Описание
Security update for pyenv
This update for pyenv fixes the following issues:
Changes in pyenv:
- CVE-2026-68939: a matching attacker-controlled file can silently select a different installed interpreter or version (bsc#1275661)
Список пакетов
openSUSE Leap 16.0
pyenv-2.4.14-bp160.2.1
pyenv-bash-completion-2.4.14-bp160.2.1
pyenv-fish-completion-2.4.14-bp160.2.1
pyenv-zsh-completion-2.4.14-bp160.2.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1275661
- SUSE CVE CVE-2026-68939 page
Описание
Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix, libexec/pyenv-local, libexec/pyenv-global, libexec/pyenv-version, and libexec/pyenv-versions pathname-expands the value against the current directory, allowing a matching attacker-controlled file to silently select a different installed interpreter or version. This issue is fixed in version 2.8.0.
Затронутые продукты
openSUSE Leap 16.0:pyenv-2.4.14-bp160.2.1
openSUSE Leap 16.0:pyenv-bash-completion-2.4.14-bp160.2.1
openSUSE Leap 16.0:pyenv-fish-completion-2.4.14-bp160.2.1
openSUSE Leap 16.0:pyenv-zsh-completion-2.4.14-bp160.2.1
Ссылки
- CVE-2026-68939
- SUSE Bug 1275661