Bug 2556397 (CVE-2026-113714)

Summary:	CVE-2026-113714 virtualenv: virtualenv: Unverified package installation via premature cache storage
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, anpicker, anthomas, aos-team-art-private, aprice, asdas, cmyers, dnakabaa, dpaolell, dschmidt, ehelms, gbenhaim, ggainey, hasun, ikhan, jdelft, jdobes, jfula, jlanda, jmitchel, jowilson, jpasqual, jsamir, jupierce, juwatts, jwong, kaycoth, kgaikwad, kshier, lcouzens, lgarciaa, mbiarnes, mdellweg, mhulan, niyer, nmoumoul, nyancey, oezr, omaciel, ometelka, orabin, osousa, pcreech, ppalepu, ppostler, prdhamdh, prwatson, ptisnovs, rbobbitt, rchan, sdawley, sghai, sidsharm, simaishi, smallamp, stcannon, suppawar, syedriko, tmalecek, ttakamiy, twaugh, vlaad, xdharmai, yguenane, zzhou
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in virtualenv. The utility writes downloaded software packages directly into its reusable cache before completing integrity verification checks. An attacker controlling a package repository can exploit this flaw to retain rejected or manipulated packages in the cache, resulting in the installation of unverified software.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-20 19:21:43 UTC

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled, a controlled package index can inject a misleading Saved line through a discarded link's data-requires-python attribute; this forged-line variant also requires knowledge of an absolute path to the genuine bundled wheel. The wrong path can then be hashed, while a digest mismatch leaves the rejected archive in the cache for later selection without verification. A separate rejected-cache-file variant requires control over downloaded data or archive selection but not the forged-line prerequisites. Explicit custom-index exceptions are outside the promised PyPI comparison, and the issue does not independently bypass TLS or establish control of default PyPI. This issue is fixed in version 21.14.9.