Amazon Linux 2023 Security Advisory: ALAS2023-2026-1838
Advisory Released Date: 2026-06-22
Advisory Updated Date: 2026-06-22
Severity:
Important
Issue Overview:
A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution. (CVE-2026-8643)
Affected Packages:
python3.14-pip
Issue Correction:
Run dnf update python3.14-pip --releasever 2023.12.20260622 or dnf update --advisory ALAS2023-2026-1838 --releasever 2023.12.20260622 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
noarch:
python3.14-pip-wheel-26.1.1-1.amzn2023.0.2.noarch
python3.14-pip-26.1.1-1.amzn2023.0.2.noarch
src:
python3.14-pip-26.1.1-1.amzn2023.0.2.src