rpms/python-pip
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security fix for CVE-2026-13346

Browse source 
Co-Authored-by: Miro Hrončok <miro@hroncok.cz>
This commit is contained in:
Lumir Balhar 2026-08-14 15:05:08 +02:00 • committed by Miro Hrončok
commit ac655bc5de
2 changed files with 350 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
python-pip.spec
View file

@ -111,6 +111,9 @@ Patch: https://github.com/pypa/pip/commit/4c6d7471de.patch
# https://github.com/pypa/pip/commit/09a03f6cfa (non-existing files removed)
Patch: 09a03f6cfa.patch
# CVE-2026-13346: Link.filename double URL decode allows path traversal
Patch: https://github.com/pypa/pip/commit/10dfb6b900.patch
# Remove -s from Python shebang - ensure that packages installed with pip
# to user locations are seen by pip itself
%undefine _py3_shebang_s