{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/vex/2026/cve-2026-13346-els_os-cloudlinux7els.json" } ], "tracking": { "current_release_date": "2026-11-05T18:45:25Z", "generator": { "date": "2026-11-05T18:45:25Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-13346-ELS_OS-CLOUDLINUX7ELS", "initial_release_date": "2026-07-29T19:16:00Z", "revision_history": [ { "date": "2026-07-29T19:16:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-11-05T18:45:25Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2026-13346" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "CloudLinux 7", "product": { "name": "CloudLinux 7", "product_id": "CloudLinux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "CloudLinux" }, { "branches": [ { "category": "product_version", "name": "python3-pip-0:9.0.3-8.0.3.el7.noarch", "product": { "name": "python3-pip-0:9.0.3-8.0.3.el7.noarch", "product_id": "python3-pip-0:9.0.3-8.0.3.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/python3-pip@9.0.3-8.0.3.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "python3-pip-0:9.0.3-8.0.3.el7.tuxcare.els1.noarch", "product": { "name": "python3-pip-0:9.0.3-8.0.3.el7.tuxcare.els1.noarch", "product_id": "python3-pip-0:9.0.3-8.0.3.el7.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/python3-pip@9.0.3-8.0.3.el7.tuxcare.els1?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "python3-pip-0:9.0.3-8.0.3.el7.tuxcare.els1.noarch as a component of CloudLinux 7", "product_id": "CloudLinux-7:python3-pip-0:9.0.3-8.0.3.el7.tuxcare.els1.noarch" }, "product_reference": "python3-pip-0:9.0.3-8.0.3.el7.tuxcare.els1.noarch", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "python3-pip-0:9.0.3-8.0.3.el7.noarch as a component of CloudLinux 7", "product_id": "CloudLinux-7:python3-pip-0:9.0.3-8.0.3.el7.noarch" }, "product_reference": "python3-pip-0:9.0.3-8.0.3.el7.noarch", "relates_to_product_reference": "CloudLinux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-13346", "cwe": { "id": "CWE-36", "name": "Absolute Path Traversal" }, "notes": [ { "category": "description", "text": "pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "CloudLinux-7:python3-pip-0:9.0.3-8.0.3.el7.noarch", "CloudLinux-7:python3-pip-0:9.0.3-8.0.3.el7.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-13346" }, { "category": "external", "summary": "https://github.com/pypa/pip/pull/14110", "url": "https://github.com/pypa/pip/pull/14110" }, { "category": "external", "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/07/29/7", "url": "http://www.openwall.com/lists/oss-security/2026/07/29/7" } ], "release_date": "2026-07-29T19:16:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-10-25T11:16:33.701914Z", "details": "This issue requires explicitly directing pip to a malicious package index and, in the practically relevant case, running pip download with the --only-binary option; a malicious package alone on a trusted index cannot trigger it. The impact is limited to arbitrary file placement within the privileges of the pip process (integrity only), requires user interaction, and has no confidentiality or availability effect. Since changing pip’s index to an untrusted source is a deliberate, non-default configuration step, centrally managed server/VM environments can safely deprioritize this CVE.", "product_ids": [ "CloudLinux-7:python3-pip-0:9.0.3-8.0.3.el7.noarch", "CloudLinux-7:python3-pip-0:9.0.3-8.0.3.el7.tuxcare.els1.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CloudLinux-7:python3-pip-0:9.0.3-8.0.3.el7.noarch", "CloudLinux-7:python3-pip-0:9.0.3-8.0.3.el7.tuxcare.els1.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }