)\n- CVE-2026-44431: sensitive information disclosure due to sensitive headers being forwarded across origins in proxied\n  low-level redirects (bsc#1265267)\n- CVE-2026-49825: The known link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be\n  used for URL bypass attributes in embedded SVG/MathML/etc. content. (bsc#1270285)\n  https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\n- CVE-2026-41066: This release fixes a possible external entity injection (XXE) vulnerability in ``iterparse()`` and\n  the ``ETCompatXMLParser``. (bsc#1263254)\n- CVE-2026-3446: Preventing ignoring excess Base64 data after the first padded quad in non-strict (default) mode.\n  (bsc#1261970, gh#python/cpython#145264)\n- CVE-2026-3479: pkgutil.get_data() has the same security model as open(). The documented limitations ensure\n  compatibility with non-filesystem loaders; Python doesn't check that. (bsc#1259989, gh#python/cpython#146121)\n- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1271428)\n- CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)\n- CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396)\n- CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) (bsc#1268397)\n- CVE-2026-40475: improper input handling of null bytes can lead to silent data truncation and security-state\n  inconsistency (bsc#1262803)\n- CVE-2025-13836: limit http.client response read in NXOS modules (bsc#1254400)\n- Updated bundled python module pip to 25.0.1\n- Updated bundled python module jinja2 to 3.1.6\n- Updated bundled python module lxml to 6.1.1\n- Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n- Remove unused paramiko python module from the bundle.\n- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n- Support attrlist in ldap.managed (bsc#1257151)\n- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:21:47Z","modified":"2026-10-08T19:15:05.005427274Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4584-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nmgr-push was updated to version 5.2.5:\n\n- Removed token based authentication mechanism for package_push (bsc#1230949)\n\nspacecmd was updated to version 5.2.10:\n\n- Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Updated translation strings\n\nspacewalk-client-tools was updated to version 5.2.7::\n\n- Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481)\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:23:05Z","modified":"2026-10-08T19:15:04.953317343Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4585-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-prometheus was updated to version 3.13.2:\n\n- Security issues:\n\n  * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)\n  * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)\n  * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)\n  * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)\n  * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)\n  * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)\n  * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)\n  * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)\n  * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)\n  * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency\n  * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit\n\n- Bug fixes and changes:\n\n  * Fixed scrape manager failing to reload properly when SD configuration changes rapidly.\n  * Prevent memory leak in remote-write path when the receiving endpoint is unavailable.\n  * Native Histograms are no longer experimental. They are fully supported for production workloads.\n  * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.\n  * TSDB compaction speed optimized by improving the block merging algorithm.\n  * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.\n  * Added new metrics to monitor the health of the rule evaluation engine.\n  * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments\n    to avoid redirects.\n  * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the\n    new longer token format.\n  * Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.\n  * Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead\n    of the current working directory.\n  * Support exporting TSDB blocks directly to cloud storage via the admin API.\n  * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of\n    prometheus_wal_watcher_records_read_total.\n  * Significant query performance boost for high-cardinality regex matchers.\n  * Introduce a new UI interface for safely deleting specific time series data directly.\n  * Added dynamic relabeling actions to extract substrings using regex capture groups.\n  * Fixed UI displaying incorrect time ranges after a timezone change.