OESA-2026-1280

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-1280
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-1280.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-1280
Upstream
Published
2026-02-06T15:54:07Z
Modified
2026-02-06T16:15:33.152273Z
Summary
python-wheel security update
Details

A built-package format for Python. A wheel is a ZIP-format archive with a specially formatted filename and the .whl extension. It is designed to contain all the files for a PEP 376 compatible install in a way that is very close to the on-disk format.

Security Fix(es):

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.(CVE-2026-24049)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:24.03-LTS-SP1 / python-wheel

Package

Name
python-wheel
Purl
pkg:rpm/openEuler/python-wheel&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.40.0-2.oe2403sp1

Ecosystem specific 

{
    "noarch": [
        "python-wheel-wheel-0.40.0-2.oe2403sp1.noarch.rpm",
        "python3-wheel-0.40.0-2.oe2403sp1.noarch.rpm"
    ],
    "src": [
        "python-wheel-0.40.0-2.oe2403sp1.src.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1280.json"