{ "threat_severity" : "Important", "public_date" : "2026-05-27T17:03:36Z", "bugzilla" : { "description" : "python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite", "id" : "2460927", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2460927" }, "cvss3" : { "cvss3_base_score" : "8.0", "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "status" : "verified" }, "cwe" : "CWE-22", "details" : [ "pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.", "A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution." ], "statement" : "This Important flaw in pip's wheel installation process allows for arbitrary file overwrite due to path traversal. An attacker could exploit this by convincing a user to install a specially crafted malicious Python wheel. While file overwrites are limited to the installing user's permissions, using `pip install` with elevated privileges in Red Hat environments significantly increases the potential impact, potentially leading to system integrity compromise or arbitrary code execution.", "acknowledgement" : "This issue was discovered by AISLE in partnership with Red Hat from.", "affected_release" : [ { "product_name" : "Red Hat Ansible Automation Platform 2.5 for RHEL 8", "release_date" : "2026-07-20T00:00:00Z", "advisory" : "RHSA-2026:42078", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.5::el8", "package" : "automation-controller-0:4.6.30-2.el8ap" }, { "product_name" : "Red Hat Ansible Automation Platform 2.5 for RHEL 9", "release_date" : "2026-07-20T00:00:00Z", "advisory" : "RHSA-2026:42078", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.5::el9", "package" : "automation-controller-0:4.6.30-2.el9ap" }, { "product_name" : "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date" : "2026-07-20T00:00:00Z", "advisory" : "RHSA-2026:42079", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package" : "automation-controller-0:4.7.14-3.el9ap" }, { "product_name" : "Red Hat Enterprise Linux 10", "release_date" : "2026-07-07T00:00:00Z", "advisory" : "RHSA-2026:36193", "cpe" : "cpe:/o:redhat:enterprise_linux:10.2", "package" : "python3.14-pip-0:25.2-3.el10_2.5" }, { "product_name" : "Red Hat Enterprise Linux 9", "release_date" : "2026-07-07T00:00:00Z", "advisory" : "RHSA-2026:36315", "cpe" : "cpe:/a:redhat:enterprise_linux:9", "package" : "python3.14-pip-0:25.2-3.el9_8.5" }, { "product_name" : "Red Hat Ansible Automation Platform 2.5", "release_date" : "2026-07-20T00:00:00Z", "advisory" : "RHSA-2026:42144", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.5::el8", "package" : "ansible-automation-platform-25/controller-rhel8:1784049109" }, { "product_name" : "Red Hat Ansible Automation Platform 2.6", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34374", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package" : "ansible-automation-platform-26/de-minimal-rhel9:1782711769" }, { "product_name" : "Red Hat Ansible Automation Platform 2.6", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34374", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package" : "ansible-automation-platform-26/de-supported-rhel9:1782713671" }, { "product_name" : "Red Hat Ansible Automation Platform 2.6", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34374", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package" : "ansible-automation-platform-26/gateway-rhel9:1782761510" }, { "product_name" : "Red Hat Ansible Automation Platform 2.6", "release_date" : "2026-07-20T00:00:00Z", "advisory" : "RHSA-2026:42132", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package" : "ansible-automation-platform-tech-preview/metrics-service-rhel9:1783969139" }, { "product_name" : "Red Hat Discovery 2", "release_date" : "2026-06-29T00:00:00Z", "advisory" : "RHSA-2026:33313", "cpe" : "cpe:/a:redhat:discovery:2::el9", "package" : "discovery/discovery-server-rhel9:1782763840" }, { "product_name" : "Red Hat Hardened Images", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34891", "cpe" : "cpe:/a:redhat:hummingbird:1", "package" : "python-pip-main-26.1.1-3.1.hum1" }, { "product_name" : "Red Hat Hardened Images", "release_date" : "2026-07-07T00:00:00Z", "advisory" : "RHSA-2026:36359", "cpe" : "cpe:/a:redhat:hummingbird:1", "package" : "python-pip-main-26.1.2-1.hum1" }, { "product_name" : "Red Hat OpenShift AI 2.25", "release_date" : "2026-07-21T00:00:00Z", "advisory" : "RHSA-2026:42644", "cpe" : "cpe:/a:redhat:openshift_ai:2.25::el9", "package" : "rhoai/odh-caikit-tgis-serving-rhel9:1783082430" }, { "product_name" : "Red Hat OpenShift AI 2.25", "release_date" : "2026-07-21T00:00:00Z", "advisory" : "RHSA-2026:42644", "cpe" : "cpe:/a:redhat:openshift_ai:2.25::el9", "package" : "rhoai/odh-kserve-storage-initializer-rhel9:1783024305" }, { "product_name" : "Red Hat OpenShift AI 2.25", "release_date" : "2026-07-21T00:00:00Z", "advisory" : "RHSA-2026:42644", "cpe" : "cpe:/a:redhat:openshift_ai:2.25::el9", "package" : "rhoai/odh-modelmesh-runtime-adapter-rhel9:1783342900" }, { "product_name" : "Red Hat OpenShift AI 