[CLSA-2026:1785240415] Fix CVE(s): CVE-2024-6345, CVE-2025-47273
Type:
security
Severity:
Important
Release date:
2026-07-28 12:07:06 UTC
Description:
* SECURITY UPDATE: remote code execution via command injection in VCS downloads - debian/patches/CVE-2024-6345.patch: replace os.system with subprocess.check_call - CVE-2024-6345 * SECURITY UPDATE: path traversal in download filename resolution - debian/patches/CVE-2025-47273.patch: validate download filename stays within tmpdir - CVE-2025-47273
CVEs fixed:
Updated packages:
  • alt-python311-setuptools_65.6.3-4_all.deb
    sha:ed4942b963882f89b7f7d0545dfe68ee047cc05f
  • alt-python311-setuptools-wheel_65.6.3-4_all.deb
    sha:de0b15378f64a54f9b07b608a51c516be70053bc
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.