Amazon Linux 2023 Security Advisory: ALAS2023-2026-1490
Advisory Released Date: 2026-03-25
Advisory Updated Date: 2026-03-25
Severity:
Low
Issue Overview:
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations. (CVE-2026-1703)
Affected Packages:
python3.13-pip
Issue Correction:
Run dnf update python3.13-pip --releasever 2023.10.20260316 or dnf update --advisory ALAS2023-2026-1490 --releasever 2023.10.20260316 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
noarch:
python3.13-pip-wheel-24.2-259.amzn2023.0.4.noarch
python3.13-pip-24.2-259.amzn2023.0.4.noarch
src:
python3.13-pip-24.2-259.amzn2023.0.4.src