Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ansible-core-2.18 for openSUSE:Factory checked in at 2026-10-18 19:25:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ansible-core-2.18 (Old) and /work/SRC/openSUSE:Factory/.ansible-core-2.18.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ansible-core-2.18" Sun Oct 18 19:25:10 2026 rev:12 rq:1385747 version:2.18.19 Changes: -------- --- /work/SRC/openSUSE:Factory/ansible-core-2.18/ansible-core-2.18.changes 2026-10-05 13:05:13.147860292 +0200 +++ /work/SRC/openSUSE:Factory/.ansible-core-2.18.new.3698736/ansible-core-2.18.changes 2026-10-18 19:25:22.651919082 +0200 @@ -1,0 +2,17 @@ +Fri Oct 16 05:22:38 UTC 2026 - Harshvardhan Sharma <[email protected]> + +- Security fix for CVE-2026-89091 (bsc#1284847): path traversal in + ansible-galaxy collection install; a crafted collection tarball + could create directories or write files outside the collection + directory. Check directory members against the collection path and + normalise paths before the containment check. Backport of + gh#ansible/ansible#87660 (devel commit ed42c495 rebased onto 2.18.19, + as upstream closed the stable-2.18 backport gh#ansible/ansible#87670 + unmerged). + * add ansible-core-CVE-2026-89091.patch +- Fix test_Request username unit tests failing in %check on Python + 3.13.16+, which includes the scheme in urllib password manager keys + (cpython#155694). Backport of gh#ansible/ansible#87486 (stable-2.18). + * add da910e7ffdb4005093f446f72001f7f700a60a53.patch + +------------------------------------------------------------------- New: ---- ansible-core-CVE-2026-89091.patch da910e7ffdb4005093f446f72001f7f700a60a53.patch ----------(New B)---------- New: unmerged). * add ansible-core-CVE-2026-89091.patch - Fix test_Request username unit tests failing in %check on Python New: (cpython#155694). Backport of gh#ansible/ansible#87486 (stable-2.18). * add da910e7ffdb4005093f446f72001f7f700a60a53.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ansible-core-2.18.spec ++++++ --- /var/tmp/diff_new_pack.HLCNcC/_old 2026-10-18 19:25:23.472953239 +0200 +++ /var/tmp/diff_new_pack.HLCNcC/_new 2026-10-18 19:25:23.474953322 +0200 @@ -61,6 +61,10 @@ Patch3: suse-distribution-fix.patch # CVE-2026-16493 (bsc#1272369) Patch4: ansible-core-CVE-2026-16493.patch +# CVE-2026-89091 (bsc#1284847) +Patch5: ansible-core-CVE-2026-89091.patch +# PATCH-FIX-UPSTREAM fix urls unit tests on Python with the cpython#155694 fix (gh#ansible/ansible#87486) +Patch6: https://github.com/ansible/ansible/commit/da910e7ffdb4005093f446f72001f7f700a60a53.patch BuildArch: noarch Provides: ansible-core = %{version} ++++++ ansible-core-CVE-2026-89091.patch ++++++ >From ed42c495548e21cbc6fe71de14265926c152d046 Mon Sep 17 00:00:00 2001 From: Sloane Hertel <[email protected]> Date: Fri, 9 Oct 2026 09:43:50 -0400 Subject: [PATCH] ansible-galaxy collection install - fix validating paths before extraction (#87660) * ansible-galaxy collection install - validate directories and absolute linknames containing '..' are within the collection move tarball extraction tests into a dedicated tasks file replace unit tests testing directory extraction with integration tests Co-authored-by: Martin Krizek <[email protected]> --- lib/ansible/galaxy/collection/__init__.