Skip to content
Heist/ feed
UnratedFix available

DEBIAN-CVE-2026-3219

Type: advisorySource: OSV1 source record

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-3219

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-3219

python-pip

Source reference: /affected/0/package/name

Affected versions
23.0.1+dfsg-1

Source reference: /affected/0/versions

23.1.2+dfsg-1

Source reference: /affected/0/versions

23.1.2+dfsg-2

Source reference: /affected/0/versions

23.2+dfsg-1

Source reference: /affected/0/versions

23.2.1+dfsg-1

Source reference: /affected/0/versions

23.3+dfsg-1

Source reference: /affected/0/versions

24.0+dfsg-1

Source reference: /affected/0/versions

24.0+dfsg-2

Source reference: /affected/0/versions

24.1+dfsg-1

Source reference: /affected/0/versions

24.1.1+dfsg-1

Source reference: /affected/0/versions

24.2+dfsg-1

Source reference: /affected/0/versions

24.3.1+dfsg-1

Source reference: /affected/0/versions

25.0+dfsg-1

Source reference: /affected/0/versions

25.0.1+dfsg-1

Source reference: /affected/0/versions

25.1+dfsg-1

Source reference: /affected/0/versions

25.1.1+dfsg-1

Source reference: /affected/0/versions

25.2+dfsg-1

Source reference: /affected/0/versions

25.3+dfsg-1

Source reference: /affected/0/versions

26.0+dfsg-1

Source reference: /affected/0/versions

26.0.1+dfsg-1

Source reference: /affected/0/versions

26.1.1+dfsg-1

Source reference: /affected/0/versions

26.1.2+dfsg-1

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

python-pip

Source reference: /affected/1/package/name

Affected versions
25.1.1+dfsg-1

Source reference: /affected/1/versions

25.2+dfsg-1

Source reference: /affected/1/versions

25.3+dfsg-1

Source reference: /affected/1/versions

26.0+dfsg-1

Source reference: /affected/1/versions

26.0.1+dfsg-1

Source reference: /affected/1/versions

26.1.1+dfsg-1

Source reference: /affected/1/versions

26.1.2+dfsg-1

Source reference: /affected/1/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

python-pip

Source reference: /affected/2/package/name

Affected versions
25.1.1+dfsg-1

Source reference: /affected/2/versions

25.2+dfsg-1

Source reference: /affected/2/versions

25.3+dfsg-1

Source reference: /affected/2/versions

26.0+dfsg-1

Source reference: /affected/2/versions

26.0.1+dfsg-1

Source reference: /affected/2/versions

Fixed versions
26.1.1+dfsg-1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "python-pip",
      "purl": "pkg:deb/debian/python-pip?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "23.0.1+dfsg-1",
      "23.1.2+dfsg-1",
      "23.1.2+dfsg-2",
      "23.2+dfsg-1",
      "23.2.1+dfsg-1",
      "23.3+dfsg-1",
      "24.0+dfsg-1",
      "24.0+dfsg-2",
      "24.1+dfsg-1",
      "24.1.1+dfsg-1",
      "24.2+dfsg-1",
      "24.3.1+dfsg-1",
      "25.0+dfsg-1",
      "25.0.1+dfsg-1",
      "25.1+dfsg-1",
      "25.1.1+dfsg-1",
      "25.2+dfsg-1",
      "25.3+dfsg-1",
      "26.0+dfsg-1",
      "26.0.1+dfsg-1",
      "26.1.1+dfsg-1",
      "26.1.2+dfsg-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3219.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "python-pip",
      "purl": "pkg:deb/debian/python-pip?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "25.1.1+dfsg-1",
      "25.2+dfsg-1",
      "25.3+dfsg-1",
      "26.0+dfsg-1",
      "26.0.1+dfsg-1",
      "26.1.1+dfsg-1",
      "26.1.2+dfsg-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3219.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "26.1.1+dfsg-1"
          }
        ]
      }
    ],
    "package": {
      "name": "python-pip",
      "purl": "pkg:deb/debian/python-pip?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "25.1.1+dfsg-1",
      "25.2+dfsg-1",
      "25.3+dfsg-1",
      "26.0+dfsg-1",
      "26.0.1+dfsg-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3219.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#56751 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement