Summary
[25.2-5]
- Fix gating plan
- removed unnecessary older VERSION= tests
- removed bootstrap test
- fix pip_install_upgrade to run pip-3.14
- fix bash completion + remove unused metadata file
[25.2-4]
- Security fix for CVE-2026-8643: path traversal in wheel entry points
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | python3.14-pip | 0:25.2-3.el10_2.5 |
| Oracle Linux · 10 | python3.14-pip-wheel | 0:25.2-3.el10_2.5 |
Vulnerabilities 1
-
Medium 4.1
pip can extract console_scripts and gui_scripts outside installation directory
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.