已开启
fix(cve): 修复 CVE-2026-8643 在 python-pip 中的漏洞 #257
fix(cve): 修复 CVE-2026-8643 在 python-pip 中的漏洞 #257
已开启
infra_team创建于 6月3日
infra_team
6月3日

当前PR是否有AI参与:

[ ] 否

[x] Yes
__1. AI Agent 平台: Claude Code / CVE Agent Team
__2. AI 模型 : claude-sonnet-4-6
__3. Prompt 上下文 : CVE 漏洞修复全流程:归属分析、修复方案设计(backport/upgrade)、patch 生成、SPEC 文件修改(Patch/Version/Release/Changelog)、本地构建验证(rpmbuild -bp)

PR功能描述 / 为什么需要这个合入:

  • 🔍 全量审计声明:本项目已基于上游主分支执行全量补丁审计
  • CVE: CVE-2026-8643
  • 策略:backport
  • 改动详情:
    • 新增 backport-CVE-2026-8643.patch,修复 pip console_scripts/gui_scripts 入口点安装路径逃逸漏洞(CWE-22,路径遍历)
    • 更新 python-pip.spec,添加 Patch 引用及 Changelog 条目

该PR关联的issue

(格式为fixes #<issue号>, 或者resolves #<issue号>): fixes #158

希望检视人员了解:

likedislike
合并受阻
Iinfra_team
6月3日 创建了 pull request,commit f88bf9f7
Iinfra_team
6月3日 关联了issue:CVE-2026-8643
openeuler-ci-botopeneuler-ci-bot成员
6月3日 添加了label:openeuler-cla/yes
openeuler-ci-bot
openeuler-ci-bot成员
6月3日 评论:

门禁正在运行, 您可以通过以下链接查看实时门禁检查结果.
若您对门禁结果含义不清晰或者遇到问题不知如何解决,可参考门禁指导手册
门禁入口及编码规范检查: multiarch/src-openeuler/trigger/python-pip/47/console

likedislike
openeuler-ci-botopeneuler-ci-bot成员
6月3日 添加了label:ci_processing
openeuler-ci-botopeneuler-ci-bot成员
6月3日 将licihua,dillon_chen,overweight,zhujianwei001,shenyangyang设为审查人
openeuler-ci-botopeneuler-ci-bot成员
6月3日 添加了label:sig/Base-service
openeuler-ci-bot
openeuler-ci-bot成员
6月3日 评论:

Welcome To openEuler Community

Hey @infra_team , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

Contact Guide

If you have any questions, please contact the SIG: Base-service ,
and any of the maintainers: @dillon_chen, @licihua, @overweight, @shenyangyang, @zhujianwei001 ,
and any of the committers: @yangyuan32, @zhuchunyi .

likedislike
openeuler-ci-botopeneuler-ci-bot成员
6月3日 添加了label:ai-co-authored
openeuler-ci-bot
openeuler-ci-bot成员
6月3日 评论:

当前仓库存在以下 保护分支 :