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/ansible/galaxy/collection/__init__.py b/lib/ansible/galaxy/collection/__init__.py index b2c83ee..a980cee 100644 --- a/lib/ansible/galaxy/collection/__init__.py +++ b/lib/ansible/galaxy/collection/__init__.py @@ -1689,6 +1689,9 @@ def _extract_tar_dir(tar, dirname, b_dest): except KeyError: raise AnsibleError("Unable to extract '%s' from collection" % dirname) + if not _is_child_path(to_bytes(tar_member.name, errors='surrogate_or_strict'), b_dest): + raise AnsibleError(f"Cannot extract directory '{dirname}' in collection: path is outside of collection '{tar_member.name}'") + b_dir_path = os.path.join(b_dest, to_bytes(dirname, errors='surrogate_or_strict')) b_parent_path = os.path.dirname(b_dir_path) @@ -1797,13 +1800,16 @@ def _get_file_hash(b_path, filename): # type: (bytes, str) -> str def _is_child_path(path, parent_path, link_name=None): """ Checks that path is a path within the parent_path specified. """ b_path = to_bytes(path, errors='surrogate_or_strict') + b_parent_path = to_bytes(parent_path, errors='surrogate_or_strict') if link_name and not os.path.isabs(b_path): # If link_name is specified, path is the source of the link and we need to resolve the absolute path. b_link_dir = os.path.dirname(to_bytes(link_name, errors='surrogate_or_strict')) - b_path = os.path.abspath(os.path.join(b_link_dir, b_path)) + b_path = os.path.join(b_link_dir, b_path) + elif not os.path.isabs(b_path): + b_path = os.path.join(b_parent_path, b_path) - b_parent_path = to_bytes(parent_path, errors='surrogate_or_strict') + b_path = os.path.normpath(b_path) return b_path == b_parent_path or b_path.startswith(b_parent_path + to_bytes(os.path.sep)) -- 2.55.0 ++++++ da910e7ffdb4005093f446f72001f7f700a60a53.patch ++++++ >From da910e7ffdb4005093f446f72001f7f700a60a53 Mon Sep 17 00:00:00 2001 From: Matt Clay <[email protected]> Date: Fri, 11 Sep 2026 15:59:50 -0700 Subject: [PATCH] [stable-2.18] Update module_utils urls unit tests (#87483) (#87486) Update the tests to work on newer Python versions which contain fixes for https://github.com/python/cpython/issues/155694. (cherry picked from commit 5ba4572) --- test/units/module_utils/urls/test_Request.py | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/test/units/module_utils/urls/test_Request.py b/test/units/module_utils/urls/test_Request.py index f5f0edeb9e1510..6fbf533fc4e075 100644 --- a/test/units/module_utils/urls/test_Request.py +++ b/test/units/module_utils/urls/test_Request.py @@ -192,7 +192,15 @@ def test_Request_open_username(urlopen_mock, install_opener_mock): if isinstance(handler, expected_handlers): found_handlers.append(handler) assert len(found_handlers) == 2 - assert found_handlers[0].passwd.passwd[None] == {(('ansible.com', '/'),): ('user', None)} + + expected = ('user', None) + result = found_handlers[0].passwd.passwd[None] + + assert ( + # see https://github.com/python/cpython/issues/155694 + result == {(('ansible.com', '/'),): expected} or # before fix + result == {((None, 'ansible.com', '/'),): expected} # after fix + ) @pytest.mark.parametrize('url, expected', ( @@ -215,7 +223,14 @@ def test_Request_open_username_in_url(url, expected, urlopen_mock, install_opene for handler in handlers: if isinstance(handler, expected_handlers): found_handlers.append(handler) - assert found_handlers[0].passwd.passwd[None] == {(('ansible.com', '/'),): expected} + + result = found_handlers[0].passwd.passwd[None] + + assert ( + # see https://github.com/python/cpython/issues/155694 + result == {(('ansible.com', '/'),): expected} or # before fix + result == {((None, 'ansible.com', '/'),): expected} # after fix + ) def test_Request_open_username_force_basic(urlopen_mock, install_opener_mock):