2.25", "release_date" : "2026-07-21T00:00:00Z", "advisory" : "RHSA-2026:42644", "cpe" : "cpe:/a:redhat:openshift_ai:2.25::el9", "package" : "rhoai/odh-training-cuda121-torch24-py311-rhel9:1783998418" }, { "product_name" : "Red Hat OpenShift AI 2.25", "release_date" : "2026-07-21T00:00:00Z", "advisory" : "RHSA-2026:42644", "cpe" : "cpe:/a:redhat:openshift_ai:2.25::el9", "package" : "rhoai/odh-training-cuda124-torch25-py311-rhel9:1783998418" }, { "product_name" : "Red Hat OpenShift AI 2.25", "release_date" : "2026-07-21T00:00:00Z", "advisory" : "RHSA-2026:42644", "cpe" : "cpe:/a:redhat:openshift_ai:2.25::el9", "package" : "rhoai/odh-training-rocm62-torch24-py311-rhel9:1782475830" }, { "product_name" : "Red Hat OpenShift AI 2.25", "release_date" : "2026-07-21T00:00:00Z", "advisory" : "RHSA-2026:42644", "cpe" : "cpe:/a:redhat:openshift_ai:2.25::el9", "package" : "rhoai/odh-training-rocm62-torch25-py311-rhel9:1782475830" }, { "product_name" : "Red Hat OpenShift AI 3.0", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34772", "cpe" : "cpe:/a:redhat:openshift_ai:3.0::el9", "package" : "rhai/base-image-cpu-rhel9:1782929133" }, { "product_name" : "Red Hat OpenShift AI 3.0", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34773", "cpe" : "cpe:/a:redhat:openshift_ai:3.0::el9", "package" : "rhai/base-image-spyre-rhel9:1782928984" }, { "product_name" : "Red Hat OpenShift AI 3.0", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34774", "cpe" : "cpe:/a:redhat:openshift_ai:3.0::el9", "package" : "rhai/base-image-tpu-rhel9:1782968171" }, { "product_name" : "Red Hat OpenShift AI 3.0", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34778", "cpe" : "cpe:/a:redhat:openshift_ai:3.0::el9", "package" : "rhai/base-image-cuda-rhel9:1782929069" }, { "product_name" : "Red Hat OpenShift AI 3.0", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34780", "cpe" : "cpe:/a:redhat:openshift_ai:3.0::el9", "package" : "rhai/base-image-rocm-rhel9:1782928977" }, { "product_name" : "Red Hat OpenShift AI 3.2", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34739", "cpe" : "cpe:/a:redhat:openshift_ai:3.2::el9", "package" : "rhai/base-image-cpu-rhel9:1782915416" }, { "product_name" : "Red Hat OpenShift AI 3.2", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34752", "cpe" : "cpe:/a:redhat:openshift_ai:3.2::el9", "package" : "rhai/base-image-cuda-rhel9:1782915184" }, { "product_name" : "Red Hat OpenShift AI 3.2", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34756", "cpe" : "cpe:/a:redhat:openshift_ai:3.2::el9", "package" : "rhai/base-image-spyre-rhel9:1782914833" }, { "product_name" : "Red Hat OpenShift AI 3.2", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34758", "cpe" : "cpe:/a:redhat:openshift_ai:3.2::el9", "package" : "rhai/base-image-rocm-rhel9:1782914751" }, { "product_name" : "Red Hat OpenShift AI 3.2", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34760", "cpe" : "cpe:/a:redhat:openshift_ai:3.2::el9", "package" : "rhai/base-image-tpu-rhel9:1782914629" }, { "product_name" : "Red Hat OpenShift AI 3.2", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34765", "cpe" : "cpe:/a:redhat:openshift_ai:3.2::el9", "package" : "rhai/base-image-rocm-rhel9:1782914721" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34740", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhai/base-image-neuron-rhel9:1782915056" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34741", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhai/base-image-spyre-rhel9:1782916020" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34748", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhai/base-image-cuda-12.9-rhel9:1782914960" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34749", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhai/base-image-rocm-6.4-rhel9:1782914644" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34750", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhai/base-image-rocm-7.0-rhel9:1782914706" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34775", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhai/base-image-cuda-13.0-rhel9:1782915015" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34776", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhai/base-image-cpu-rhel9:1782914779" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-02T00:00:00Z", "advisory" : "RHSA-2026:34777", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhai/base-image-tpu-rhel9:1782914653" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37275", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhoai/odh-kserve-storage-initializer-rhel9:1783010225" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37275", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhoai/odh-mlserver-rhel9:1782887848" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37275", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhoai/odh-training-cuda121-torch24-py311-rhel9:1782471555" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37275", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhoai/odh-training-cuda124-torch25-py311-rhel9:1782471579" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37275", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhoai/odh-training-cuda128-torch28-py312-rhel9:1783073038" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37275", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhoai/odh-training-cuda128-torch29-py312-rhel9:1782991170" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37275", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhoai/odh-training-rocm62-torch24-py311-rhel9:1782471656" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37275", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhoai/odh-training-rocm62-torch25-py311-rhel9:1782471663" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37275", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhoai/odh-training-rocm64-torch28-py312-rhel9:1783069204" }, { "product_name" : "Red Hat OpenShift AI 3.3", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37275", "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9", "package" : "rhoai/odh-training-rocm64-torch29-py312-rhel9:1782991170" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34456", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-kserve-storage-initializer-rhel9:1782133213" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34456", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-mlserver-rhel9:1782726504" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34456", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-th06-cpu-torch210-py312-rhel9:1782135464" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34456", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-th06-cuda130-torch210-py312-rhel9:1782136276" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34456", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-th06-rocm64-torch291-py312-rhel9:1782135346" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34456", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-training-cuda121-torch24-py311-rhel9:1782132167" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34456", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-training-cuda124-torch25-py311-rhel9:1782132207" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34456", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-training-cuda128-torch28-py312-rhel9:1782132237" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34456", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-training-cuda128-torch29-py312-rhel9:1782132240" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34456", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-training-rocm62-torch24-py311-rhel9:1782132286" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34456", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-training-rocm62-torch25-py311-rhel9:1782132236" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34456", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-training-rocm64-torch28-py312-rhel9:1782132163" }, { "product_name" : "Red Hat OpenShift AI 3.4", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34456", "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9", "package" : "rhoai/odh-training-rocm64-torch29-py312-rhel9:1782132297" }, { "product_name" : "Red Hat Trusted Artifact Signer 1.4", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37283", "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1.4::el9", "package" : "rhtas/model-transparency-rhel9:1782485441" } ], "package_state" : [ { "product_name" : "Exploit Intelligence", "fix_state" : "Affected", "package_name" : "exploit-intelligence-tech-preview/vulnerability-analysis-rhel9", "cpe" : "cpe:/a:redhat:exploit_intelligence:0" }, { "product_name" : "Migration Toolkit for Applications 8", "fix_state" : "Affected", "package_name" : "mta/mta-rhel9-operator", "cpe" : "cpe:/a:redhat:migration_toolkit_applications:8" }, { "product_name" : "Migration Toolkit for Virtualization", "fix_state" : "Affected", "package_name" : "migration-toolkit-virtualization/mtv-rhel9-operator", "cpe" : "cpe:/a:redhat:migration_toolkit_virtualization:2" }, { "product_name" : "Migration Toolkit for Virtualization", "fix_state" : "Will not fix", "package_name" : "mtv-candidate/mtv-rhel9-operator", "cpe" : "cpe:/a:redhat:migration_toolkit_virtualization:2" }, { "product_name" : "OpenShift Lightspeed", "fix_state" : "Not affected", "package_name" : "openshift-lightspeed/lightspeed-service-api-rhel9", "cpe" : "cpe:/a:redhat:openshift_lightspeed" }, { "product_name" : "OpenShift Lightspeed", "fix_state" : "Not affected", "package_name" : "openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9", "cpe" : "cpe:/a:redhat:openshift_lightspeed" }, { "product_name" : "OpenShift Service Mesh 3", "fix_state" : "Not affected", "package_name" : "openshift-service-mesh/kiali-rhel9-operator", "cpe" : "cpe:/a:redhat:service_mesh:3" }, { "product_name" : "Pen Drive Powered by Red Hat Lightspeed", "fix_state" : "Affected", "package_name" : "pen-drive/pen-drive-scanner-rhel9", "cpe" : "cpe:/a:redhat:pdrive_lightspeed:0" }, { "product_name" : "Pen