Protected Branch Version Release
master 23.3.1 11
openEuler-22.03-LTS-SP4 21.3.1 16
openEuler-20.03-LTS-SP4 20.2.2 17
openEuler-24.03-LTS-SP1 23.3.1 11
openEuler-24.03-LTS-SP4 23.3.1 11
openEuler-24.03-LTS-Next 23.3.1 11
openEuler-24.03-LTS-SP3 23.3.1 11
Multi-Version_OpenStack-Wallaby_openEuler-22.03-LTS-Next 20.3.3 4
patch-tracking/20210103065849753943 20.2.2 4
patch-tracking/20210102215849754068 20.2.2 4
patch-tracking/20210102185849754628 20.2.2 4
patch-tracking/20210102025849754649 20.2.2 4
patch-tracking/20201230035849754080 20.2.2 4
patch-tracking/20201229175849755199 20.2.2 4
patch-tracking/20201229165849754542 20.2.2 4
patch-tracking/20201229065849754762 20.2.2 4
patch-tracking/20201228155849754502 20.2.2 4
patch-tracking/20201228025849754267 20.2.2 4
patch-tracking/20201228015849753395 20.2.2 4
patch-tracking/20201227235849754564 20.2.2 4
patch-tracking/20201227205849754513 20.2.2 4
patch-tracking/20201227195849753685 20.2.2 4
patch-tracking/20201227005849754791 20.2.2 4
patch-tracking/20201226185849754648 20.2.2 4
patch-tracking/20201226175849753759 20.2.2 4
patch-tracking/20201226035849754498 20.2.2 4
patch-tracking/20201225185849754344 20.2.2 4
patch-tracking/20201225025849753874 20.2.2 4
patch-tracking/20201224165849756204 20.2.2 4
patch-tracking/20201224015849754669 20.2.2 4
patch-tracking/20201223195849756468 20.2.2 4
patch-tracking/20201221025849753945 20.2.2 4
patch-tracking/20201220105849756063 20.2.2 4
patch-tracking/20201218235849755633 20.2.2 4
patch-tracking/20201215235849753546 20.2.2 4
patch-tracking/20201215225849754007 20.2.2 4
patch-tracking/20201215185849754891 20.2.2 4
patch-tracking/20201215095849755409 20.2.2 4
patch-tracking/20201215045849754838 20.2.2 4
patch-tracking/20201214225849754386 20.2.2 4
patch-tracking/20201212205849754254 20.2.2 4
patch-tracking/20201212055849756634 20.2.2 4
patch-tracking/20201209205849754911 20.2.2 4
patch-tracking/20201208205849756098 20.2.2 4
patch-tracking/20201208145849754962 20.2.2 4
patch-tracking/20201203215849755722 20.2.2 4
patch-tracking/20201203175849753936 20.2.2 4
patch-tracking/20201202085849753896 20.2.2 4
patch-tracking/20201130205849754646 20.2.2 4
patch-tracking/20201130055849755450 20.2.2 4
patch-tracking/20201130035849754506 20.2.2 4
patch-tracking/20201129045849754147 20.2.2 4
patch-tracking/20201127173007638817 20.2.2 4
patch-tracking/20201126183007639649 20.2.2 4
patch-tracking/20201123193007640242 20.2.2 4
patch-tracking/20201123063007638028 20.2.2 4
patch-tracking/20201122003007639392 20.2.2 4
patch-tracking/20201120213007643685 20.2.2 4
patch-tracking/20201120203007637843 20.2.2 4
patch-tracking/20201120023007638765 20.2.2 4
patch-tracking/20201119183007636686 20.2.2 4
patch-tracking/20201115033007638628 20.2.2 4
patch-tracking/20201115023007641064 20.2.2 4
patch-tracking/20201114203007638671 20.2.2 4
patch-tracking/20201114073007638399 20.2.2 4
patch-tracking/20201114053007640007 20.2.2 4
patch-tracking/20201110213007639671 20.2.2 4
patch-tracking/20201109063007638942 20.2.2 4
patch-tracking/20201103193007638690 20.2.2 3
patch-tracking/20201101033007638063 20.2.2 3
patch-tracking/20201101023007638760 20.2.2 3
patch-tracking/20201031183007637838 20.2.2 3
patch-tracking/20201031173007637825 20.2.2 3
patch-tracking/20201031033007637601 20.2.2 3
patch-tracking/20201031023007637049 20.2.2 3
patch-tracking/20201030183007637746 20.2.2 3
patch-tracking/20201030083007637392 20.2.2 3
patch-tracking/20201030023007654763 20.2.2 3
patch-tracking/20201029073007637383 20.2.2 3
patch-tracking/20201028213007638385 20.2.2 3
patch-tracking/20201028163007637678 20.2.2 3
patch-tracking/20201028023007638464 20.2.2 3
patch-tracking/20201028013007637914 20.2.2 3
patch-tracking/20201028003007637706 20.2.2 3
patch-tracking/20201027223007638441 20.2.2 3
patch-tracking/20201027073007637630 20.2.2 3
patch-tracking/20201026213007637562 20.2.2 3
patch-tracking/20201026123007637457 20.2.2 3
patch-tracking/20201019223007639380 20.2.2 3
patch-tracking/20201018063007637934 20.2.2 3
patch-tracking/20201014092337225111 20.2.2 3
patch-tracking/20201014082337224858 20.2.2 3
patch-tracking/20201014072337224082 20.2.2 3
patch-tracking/20201014062337224912 20.2.2 3
patch-tracking/20201014052337224554 20.2.2 3
patch-tracking/20201014042337224652 20.2.2 3
patch-tracking/20201014032337224412 20.2.2 3
patch-tracking/20201014022337224354 20.2.2 3
patch-tracking/20201014012337224479 20.2.2 3
patch-tracking/20201014002337225130 20.2.2 3
patch-tracking/20201013232337224234 20.2.2 3
patch-tracking/20201013222337227482 20.2.2 3
openEuler1.0-base 18.0 11
openEuler1.0 18.0 11

