René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Rebuild Request: `python:3.10-alpine` — CVE-2026-23949 \u0026 CVE-2026-24049 (HIGH/CRITICAL)","articleBody":"## Rebuild Request: `python:3.10-alpine` — CVE-2026-23949 \u0026 CVE-2026-24049 (HIGH/CRITICAL)\n\n### Summary\n\nThe current `python:3.10-alpine` image ships with outdated versions of `jaraco.context` and `wheel` that contain known, **fixed** vulnerabilities. A rebuild is needed to pick up the patched versions.\n\nBoth CVEs have fixed versions available and this should be resolved by a simple image rebuild.\n\n---\n\n### Affected Image\n\n`python:3.10-alpine`\n\n---\n\n### Vulnerabilities\n\n| Library | CVE | Severity | Installed Version | Fixed Version | Description |\n|---|---|---|---|---|---|\n| `jaraco.context` | CVE-2026-23949 | HIGH | 5.3.0 | 6.1.0 | Path traversal via malicious tar archives |\n| `wheel` | CVE-2026-24049 | HIGH | 0.45.1 | 0.46.2 | Privilege escalation or arbitrary code execution via malicious wheel file |\n\nReferences:\n- https://avd.aquasec.com/nvd/cve-2026-23949\n- https://avd.aquasec.com/nvd/cve-2026-24049\n\n---\n\n### Impact\n\nThese vulnerabilities are being flagged as **Critical** by JFrog Xray, blocking our CI/CD pipeline builds. The fixes are already available upstream — this requires only an image rebuild to pull in the updated package versions.\n\n---\n","author":{"url":"https://github.com/tpickle-py","@type":"Person","name":"tpickle-py"},"datePublished":"2026-02-20T00:57:52.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/1112/python/issues/1112"}