Pull Request has been successfully merged by openeuler-ci-bot.
（Thank you for Liuhuiooo's contribution.）
当前仓库存在以下 保护分支 ：
| Protected Branch | Version | Release |
|---|---|---|
| master | 20260107 | 1 |
| openEuler-24.03-LTS-SP4 | 20231228 | 3 |
| openEuler-24.03-LTS-Next | 20231228 | 3 |
| openEuler-24.03-LTS-SP3 | 20231228 | 2 |
| openEuler-24.03-LTS-SP1 | 20231228 | 2 |
评论 /sync <branch1> <branch2> ... 可将当前 PR 修改同步到其它分支（创建同步 PR）：
a) 如果当前 PR 是 Open 状态，同步操作将延迟到 PR 被合并时执行
b) 如果当前 PR 已经 Merged，将立即执行同步操作
注意：
- /sync 命令可以指定同步到多个分支，仅最后一个 /sync 命令生效
- 如果创建的同步 PR 不正确，可通过向同步 PR 的源分支提交轻量级 PR 完善，或使用 /close 命令关闭
Welcome To openEuler Community
Hey @Liuhuiooo , thanks for your contribution to the community.
Bot Usage Manual
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.
Contact Guide
If you have any questions, please contact the SIG: sig-python-modules ,
and any of the maintainers: @shinwell_hu, @yangzhao_kl ,
and any of the committers: @desert-sailor .
门禁正在运行， 您可以通过以下链接查看实时门禁检查结果.
若您对门禁结果含义不清晰或者遇到问题不知如何解决，可参考门禁指导手册
门禁入口及编码规范检查: multiarch/src-openeuler/trigger/python-pdfminer.six/5/console
aarch64架构构建及构建后检查：multiarch/src-openeuler/aarch64/python-pdfminer.six/5/console
x86_64架构构建及构建后检查：multiarch/src-openeuler/x86-64/python-pdfminer.six/5/console
门禁正在运行， 您可以通过以下链接查看实时门禁检查结果.
若您对门禁结果含义不清晰或者遇到问题不知如何解决，可参考门禁指导手册
门禁入口及编码规范检查: multiarch/src-openeuler/trigger/python-pdfminer.six/6/console
| Check Name | Build Result | Build Details | |
|---|---|---|---|
| check_binary_file | ✅SUCCESS | #5 | |
| check_lfsconfig | ☑️EXCLUDE | ||
| check_package_yaml_file | ✅SUCCESS | ||
| check_repo_in_maintain | ✅SUCCESS | ||
| check_consistency | ✅SUCCESS | ||
| check_spec_file | ❌FAILED | ||
| x86_64 | check_build | ✅SUCCESS | #5 |
| check_install | ✅SUCCESS | ||
| check_license | ✅SUCCESS | ||
| aarch64 | check_build | ❌FAILED | #5 |
x86_64架构构建及构建后检查：multiarch/src-openeuler/x86-64/python-pdfminer.six/6/console
aarch64架构构建及构建后检查：multiarch/src-openeuler/aarch64/python-pdfminer.six/6/console
| Check Name | Build Result | Build Details | |
|---|---|---|---|
| check_binary_file | ✅SUCCESS | #6 | |
| check_lfsconfig | ☑️EXCLUDE | ||
| check_package_yaml_file | ✅SUCCESS | ||
| check_repo_in_maintain | ✅SUCCESS | ||
| check_consistency | ✅SUCCESS | ||
| check_spec_file | ✅SUCCESS | ||
| x86_64 | check_build | ✅SUCCESS | #6 |
| check_install | ✅SUCCESS | ||
| check_license | ✅SUCCESS | ||
| aarch64 | check_build | ✅SUCCESS | #6 |
| check_install | ✅SUCCESS | ||
| check_license | ✅SUCCESS | ||
如下为接口变更检查结果，目标分支为openEuler-24.03-LTS-SP3，请PR提交者check差异信息
| Arch Name | Check Items | Rpm Name | Check Result | Build Details |
|---|---|---|---|---|
| compare_package(x86_64) | add_rpms | ✅SUCCESS | #6 | |
| delete_rpms | ✅SUCCESS | |||
| rpm_cmd | ✅SUCCESS | |||
| rpm_files | ✅SUCCESS | |||
| rpm_provides | ✅SUCCESS | |||
| rpm_requires | ✅SUCCESS | |||
| compare_package(aarch64) | add_rpms | ✅SUCCESS | #6 | |
| delete_rpms | ✅SUCCESS | |||
| rpm_cmd | ✅SUCCESS | |||
| rpm_files | ✅SUCCESS | |||
| rpm_provides | ✅SUCCESS | |||
| rpm_requires | ✅SUCCESS |
Hi @shinwell_hu @yangzhao_kl, sorry to bother. This CVE fix has passed CLA/CI and is mergeable now. Could you please help review it when you have time? Please let me know if any adjustment is needed. Thanks!
/lgtm
/approve
openeuler-ci-bot
/sync openEuler-24.03-LTS-SP1
In response to this:
/sync openEuler-24.03-LTS-SP1
同步操作执行结果:
| Branch | Status | Pull Request |
|---|---|---|
| openEuler-24.03-LTS-SP1 | 创建同步 PR | https://gitcode.com/src-openeuler/python-pdfminer.six/merge_requests/29 |
Fix CVE-2025-64512 (arbitrary code execution via malicious pickle font file, CVSS 8.6 High) in python-pdfminer.six on openEuler-24.03-LTS-SP3 (pdfminer.six 20231228).
CMapDB._load_data builds the cmap path as os.path.join(directory, name + '.pickle.gz') where name comes from the PDF, so a malicious CMapName with path traversal loads an attacker-controlled pickle file -> RCE via pickle.loads. Reuses the exact patch openEuler already reviewed and merged for the same pdfminer.six 20231228 on openEuler-24.03-LTS-SP4 / Next: resolve paths with realpath and skip any that escape the cmap directory. openEuler-24.03-LTS-SP3 ships the identical 20231228 but was missing this fix.
Verified locally on pdfminer.six 20231228: a malicious cmap name with ../ traversal loads a crafted pickle and executes os.system before the patch; after the patch the traversal path is skipped (CMapNotFound) and no code runs.