\n  * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0\n\ngrafana was updated to version 12.4.10:\n\n- Security issues:\n\n  * CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)\n  * CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)\n  * CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973)\n  * CVE-2026-19475: Fixed DoS risks in PostgreSQL Datasource by checking timeGroup macros (bsc#1278307)\n  * CVE-2026-14199: Fixed auth bypass or session takeover via Auth Proxy cache key collision (bsc#1278322)\n  * CVE-2026-19197: Fixed access control and authorization checks in dashboard snapshots (bsc#1277025)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm (bsc#1272008)\n  * CVE-2026-41178: Fixed denial-of-service risks in OpenTelemetry baggage parsing (bsc#1276658)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274217)\n  * CVE-2026-8595: Fixed stored XSS via malicious dashboard field names in table panels (bsc#1271557)\n  * CVE-2026-42127: Fixed DoS risks in the public dashboard query endpoint (bsc#1268868)\n  * CVE-2026-9029: Fixed arbitrary code execution and script injection in the geomap panel (bsc#1272328)\n  * CVE-2026-33814: Fixed infinite loop in HTTP/2 transport during framesize check (bsc#1265763)\n  * CVE-2026-8609: Fixed pre-authentication denial-of-service risks in OAuth login routes (bsc#1271330)\n  * CVE-2026-1229: Fixed incorrect value calculation in ecc/p384 Package (bsc#1265525, bsc#1262187)\n  * CVE-2025-12141: Fixed information disclosure of secure settings via contact point modification (bsc#1262187)\n  * CVE-2026-21723: Fixed out-of-memory and denial-of-service risks in templates test endpoint (bsc#1272427)\n  * CVE-2026-41606: Fixed denial-of-service risks from nested messages in Apache Thrift parser (bsc#1263330)\n\n- Bug fixes and changes:\n\n  * Dashboards: Fix adhoc and groupby variable datasource on UI import\n  * Dashboards: Fix version dates and user display names in the legacy version history page\n  * Dashboard Import: Labels in v2 schema\n  * Azure Monitor: fix migration for dimension filters\n  * Dashboards: Get annotations and dashboard endpoint performance improvements\n  * DashboardDS: Fix Mixed panels with a time override stuck in permanent loading\n  * Alerting: Add protected fields authorization check to provisioning API\n  * Alerting: Return 403 instead of 500 on contact point provenance mismatch\n  * Jaeger: Handle gzip, deflate, and brotli compressed API responses\n  * Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL\n\nmgr-push was updated to version 5.2.5:\n\n- Removed token based authentication mechanism for package_push (bsc#1230949)\n\nspacecmd was updated to version 5.2.10:\n\n- Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Updated translation strings\n\nspacewalk-client-tools was updated to version 5.2.7:\n\n- Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481)\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:24:34Z","modified":"2026-10-08T19:15:05.011279037Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4743-1","title":"Security update for python36","description":"This update for python36 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously\n  crafted wheel archives (bsc#1274743).\n- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429).\n- CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).\n- CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).\n- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).\n- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high\n  CPU usage (bsc#1273148).\n- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).\n- CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect\n  sniffing and consume significant CPU (bsc#1274683).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nNon security issue fixed:\n\n- Update bundled setuptools wheels to\n setuptools-44.1.1-py2.py3-none-any.whl (bsc#1277271)\n","status":"published","published":"2026-10-19T15:00:47Z","modified":"2026-10-20T10:45:04.35999946Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4754-1","title":"Security update for python3","description":"This update for python3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the\n  `configparser` module is used (bsc#1269066).\n- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously\n  crafted wheel archives (bsc#1257599 bsc#1274743).\n- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429 bsc#1262467).\n- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted\n  Unicode input (bsc#1267581).\n- CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).\n- CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).\n- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).\n- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting\n  hardlinks (bsc#1269959).\n- CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442\n  bsc#1263443).\n- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high\n  CPU usage (bsc#1273148).\n- CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding\n  protection (bsc#1264962).\n- CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction directory\n  (bsc#1267821).\n- CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).\n- CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite\n  (bsc#1266669).\n- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).\n- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and\n  enables arbitrary file reads and writes (bsc#1268977).\n- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS\n  (bsc#1269788).\n- CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).\n- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations\n  (bsc#1271192).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect\n  sniffing and consume significant CPU (bsc#1274683).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nNon security issue fixed:\n\n- Fix an error that returned non-zero exit status 1 (bsc#1277271).\n- Fix regression in `http.cookies` (bsc#1263083).  \n- Update bundled pip wheels to pip-20.0.2-py2.py3-none-any.whl.\n","status":"published","published":"2026-10-20T10:52:18Z","modified":"2026-10-21T13:00:04.220561742Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}