评论 /sync <branch1> <branch2> ... 可将当前 PR 修改同步到其它分支(创建同步 PR):
a) 如果当前 PR 是 Open 状态,同步操作将延迟到 PR 被合并时执行
b) 如果当前 PR 已经 Merged,将立即执行同步操作

注意:

  1. /sync 命令可以指定同步到多个分支,仅最后一个 /sync 命令生效
  2. 如果创建的同步 PR 不正确,可通过向同步 PR 的源分支提交轻量级 PR 完善,或使用 /close 命令关闭
likedislike
openeuler-ci-bot
openeuler-ci-bot成员
6月3日 评论:

aarch64架构构建及构建后检查:multiarch/src-openeuler/aarch64/python-pip/47/console

likedislike
openeuler-ci-bot
openeuler-ci-bot成员
6月3日 评论:

x86_64架构构建及构建后检查:multiarch/src-openeuler/x86-64/python-pip/47/console

likedislike
openeuler-ci-botopeneuler-ci-bot成员
6月3日 删除了label:ci_processing
openeuler-ci-bot
openeuler-ci-bot成员
6月3日 评论:
Check Name Build Result Build Details
check_binary_file ✅SUCCESS #47
check_package_yaml_file ✅SUCCESS
check_repo_in_maintain ✅SUCCESS
check_consistency ✅SUCCESS
check_spec_file ❌FAILED
x86_64 check_build ❌FAILED #47
aarch64 check_build ❌FAILED #47
likedislike
openeuler-ci-botopeneuler-ci-bot成员
6月3日 添加了label:ci_failed
openeuler-ci-bot
openeuler-ci-bot成员
6月3日 评论:
likedislike
Iinfra_team
6月3日 virtual merging failed, update merge request[project_id: 7691798, iid: 257, target_commit_sha: 354071023f6520ef2af1982edd64d3741d3afa4e], message: Conflict detected
此处折叠了7条事件消息 查看更多
Iinfra_team
6月3日 预合并成功(commit_id: aec569cb6a1ddcb0cc3257dbc750ea656ac25d10)
openeuler-ci-bot
openeuler-ci-bot成员
6月3日 评论:

CLA Signature Pass

infra_team, thanks for your pull request. All authors of the commits have signed the CLA. 👍

likedislike
openeuler-ci-bot
openeuler-ci-bot成员
6月3日 评论:

门禁正在运行, 您可以通过以下链接查看实时门禁检查结果.
若您对门禁结果含义不清晰或者遇到问题不知如何解决,可参考门禁指导手册
门禁入口及编码规范检查: multiarch/src-openeuler/trigger/python-pip/56/console

likedislike
openeuler-ci-botopeneuler-ci-bot成员
6月3日 删除了label:ci_failed
openeuler-ci-botopeneuler-ci-bot成员
6月3日 添加了label:ci_processing
openeuler-ci-bot
openeuler-ci-bot成员
6月3日 评论:

aarch64架构构建及构建后检查:multiarch/src-openeuler/aarch64/python-pip/56/console

likedislike
openeuler-ci-bot
openeuler-ci-bot成员
6月3日 评论:

x86_64架构构建及构建后检查:multiarch/src-openeuler/x86-64/python-pip/56/console

likedislike
openeuler-ci-botopeneuler-ci-bot成员
6月3日 删除了label:ci_processing
openeuler-ci-bot
openeuler-ci-bot成员
6月3日 评论:
Check Name Build Result Build Details
check_binary_file ✅SUCCESS #56
check_package_yaml_file ✅SUCCESS
check_repo_in_maintain ✅SUCCESS
check_consistency ✅SUCCESS
check_spec_file ❌FAILED
x86_64 check_build ✅SUCCESS #56
check_install ✅SUCCESS
check_license ✅SUCCESS
aarch64 check_build ✅SUCCESS #56
check_install ❌FAILED
check_license ✅SUCCESS
likedislike
openeuler-ci-botopeneuler-ci-bot成员
6月3日 添加了label:ci_failed
openeuler-ci-bot
openeuler-ci-bot成员
6月3日 评论:
likedislike