Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python314 for openSUSE:Factory checked in at 2026-07-22 19:00:51 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python314 (Old) and /work/SRC/openSUSE:Factory/.python314.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python314" Wed Jul 22 19:00:51 2026 rev:38 rq:1365776 version:3.14.6 Changes: -------- --- /work/SRC/openSUSE:Factory/python314/python314.changes 2026-07-02 20:07:59.082325018 +0200 +++ /work/SRC/openSUSE:Factory/.python314.new.24530/python314.changes 2026-07-22 19:00:53.956402621 +0200 @@ -1,0 +2,7 @@ +Wed Jul 1 23:10:26 UTC 2026 - Matej Cepl <[email protected]> + +- CVE-2026-11940: fix the symlink escape via tarfile + hardlink-extraction fallback (bsc#1268977) + CVE-2026-11940-tarfile-escape.patch + +------------------------------------------------------------------- New: ---- CVE-2026-11940-tarfile-escape.patch ----------(New B)---------- New: hardlink-extraction fallback (bsc#1268977) CVE-2026-11940-tarfile-escape.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python314.spec ++++++ --- /var/tmp/diff_new_pack.shufhh/_old 2026-07-22 19:00:55.480454740 +0200 +++ /var/tmp/diff_new_pack.shufhh/_new 2026-07-22 19:00:55.484454877 +0200 @@ -240,6 +240,9 @@ # PATCH-FIX-OPENSUSE bsc1260884-llvm21-support.patch bsc#1260884 [email protected] # update JIT builds to use LLVM 21 Patch57: bsc1260884-llvm21-support.patch +# PATCH-FIX-UPSTREAM CVE-2026-11940-tarfile-escape.patch bsc#1268977 [email protected] +# Fix symlink escape via tarfile hardlink-extraction fallback +Patch58: CVE-2026-11940-tarfile-escape.patch #### Python 3.14 END OF PATCHES BuildRequires: autoconf-archive BuildRequires: automake ++++++ CVE-2026-11940-tarfile-escape.patch ++++++ >From 6b66c843887161f1e82c61c9e9489ba7cf5d36cf Mon Sep 17 00:00:00 2001 From: Stan Ulbrych <[email protected]> Date: Tue, 23 Jun 2026 14:31:38 +0100 Subject: [PATCH] gh-151558: Fix symlink escape via `tarfile` hardlink-extraction fallback (GH-151559) (cherry picked from commit 27dd970bf6b17ebca7c8ed486a40ab043ed7af8f) Co-authored-by: Stan Ulbrych <[email protected]> --- Lib/tarfile.py | 3 +++ Lib/test/test_tarfile.py | 24 +++++++++++++++++++ ...-06-10-13-08-19.gh-issue-151558.mL74i2.rst | 3 +++ 3 files changed, 30 insertions(+) create mode 100644 Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst diff --git a/Lib/tarfile.py b/Lib/tarfile.py index e6734db24f642e8..63f23490e8a149e 100644 --- a/Lib/tarfile.py +++ b/Lib/tarfile.py @@ -2782,6 +2782,9 @@ def makelink_with_filter(self, tarinfo, targetpath, "makelink_with_filter: if filter_function is not None, " + "extraction_root must also not be None") try: + filter_function( + unfiltered.replace(name=tarinfo.name, deep=False), + extraction_root) filtered = filter_function(unfiltered, extraction_root) except _FILTER_ERRORS as cause: raise LinkFallbackError(tarinfo, unfiltered.name) from cause diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py index d974c7d46ec18c0..0fc7413be8db28c 100644 --- a/Lib/test/test_tarfile.py +++ b/Lib/test/test_tarfile.py @@ -4344,6 +4344,30 @@ def test_sneaky_hardlink_fallback(self): self.expect_file("boom", symlink_to='../../link_here') self.expect_file("c", symlink_to='b') + @symlink_test + def test_sneaky_hardlink_fallback_deep(self): + # (CVE-2026-11940) + with ArchiveMaker() as arc: + arc.add("a/b/s", symlink_to=os.path.join("..", "escape")) + arc.add("s", hardlink_to=os.path.join("a", "b", "s")) + + with self.check_context(arc.open(), 'data'): + e = self.expect_exception( + tarfile.LinkFallbackError, + "link 's' would be extracted as a copy of " + + "'a/b/s', which was rejected") + self.assertIsInstance(e.__cause__, + tarfile.LinkOutsideDestinationError) + + for filter in 'tar', 'fully_trusted': + with self.subTest(filter), self.check_context(arc.open(), filter): + if not os_helper.can_symlink(): + self.expect_file("a/") + self.expect_file("a/b/") + else: + self.expect_file("a/b/s", symlink_to=os.path.join('..', 'escape')) + self.expect_file("s", symlink_to=os.path.join('..', 'escape')) + @symlink_test def test_exfiltration_via_symlink(self): # (CVE-2025-4138) diff --git a/Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst b/Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst new file mode 100644 index 000000000000000..74459d5680e21a3 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst @@ -0,0 +1,3 @@ +Fixed an vulnerability in the :mod:`tarfile` ``data`` and ``tar`` extraction +filters where crafted archives could create a symlink pointing outside the +destination directory. This was a bypass of :cve:`2025-4330`. ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.shufhh/_old 2026-07-22 19:00:55.660460896 +0200 +++ /var/tmp/diff_new_pack.shufhh/_new 2026-07-22 19:00:55.664461033 +0200 @@ -1,6 +1,6 @@ -mtime: 1782860245 -commit: c2d17451a9c9e5192ab08ece6c401e67c08253be2fa04fc35f86e31f3dc7f65a +mtime: 1782986586 +commit: a1c64fe7cbc52ac1301387f243433e55c9bbf8797f1b1a1ff9e90094e634812a url: https://src.opensuse.org/python-interpreters/python314 -revision: c2d17451a9c9e5192ab08ece6c401e67c08253be2fa04fc35f86e31f3dc7f65a +revision: a1c64fe7cbc52ac1301387f243433e55c9bbf8797f1b1a1ff9e90094e634812a projectscmsync: https://src.opensuse.org/python-interpreters/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-07-02 12:03:06.000000000 +0200 @@ -0,0 +1,5 @@ +.osc +*.obscpio +_build.* +.pbuild +python314-*-build/
