已开启
Fix CVE-2025-47273: path traversal vulnerability in PackageIndex #86
nebd创建于 7月15日
Fix CVE-2025-47273: path traversal vulnerability in PackageIndex #86
已开启
共 2 个文件变更+42-1
| @@ -0,0 +1,38 @@ | |||
| 1 | +From 250a6d17978f9f6ac3ac887091f2d32886fbbb0b Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: shaojiansong <shaojiansong@kylinos.cn> | ||
| 3 | +Date: Wed, 15 Jul 2026 15:20:07 +0800 | ||
| 4 | +Origin: https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b | ||
| 5 | +Issue: https://atomgit.com/src-openeuler/python-setuptools/issues/17 | ||
| 6 | +Subject: [PATCH] Add a check to ensure the name resolves relative to the | ||
| 7 | + tmpdir. | ||
| 8 | + | ||
| 9 | +Closes #4946 | ||
| 10 | + | ||
| 11 | +Fixes CVE-2025-47273 | ||
| 12 | +--- | ||
| 13 | + setuptools/package_index.py | 9 ++++++++- | ||
| 14 | + 1 file changed, 8 insertions(+), 1 deletion(-) | ||
| 15 | + | ||
| 16 | +diff --git a/setuptools/package_index.py b/setuptools/package_index.py | ||
| 17 | +index 3500c2d..e446333 100644 | ||
| 18 | +--- a/setuptools/package_index.py | ||
| 19 | ++++ b/setuptools/package_index.py | ||
| 20 | + class PackageIndex(Environment): | ||
| 21 | + # strip any extra .zip before download | ||
| 22 | + name = re.sub(r'\.egg\.zip$', '.egg', name) | ||
| 23 | + | ||
| 24 | +- return os.path.join(tmpdir, name) | ||
| 25 | ++ | ||
| 26 | ++ filename = os.path.join(tmpdir, name) | ||
| 27 | ++ | ||
| 28 | ++ # ensure path resolves within the tmpdir | ||
| 29 | ++ if not filename.startswith(str(tmpdir)): | ||
| 30 | ++ raise ValueError(f"Invalid filename {filename}") | ||
| 31 | ++ | ||
| 32 | ++ return filename | ||
| 33 | + | ||
| 34 | + def _download_url(self, url, tmpdir): | ||
| 35 | + """ | ||
| 36 | +-- | ||
| 37 | +2.40.0.windows.1 | ||
| 38 | + | ||
| @@ -8,7 +8,7 @@ | |||
| 8 | 8 | ||
| 9 | Name: python-setuptools | 9 | Name: python-setuptools |
| 10 | Version: 78.1.1 | 10 | Version: 78.1.1 |
| 11 | -Release: 6 | 11 | +Release: 7 |
| 12 | Summary: Easily build and distribute Python packages | 12 | Summary: Easily build and distribute Python packages |
| 13 | 13 | ||
| 14 | License: MIT AND Apache-2.0 AND (BSD-2-Clause OR Apache-2.0) AND Python-2.0 AND LGPL-3.0-only | 14 | License: MIT AND Apache-2.0 AND (BSD-2-Clause OR Apache-2.0) AND Python-2.0 AND LGPL-3.0-only |
| @@ -16,6 +16,7 @@ URL: https://pypi.python.org/pypi/setuptools | |||
| 16 | Source0: %{pypi_source setuptools %{version}} | 16 | Source0: %{pypi_source setuptools %{version}} |
| 17 | Patch1: Revert-Always-rewrite-a-Python-shebang-to-python.patch | 17 | Patch1: Revert-Always-rewrite-a-Python-shebang-to-python.patch |
| 18 | Patch2: backport-CVE-2026-59890.patch | 18 | Patch2: backport-CVE-2026-59890.patch |
| 19 | +Patch3: backport-CVE-2025-47273.patch | ||
| 19 | 20 | ||
| 20 | BuildArch: noarch | 21 | BuildArch: noarch |
| 21 | 22 | ||
| @@ -108,6 +109,8 @@ PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=$(pwd) py.test-%{python3_version} --ignore= | |||
| 108 | 109 | ||
| 109 | 110 | ||
| 110 | %changelog | 111 | %changelog |
| 112 | +* 周三 7月 15 2026 shaojiansong <shaojiansong@kylinos.cn> - 78.1.1-7 | ||
| 113 | +- Fix CVE-2025-47273: path traversal vulnerability in PackageIndex | ||
| 111 | * Fri Jul 10 2026 markeryang <747675909@qq.com> - 78.1.1-6 | 114 | * Fri Jul 10 2026 markeryang <747675909@qq.com> - 78.1.1-6 |
| 112 | - Fix CVE-2026-59890 | 115 | - Fix CVE-2026-59890 |
| 113 | 116 | ||