The Python wheel command line tool versions 0.40.0 through 0.46.1 contain a path traversal vulnerability in the unpack function. This flaw arises because the logic blindly trusts filenames from the archive header when applying chmod operations, despite the extraction process potentially sanitizing paths. An attacker can craft a malicious wheel file that, when unpacked, changes permissions on critical system files such as /etc/passwd or SSH keys. This improper limitation of pathname to a restricted directory (CWE-22) can enable privilege escalation or arbitrary code execution by making sensitive scripts writable. The vulnerability has been addressed and fixed in version 0.46.2. Red Hat has issued advisories and released updated packages to remediate this issue.

Successful exploitation allows an attacker to modify file permissions of critical system files, potentially leading to privilege escalation or arbitrary code execution. The attacker can make sensitive scripts writable, bypassing security mechanisms. The integrity and availability of the system can be compromised by overwriting or corrupting important files. Confidentiality may also be impacted if sensitive files are exposed or modified. The CVSS v3.1 score is 7.1 (high severity) with local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on integrity and availability.

A fix is available in Python wheel version 0.46.2. Users should upgrade to this version or later to remediate the vulnerability. Red Hat has released updated discovery-cli packages (version 2.4.3) containing the fix for affected Red Hat Enterprise Linux versions. There are no effective mitigations that meet Red Hat's criteria other than applying the official fix. Users should apply the vendor-provided patches or updates promptly.