mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-25 07:36:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

python3-pip: Fix CVE-2026-8643

Browse Source 
Apply the primary upstream fix referenced in [4] with commit [1]. Then
apply the two follow-up regression-fix commits [2] and [3].

The primary fix rejects entry-point names that escape the configured
scripts directory. The follow-up fixes handle doubled-slash roots and
reuse the existing directory-containment helper.

[1] 8eb178480b
[2] 7ff8bdd81e
[3] fa7854f6b3
[4] https://github.com/advisories/GHSA-wf93-45jw-7689

(From OE-Core rev: 2c276677d619bc6205872eb2b5a9948a4605d8ea)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Hetvi Thakar
2026-08-16 21:44:29 -07:00
committed by Paul Barker
parent 97fdca2021
commit b24d56a0b3
4 changed files with 185 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

79
meta/recipes-devtools/python/python3-pip/CVE-2026-8643.patch Normal file
View File

@@ -0,0 +1,79 @@
From fc0f7c683c372d66f2e2d6edc00909cc5f225f67 Mon Sep 17 00:00:00 2001
From: Damian Shaw <damian.peter.shaw@gmail.com>
Date: Wed, 20 May 2026 15:20:25 -0400
Subject: [PATCH] Reject entry point names that escape scripts dir (#14000)
* Reject entry point names that escape scripts dir
* NEWS ENTRY
CVE: CVE-2026-8643
Upstream-Status: Backport [https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb]
Backport Changes:
- Omit tests/unit/test_wheel.py because the pip 24.0 PyPI sdist used by this
recipe does not ship the upstream tests directory.
(cherry picked from commit 8eb178480bd1a2b223f509fc430796b265158dfb)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
news/14000.bugfix.rst | 2 +
src/pip/_internal/operations/install/wheel.py | 26 +++++++-
2 files changed, 25 insertions(+), 3 deletions(-)
create mode 100644 news/14000.bugfix.rst
diff --git a/news/14000.bugfix.rst b/news/14000.bugfix.rst
new file mode 100644
index 000000000..3b86f1b3b
--- /dev/null
+++ b/news/14000.bugfix.rst
@@ -0,0 +1,2 @@
+Reject ``console_scripts`` and ``gui_scripts`` entry points whose name would
+install a script outside the scripts directory.
diff --git a/src/pip/_internal/operations/install/wheel.py b/src/pip/_internal/operations/install/wheel.py
index f67180c9e..8a36a66ae 100644
--- a/src/pip/_internal/operations/install/wheel.py
+++ b/src/pip/_internal/operations/install/wheel.py
@@ -409,17 +409,37 @@ class MissingCallableSuffix(InstallationError):
)
-def _raise_for_invalid_entrypoint(specification: str) -> None:
+def _script_within_dir(name: str, scripts_dir: str) -> bool:
+ """Return whether script ``name`` resolves to a path inside the ``scripts_dir``.
+
+ distlib joins the entry point name onto the scripts directory, so a name
+ with path separators or ``..`` components can resolve elsewhere.
+ """
+ root = os.path.normpath(scripts_dir)
+ dest = os.path.normpath(os.path.join(scripts_dir, name))
+ return dest.startswith(root + os.sep)
+
+
+def _raise_for_invalid_entrypoint(specification: str, scripts_dir: str) -> None:
entry = get_export_entry(specification)
- if entry is not None and entry.suffix is None:
+ if entry is None:
+ return
+
+ if entry.suffix is None:
raise MissingCallableSuffix(str(entry))
+ if not _script_within_dir(entry.name, scripts_dir):
+ raise InstallationError(
+ f"Invalid script entry point name {entry.name!r}: the script "
+ f"would be installed outside the scripts directory ({scripts_dir})."
+ )
+
class PipScriptMaker(ScriptMaker):
def make(
self, specification: str, options: Optional[Dict[str, Any]] = None
) -> List[str]:
- _raise_for_invalid_entrypoint(specification)
+ _raise_for_invalid_entrypoint(specification, self.target_dir)
return super().make(specification, options)
--
2.35.6