PT-2026-26139 · Pypi · Pkgutil

Stanfromireland · Publicado 2026-03-18 · Atualizado 2026-05-22 · CVE-2026-3479

Positive Technologies (AI Summary)

CVSS v4.0

Vetor base

AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pkgutil (affected versions not specified)

Description The pkgutil.get data() function did not properly validate the resource argument, as documented. This allowed for path traversal, potentially enabling unauthorized access to files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BIT-LIBPYTHON-2026-3479

BIT-PYTHON-2026-3479

BIT-PYTHON-MIN-2026-3479

CVE-2026-3479

ECHO-C84E-DEA4-EC4C

OESA-2026-1899

OESA-2026-1900

OESA-2026-1901

OESA-2026-1902

OPENSUSE-SU-2026:10520-1

OPENSUSE-SU-2026:10521-1

OPENSUSE-SU-2026:10522-1

OPENSUSE-SU-2026:10552-1

OPENSUSE-SU-2026:10553-1

OPENSUSE-SU-2026:10554-1

OPENSUSE-SU-2026:10782-1

OPENSUSE-SU-2026:20517-1

PSF-2026-13

RHSA-2026:10118

RHSA-2026:11324

RHSA-2026:7443

RHSA-2026:7661

SUSE-SU-2026:1292-1

SUSE-SU-2026:1345-1

SUSE-SU-2026:1349-1

SUSE-SU-2026:1354-1

SUSE-SU-2026:1365-1

SUSE-SU-2026:1376-1

SUSE-SU-2026:1385-1

SUSE-SU-2026:1417-1

SUSE-SU-2026:1530-1

SUSE-SU-2026:1715-1

SUSE-SU-2026:1818-1

SUSE-SU-2026:21104-1

SUSE-SU-2026:21178-1

SUSE-SU-2026:21254-1

Produtos afetados

Pkgutil

Referências · 100

• https://github.com/python/cpython/pull/146122 · Correção
• https://github.com/python/cpython/issues/146121 · Nota
• https://github.com/python/cpython/commit/bcdf231946b1da8bdfbab4c05539bb0cc964a1c7 · Correção
• https://github.com/python/cpython/commit/cf59bf76470f3d75ad47d80ffb8ce76b64b5e943 · Correção
• https://github.com/python/cpython/commit/d786d59a8f7196bb630100a869f28ad13436b59c · Correção
• https://github.com/python/cpython/commit/5af6ce3e7b643a30a02d22245c1e3f4a8bc0a1fe · Correção
• https://github.com/python/cpython/pull/146134 · Nota
• https://github.com/python/cpython/pull/146133 · Nota
• https://github.com/python/cpython/pull/146136 · Nota
• https://suse.com/support/update/announcement/2026/suse-su-20261365-1 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2026:10522-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1252974 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2026:1385-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2026:1345-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2026:1354-1 · Aviso do Fabricante