rpms/python-pip
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security fixes for CVE-2026-13346 and CVE-2026-8643

Browse source 
(cherry picked from commit 40c9b4419c)

Co-Authored-By: Miro Hrončok <miro@hroncok.cz>
This commit is contained in:
Lumir Balhar 2026-08-14 15:05:08 +02:00 • committed by Miro Hrončok
commit a1b6765c8d
3 changed files with 481 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
python-pip.spec
View file

@ -112,6 +112,14 @@ Patch: truststore-pem-path.patch
# Upstream fix: https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
Patch: urllib3-CVE-2025-50181.patch
# CVE-2026-8643: entry point path traversal in console_scripts/gui_scripts
# Upstream fix: https://github.com/pypa/pip/pull/14000
Patch: CVE-2026-8643.patch
# CVE-2026-13346: Link.filename double URL decode allows path traversal
# Upstream fix: https://github.com/pypa/pip/pull/14110
Patch: CVE-2026-13346.patch
# Remove -s from Python shebang - ensure that packages installed with pip
# to user locations are seen by pip itself
%undefine _py3_shebang_s