pip (20.2.4-9) stable; urgency=medium

  * SECURITY UPDATE: directory escape via Link.filename decoding the URL path twice
    - debian/patches/CVE-2026-13346.patch: decode the URL path once and reduce the
      file name to a single path component
    - CVE-2026-13346

 -- Davit Sargsyan <dsargsyan@cloudlinux.com>  Mon, 24 Aug 2026 15:30:00 -0400

pip (20.2.4-8) stable; urgency=medium

  * SECURITY UPDATE: option injection via Mercurial revision passed as a bare argument
    - debian/patches/CVE-2023-5752.patch: pass the revision as --rev=<rev> so it
      cannot be interpreted as an hg option
    - CVE-2023-5752
  * SECURITY UPDATE: arbitrary file write via unchecked symlink targets in tar extraction
    - debian/patches/CVE-2025-8869.patch: reject symlink members whose target is
      absent from the archive or resolves outside the destination directory
    - CVE-2025-8869
  * SECURITY UPDATE: path traversal via sibling-prefix directory containment check
    - debian/patches/CVE-2026-1703.patch: compare whole path components instead of
      using os.path.commonprefix
    - CVE-2026-1703
  * SECURITY UPDATE: archive format confusion for files matching both zip and tar signatures
    - debian/patches/CVE-2026-3219.patch: order format detection by confidence and
      refuse archives with an ambiguous signature
    - CVE-2026-3219
  * SECURITY UPDATE: arbitrary file write via entry point name escaping the scripts directory
    - debian/patches/CVE-2026-8643.patch: reject console script names that do not
      resolve inside the scripts directory
    - CVE-2026-8643

 -- Viktor Borzov <vborzov@cloudlinux.com>  Thu, 30 Jul 2026 12:20:00 -0400

pip (20.2.4-7) stable; urgency=medium

  * SECURITY UPDATE: Fix revision hijacking via unicode separators in git references
    - debian/patches/CVE-2021-3572.patch: Fix revision hijacking via unicode separators in git references
    - CVE-2021-3572

 -- Juan-Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 27 Jul 2026 12:10:00 +0000

pip (20.2.4-6) stable; urgency=medium

  * ALTPYTH-560: Initial build.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 23 Jul 2025 13:20:00 +0300