Drive Powered by Red Hat Lightspeed", "fix_state" : "Affected", "package_name" : "pen-drive/pen-drive-scanner-rhel9", "cpe" : "cpe:/a:redhat:pdrive_lightspeed:1" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Affected", "package_name" : "rhaii/model-opt-cuda-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Affected", "package_name" : "rhaiis/model-opt-cuda-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Will not fix", "package_name" : "rhaiis/vllm-cpu-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Affected", "package_name" : "rhaiis/vllm-cuda-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Will not fix", "package_name" : "rhaiis/vllm-neuron-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Affected", "package_name" : "rhaiis/vllm-rocm-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Will not fix", "package_name" : "rhaiis/vllm-spyre-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Will not fix", "package_name" : "rhaiis/vllm-tpu-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Affected", "package_name" : "rhaii/vllm-cpu-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Affected", "package_name" : "rhaii/vllm-cuda-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Will not fix", "package_name" : "rhaii/vllm-gaudi-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Will not fix", "package_name" : "rhaii/vllm-neuron-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Affected", "package_name" : "rhaii/vllm-rocm-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Affected", "package_name" : "rhaii/vllm-spyre-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat AI Inference Server", "fix_state" : "Will not fix", "package_name" : "rhaii/vllm-tpu-rhel9", "cpe" : "cpe:/a:redhat:ai_inference_server:3" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Affected", "package_name" : "ansible-automation-platform-26/controller-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Affected", "package_name" : "ansible-automation-platform-26/controller-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Affected", "package_name" : "ansible-automation-platform-26/eda-controller-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Affected", "package_name" : "ansible-automation-platform-26/gateway-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Affected", "package_name" : "ansible-automation-platform-26/hub-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Will not fix", "package_name" : "ansible-automation-platform-26/lightspeed-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Affected", "package_name" : "ansible-automation-platform-26/platform-resource-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Affected", "package_name" : "ansible-automation-platform-27/aap-cloud-billing-operator-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Affected", "package_name" : "ansible-automation-platform/automation-dashboard-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Affected", "package_name" : "ansible-automation-platform-tech-preview/metrics-service-rhel9-operator", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Developer Hub", "fix_state" : "Not affected", "package_name" : "rhdh/rhdh-hub-rhel9", "cpe" : "cpe:/a:redhat:rhdh:1" }, { "product_name" : "Red Hat Enterprise Linux 10", "fix_state" : "Not affected", "package_name" : "python-pip", "cpe" : "cpe:/o:redhat:enterprise_linux:10" }, { "product_name" : "Red Hat Enterprise Linux 10", "fix_state" : "Affected", "package_name" : "rhel10/python-312-minimal", "cpe" : "cpe:/o:redhat:enterprise_linux:10" }, { "product_name" : "Red Hat Enterprise Linux 7", "fix_state" : "Not affected", "package_name" : "python-pip", "cpe" : "cpe:/o:redhat:enterprise_linux:7" }, { "product_name" : "Red Hat Enterprise Linux 8", "fix_state" : "Not affected", "package_name" : "python3.12-pip", "cpe" : "cpe:/o:redhat:enterprise_linux:8" }, { "product_name" : "Red Hat Enterprise Linux 8", "fix_state" : "Not affected", "package_name" : "python-pip", "cpe" : "cpe:/o:redhat:enterprise_linux:8" }, { "product_name" : "Red Hat Enterprise Linux 8", "fix_state" : "Affected", "package_name" : "ubi8/python-311", "cpe" : "cpe:/o:redhat:enterprise_linux:8" }, { "product_name" : "Red Hat Enterprise Linux 8", "fix_state" : "Affected", "package_name" : "ubi8/python-312", "cpe" : "cpe:/o:redhat:enterprise_linux:8" }, { "product_name" : "Red Hat Enterprise Linux 8", "fix_state" : "Affected", "package_name" : "ubi8/python-36", "cpe" : "cpe:/o:redhat:enterprise_linux:8" }, { "product_name" : "Red Hat Enterprise Linux 8", "fix_state" : "Affected", "package_name" : "ubi8/python-39", "cpe" : "cpe:/o:redhat:enterprise_linux:8" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Not affected", "package_name" : "python3.12-pip", "cpe" : "cpe:/o:redhat:enterprise_linux:9" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Not