[<prev] [next>] [day] [month] [year] [list]
Message-ID: <e908202e-dbf4-4ce8-9f23-2dfe1428f566@oracle.com>
Date: Mon, 27 Apr 2026 13:31:14 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: [CVE-2026-6357] pip self-update functionality can
import newly installed modules after wheel installation
-------- Forwarded Message --------
Subject: [Security-announce][CVE-2026-6357] pip self-update functionality can
import newly installed modules after wheel installation
Date: Mon, 27 Apr 2026 14:20:59 +0000
From: Seth Larson <seth@...hon.org>
Reply-To: security-sig@...hon.org
To: security-announce@...hon.org
There is a MEDIUM severity vulnerability affecting the pip project.
pip prior to version 26.1 would run self-update check functionality after
installing wheel files which required importing well-known Python modules names.
These module imports were intentionally deferred to increase startup time of the
pip CLI. The patch changes self-update functionality to run before wheels are
installed to prevent newly-installed modules from being imported shortly after
the installation of a wheel package. Users should still review package contents
prior to installation.
Please see the linked CVE ID for the latest information on affected versions:
* https://www.cve.org/CVERecord?id=CVE-2026-6357
* https://github.com/pypa/pip/pull/13923
_______________________________________________
Security-announce mailing list -- security-announce@...hon.org
To unsubscribe send an email to security-announce-leave@...hon.org
https://mail.python.org/mailman3//lists/security-announce.python.org
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
