Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 2

Vulnerabilities 1

• Low 2.0
  CVE-2026-1703

  Limited path traversal when installing wheel archives

  When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable fi…

  Python Packaging Authority pip katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi PyPI
  Feb 2, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-1703
• article
  https://access.redhat.com/security/updates/classification/
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7610.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436000
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-1703
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-1703
• article
  https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735
• article
  https://github.com/pypa/pip/pull/13777
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/WIEA34D4TABF2UNQJAOMXKCICSPBE2DJ/