affected", "package_name" : "python-pip", "cpe" : "cpe:/o:redhat:enterprise_linux:9" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Affected", "package_name" : "rhel9/python-311", "cpe" : "cpe:/o:redhat:enterprise_linux:9" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Affected", "package_name" : "rhel9/python-39", "cpe" : "cpe:/o:redhat:enterprise_linux:9" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Affected", "package_name" : "ubi9/python-312", "cpe" : "cpe:/o:redhat:enterprise_linux:9" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Affected", "package_name" : "ubi9/python-312-minimal", "cpe" : "cpe:/o:redhat:enterprise_linux:9" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/bootc-aws-cuda-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/bootc-azure-cuda-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/bootc-azure-rocm-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/bootc-cuda-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/bootc-gaudi-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/bootc-gcp-cuda-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/bootc-rocm-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/disk-image-cuda-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhai/base-image-gaudi-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhai/base-image-rocm-7.1-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-automl-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-autorag-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-built-in-detector-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-caikit-nlp-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-feature-server-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-guardrails-detector-huggingface-runtime-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-kserve-autogluon-server-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-llama-stack-core-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Not affected", "package_name" : "rhoai/odh-llm-d-kv-cache-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Not affected", "package_name" : "rhoai/odh-model-registry-job-async-upload-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-pipelines-components-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Not affected", "package_name" : "rhoai/odh-spark-operator-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-ta-lmes-job-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-th06-cpu-torch291-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-trustyai-nemo-guardrails-server-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-vllm-cuda-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-vllm-rocm-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Affected", "package_name" : "openshift4/ose-ansible-rhel9-operator", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Affected", "package_name" : "rhcos", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Dev Spaces", "fix_state" : "Affected", "package_name" : "devspaces/udi-rhel9", "cpe" : "cpe:/a:redhat:openshift_devspaces:3" }, { "product_name" : "Red Hat Quay 3", "fix_state" : "Not affected", "package_name" : "quay/quay-rhel8", "cpe" : "cpe:/a:redhat:quay:3" }, { "product_name" : "Red Hat Quay 3", "fix_state" : "Not affected", "package_name" : "quay/quay-rhel9", "cpe" : "cpe:/a:redhat:quay:3" }, { "product_name" : "Red Hat Satellite 6", "fix_state" : "Not affected", "package_name" : "satellite/foreman-mcp-server-rhel9", "cpe" : "cpe:/a:redhat:satellite:6" }, { "product_name" : "Red Hat Satellite 6", "fix_state" : "Not affected", "package_name" : "satellite/iop-advisor-backend-rhel9", "cpe" : "cpe:/a:redhat:satellite:6" }, { "product_name" : "Red Hat Satellite 6", "fix_state" : "Not affected", "package_name" : "satellite/iop-advisor-engine-rhel9", "cpe" : "cpe:/a:redhat:satellite:6" }, { "product_name" : "Red Hat Trusted Artifact Signer", "fix_state" : "Affected", "package_name" : "rhtas/segment-reporting-rhel9", "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1" }, { "product_name" : "Service Telemetry Framework 1.5", "fix_state" : "Not affected", "package_name" : "stf/prometheus-webhook-snmp-rhel9", "cpe" : "cpe:/a:redhat:stf:1.5" }, { "product_name" : "Service Telemetry Framework 1.5", "fix_state" : "Not affected", "package_name" : "stf/service-telemetry-rhel9-operator", "cpe" : "cpe:/a:redhat:stf:1.5" }, { "product_name" : "Service Telemetry Framework 1.5", "fix_state" : "Not affected", "package_name" : "stf/smart-gateway-rhel9-operator", "cpe" : "cpe:/a:redhat:stf:1.5" } ], "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-8643\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-8643\nhttps://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb" ], "name" : "CVE-2026-8643", "mitigation" : { "value" : "To mitigate this issue, users should avoid installing Python wheels from untrusted sources. It is strongly advised against using `pip install` with elevated privileges, such as `sudo`, when installing wheels. Additionally, administrators should inspect `entry_points.txt` within wheels for path separators or absolute paths before installation.", "lang" : "en:us" }, "csaw" : false }