Skip to content

Release 24.0.post2

Choose a tag to compare

View all tags
@icanhasmath icanhasmath released this 22 Oct 19:06
· 0 commits to main since this release
24.0.post2
e3a696b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Second ActiveState security release for pip 24.0 (Python 3.7), superseding the 24.0.0.1 build. Merged in #5.

The version is 24.0.post2. 24.0.0.1 reported itself as plain 24.0, so it counts as release #1, and the scanner version for this one is 24.0.0.2.

CVE Advisory Status
CVE-2026-3219 GHSA-58qw-9mgm-455v Patched
CVE-2026-6357 GHSA-jp4c-xjxw-mgf9 Patched
CVE-2026-8643 GHSA-wf93-45jw-7689 Patched (exploitable here; distlib 0.3.8)
CVE-2026-13346 GHSA-qwm4-qh6w-59xr Patched
CVE-2024-39689 GHSA-248v-346w-9cwc Patched: vendored certifi upgrade (GLOBALTRUST)
— GHSA-6q48-6c7w-9gw2 Patched: vendored certifi upgrade (emSign, critical)
CVE-2025-8869 GHSA-4xh5-x5gv-qwph Patched in 24.0.0.1; hardened here with pypa#14127 (3.7 always uses the tar fallback)
CVE-2026-1703 GHSA-6vgw-5pg2-w6jp Patched in 24.0.0.1; its commonpath check broke // prefixes, which is fixed here

Vendored certifi moves from 2023.7.22 to 2026.10.19, byte-identical to pip 26.2.2's vendored copy.

Review-round hardening (also in this release):

  • CVE-2025-8869 follow-up: pypa#14127 is ported, rejecting symlink redirection in the tar fallback.
  • Path checks: containment checks are root-safe and //-safe.
  • Archive members: symlink targets are matched against normalized member names.
  • Error messages: an unsafe download file name now gives a pip ERROR: instead of a traceback.

Validated on the built wheel, in the matching python:X-slim image:

  • CVE-2026-6357: the end-to-end _manylinux exploit is not executed.
  • CVE-2026-1703: the sibling-prefix wheel is blocked.
  • CVE-2025-8869: both pypa#14127 escape archives are refused.
  • Archive shapes: valid ./-prefixed and implied-directory archives unpack.
  • Bundled certifi: the bundle has no emSign ECC G3, TrustCor, E-Tugra or GLOBALTRUST roots.
  • Network: a real pip download from PyPI works.

sha256

  • pip-24.0.post2.tar.gz: 23dd20ed6578dd7a42b6f98f11f13b73fb4a823da2145cd1c212d56db4b55457
  • pip-24.0.post2-py3-none-any.whl: f5a127fad99dba8f6f72f69d4944cbc9f526356b4a8da994aded64da1016822f
Assets 4
Loading