[CLSA-2026:1791301739] Fix CVE(s): CVE-2024-6345, CVE-2025-47273
Type:
security
Severity:
Important
Release date:
2026-10-06 15:49:10 UTC
Description:
* CVE-2024-6345: shell command injection in PackageIndex VCS downloads * CVE-2025-47273: path traversal in PackageIndex._download_url()
CVEs fixed:
Updated packages:
  • pypy-pkg-resources_39.0.1-2ubuntu0.1+tuxcare.els1_all.deb
    sha:2b5099d9cd012d5358878242bdcaa5939fbcc0d9
  • pypy-setuptools_39.0.1-2ubuntu0.1+tuxcare.els1_all.deb
    sha:7ae5713a84204ae6cd1dab3ca66a2c3b0fe89a98
  • python-pkg-resources_39.0.1-2ubuntu0.1+tuxcare.els1_all.deb
    sha:3cb4f7e769a915fee9ab11d2b9ed374ba07effa5
  • python-setuptools_39.0.1-2ubuntu0.1+tuxcare.els1_all.deb
    sha:928ca47a72a77c5be3e49078ea61cb4c09227151
  • python-setuptools-doc_39.0.1-2ubuntu0.1+tuxcare.els1_all.deb
    sha:3b58844b537a27785e4d343db62cf9b76b0ae129
  • python3-pkg-resources_39.0.1-2ubuntu0.1+tuxcare.els1_all.deb
    sha:54804f675b83abb57e5f0fbb723a1a1a4123d4f4
  • python3-setuptools_39.0.1-2ubuntu0.1+tuxcare.els1_all.deb
    sha:183043485fc3b4c54baaf2ef396afe464daafb76
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.