Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat Python Update Fixes Security Flaw in Third-Party Packages

published 9 months ago

Summary

This update addresses a security issue in Python's package manager, which could allow an attacker to manipulate package dependencies and potentially execute malicious code. Affected users should update their Python installation to the latest version to ensure they have the fix.

What to do

Update redhat python3.12-wheel to version 0:0.41.2-4.el8_10.
Update redhat python3.12-wheel-wheel to version 0:0.41.2-4.el8_10.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:8::appstream	redhat	python3.12-wheel	< 0:0.41.2-4.el8_10 Fix: upgrade to 0:0.41.2-4.el8_10
Red Hat:enterprise_linux:8::appstream	redhat	python3.12-wheel-wheel	< 0:0.41.2-4.el8_10 Fix: upgrade to 0:0.41.2-4.el8_10
Red Hat:enterprise_linux:8::crb	redhat	python3.12-wheel	< 0:0.41.2-4.el8_10 Fix: upgrade to 0:0.41.2-4.el8_10
Red Hat:enterprise_linux:8::crb	redhat	python3.12-wheel-wheel	< 0:0.41.2-4.el8_10 Fix: upgrade to 0:0.41.2-4.el8_10

Original advisory text

Red Hat Security Advisory: python3.12-wheel security update

References

https://access.redhat.com/errata/RHSA-2026:2090 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2431959 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2090.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-24049 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-24049 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-24049 Vendor Advisory
https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef Third Party Advisory
https://github.com/pypa/wheel/releases/tag/0.46.2 Third Party Advisory
https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.1 High

Timeline

Published6 Feb 2026

Updated7 Mar 2026

First seen6 Mar 2026

Sources

RHSA-2026:2090 · OSV

Track software like this

Free during beta