Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · Hardened Images 1 hummingbird:1 | python-pip | 0:26.2-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | python-pip-wheel | 0:26.2-0.1.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | python3-pip | 0:26.2-0.1.hum1 |
Vulnerabilities 2
-
Medium 5.6
pip absolute path traversal during download from malicious package indexes
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index…
-
Medium 5.3
pip self-update functionality can import newly installed modules after wheel installation
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch chan…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-13346
-
article
https://access.redhat.com/security/updates/classification/
-
article
https://images.redhat.com/
-
report
https://access.redhat.com/security/cve/CVE-2026-6357
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48788.json
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2463234
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-6357
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6357
-
article
https://github.com/pypa/pip/pull/13923
-
article
https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/#security-fixes
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2508514
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-13346
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-13346
-
article
https://github.com/pypa/pip/pull/14110
-
article
https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/