Bug 2431959 (CVE-2026-24049)
| Summary: | CVE-2026-24049 wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | abarbaro, alcohan, alinfoot, alizardo, anpicker, anthomas, aprice, bbrownin, bdettelb, brasmith, carogers, caswilli, cochase, crizzo, dfreiber, doconnor, dranck, drow, dschmidt, dtrifiro, eglynn, ehelms, erezende, ggainey, gparvin, gtanzill, haoli, hasun, hkataria, jajackso, jbalunas, jburrell, jbuscemi, jcammara, jcantril, jchui, jdobes, jfula, jhe, jjoyce, jkoehler, jlanda, jmitchel, jneedle, jowilson, jsamir, juwatts, kaycoth, kegrant, kgaikwad, koliveir, kshier, ktsao, lball, ljawale, lphiri, luizcosta, mabashia, mattdavi, mburns, mgarciac, mhulan, mrunge, nboldt, ngough, nmoumoul, nweather, nyancey, oezr, ometelka, orabin, osousa, owatkins, pahickey, pakotvan, pbraun, pcreech, psrna, ptisnovs, rbobbitt, rbryant, rchan, rhaigner, rojacob, sdawley, shvarugh, simaishi, smallamp, smcdonal, stcannon, sthirugn, syedriko, teagle, tfister, thavo, tmalecek, veshanka, vimartin, vkumar, weaton, xdharmai, yguenane, zzhou |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A path traversal flaw has been discovered in the python wheel too. The unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2432088, 2432089, 2432102, 2432103, 2432104, 2432087, 2432090, 2432091, 2432092, 2432093, 2432094, 2432095, 2432096, 2432097, 2432098, 2432099, 2432100, 2432101, 2432105, 2432106, 2432107, 2432108, 2432109, 2432110, 2432111 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-01-22 05:01:19 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:1902 https://access.redhat.com/errata/RHSA-2026:1902 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:1939 https://access.redhat.com/errata/RHSA-2026:1939 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:2090 https://access.redhat.com/errata/RHSA-2026:2090 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:2710 https://access.redhat.com/errata/RHSA-2026:2710 This issue has been addressed in the following products: Discovery 2 for RHEL 10 Discovery 2 for RHEL 8 Discovery 2 for RHEL 9 Via RHSA-2026:2823 https://access.redhat.com/errata/RHSA-2026:2823 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:2865 https://access.redhat.com/errata/RHSA-2026:2865 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:2866 https://access.redhat.com/errata/RHSA-2026:2866 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.6 for RHEL 9 Red Hat Ansible Automation Platform 2.6 for RHEL 10 Via RHSA-2026:3958 https://access.redhat.com/errata/RHSA-2026:3958 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Via RHSA-2026:3959 https://access.redhat.com/errata/RHSA-2026:3959 |