جزئیات آسیب‌پذیری
CVE-2026-24049
Red Hat Logging Subsystem for Red Hat OpenShiftRed Hat Migration Toolkit for VirtualizationRed Hat OpenShift LightspeedRed Hat AI Inference ServerRed Hat Advanced Cluster Security 4Red Hat Ansible Automation Platform 2
wheel Allows Arbitrary File Permission Modification via Path Traversal
CVSS 3.1
7.1بالا
شرح رسمی (انگلیسی)
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.1بالا | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H |
| 7.1بالا | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Migration Toolkit for Virtualization | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Migration Toolkit for Virtualization | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Security 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 6 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Dev Spaces | همه | CVEProject cvelistV5 (CNA) |
| pypa | wheel | >= 0.40.0, < 0.46.2 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۵۰- https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx x_refsource_CONFIRM
- https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef x_refsource_MISC
- https://github.com/pypa/wheel/releases/tag/0.46.2 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-24049 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2431959 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24049.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:2823 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3959 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3958 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2090 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2866 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2710 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1939 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2865 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1902 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2900 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:61628 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3461 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3462 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3960 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13545 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62115 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2675 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2694 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10184 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2695 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2106 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3782 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19712 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3713 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5119 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20089 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17599 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6555 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7250 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6565 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6562 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6192 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14020 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2762 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4942 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4185 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4215 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1942 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2681 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2754 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1504 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2925 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4271 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2139 vendor-advisoryx_refsource_REDHAT
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۱۱/۰۲
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۲۵
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
۰٫۳۵٪
احتمال بهره‌برداری در ۳۰ روز
۲۸٫۸٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- اثبات مفهوم
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-732Incorrect Permission Assignment for Critical Resource
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')