{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-pip",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-pip fixes the following issues:\n\n- CVE-2026-3219: concatenated tar and ZIP files are handled as ZIP files, resulting in possibly obfuscated malicious\n  code (bsc#1262429).\n- CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation, resulting\n  in potential arbitrary code execution (bsc#1263442).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-872",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22018-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22018-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622018-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22018-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047158.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1262429",
        "url": "https://bugzilla.suse.com/1262429"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1263442",
        "url": "https://bugzilla.suse.com/1263442"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-1703 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-1703/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-3219 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-3219/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-6357 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-6357/"
      }
    ],
    "title": "Security update for python-pip",
    "tracking": {
      "current_release_date": "2026-06-02T13:37:13Z",
      "generator": {
        "date": "2026-06-02T13:37:13Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22018-1",
      "initial_release_date": "2026-06-02T13:37:13Z",
      "revision_history": [
        {
          "date": "2026-06-02T13:37:13Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-pip-25.0.1-160000.4.1.noarch",
                "product": {
                  "name": "python313-pip-25.0.1-160000.4.1.noarch",
                  "product_id": "python313-pip-25.0.1-160000.4.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "python313-pip-wheel-25.0.1-160000.4.1.noarch",
                "product": {
                  "name": "python313-pip-wheel-25.0.1-160000.4.1.noarch",
                  "product_id": "python313-pip-wheel-25.0.1-160000.4.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-pip-25.0.1-160000.4.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:python313-pip-25.0.1-160000.4.1.noarch"
        },
        "product_reference": "python313-pip-25.0.1-160000.4.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-pip-wheel-25.0.1-160000.4.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch"
        },
        "product_reference": "python313-pip-wheel-25.0.1-160000.4.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-pip-25.0.1-160000.4.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-25.0.1-160000.4.1.noarch"
        },
        "product_reference": "python313-pip-25.0.1-160000.4.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-pip-wheel-25.0.1-160000.4.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch"
        },
        "product_reference": "python313-pip-wheel-25.0.1-160000.4.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1703",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-1703"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn\u0027t able to inject or overwrite executable files in typical situations.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-pip-25.0.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-25.0.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-1703",
          "url": "https://www.suse.com/security/cve/CVE-2026-1703"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257599 for CVE-2026-1703",
          "url": "https://bugzilla.suse.com/1257599"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-pip-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-pip-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-02T13:37:13Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-1703"
    },
    {
      "cve": "CVE-2026-3219",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-3219"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing \"incorrect\" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-pip-25.0.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-25.0.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-3219",
          "url": "https://www.suse.com/security/cve/CVE-2026-3219"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262429 for CVE-2026-3219",
          "url": "https://bugzilla.suse.com/1262429"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-pip-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-pip-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-02T13:37:13Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-3219"
    },
    {
      "cve": "CVE-2026-6357",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-6357"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-pip-25.0.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-25.0.1-160000.4.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-6357",
          "url": "https://www.suse.com/security/cve/CVE-2026-6357"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1263442 for CVE-2026-6357",
          "url": "https://bugzilla.suse.com/1263442"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-pip-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-pip-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-25.0.1-160000.4.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-pip-wheel-25.0.1-160000.4.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-02T13:37:13Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-6357"
    }
  ]
}