Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python315 for openSUSE:Factory checked in at 2026-07-15 16:43:57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python315 (Old) and /work/SRC/openSUSE:Factory/.python315.new.1991 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python315" Wed Jul 15 16:43:57 2026 rev:16 rq:1365775 version:3.15.0~b3 Changes: -------- --- /work/SRC/openSUSE:Factory/python315/python315.changes 2026-06-29 17:31:41.276750675 +0200 +++ /work/SRC/openSUSE:Factory/.python315.new.1991/python315.changes 2026-07-15 17:01:57.443833352 +0200 @@ -1,0 +2,13 @@ +Wed Jul 1 23:10:26 UTC 2026 - Matej Cepl <[email protected]> + +- CVE-2026-11940: fix the symlink escape via tarfile + hardlink-extraction fallback (bsc#1268977) + CVE-2026-11940-tarfile-escape.patch + +------------------------------------------------------------------- +Tue Jun 30 02:46:39 UTC 2026 - Matej Cepl <[email protected]> + +- add gcc and g++ dependencies to the -devel package (and BR for + the whole package) + +------------------------------------------------------------------- New: ---- CVE-2026-11940-tarfile-escape.patch ----------(New B)---------- New: hardlink-extraction fallback (bsc#1268977) CVE-2026-11940-tarfile-escape.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python315.spec ++++++ --- /var/tmp/diff_new_pack.cguDD1/_old 2026-07-15 17:02:00.443935244 +0200 +++ /var/tmp/diff_new_pack.cguDD1/_new 2026-07-15 17:02:00.443935244 +0200 @@ -230,11 +230,16 @@ # PATCH-FIX-OPENSUSE test_UDPLITE_support.patch gh#python/cpython#149078 [email protected] # improve testing of the presence of IPPROTO_UDPLITE support Patch49: test_UDPLITE_support.patch +# PATCH-FIX-UPSTREAM CVE-2026-11940-tarfile-escape.patch bsc#1268977 [email protected] +# Fix symlink escape via tarfile hardlink-extraction fallback +Patch50: CVE-2026-11940-tarfile-escape.patch #### Python 3.15 DEVELOPMENT PATCHES BuildRequires: autoconf-archive BuildRequires: automake BuildRequires: crypto-policies-scripts BuildRequires: fdupes +BuildRequires: gcc +BuildRequires: gcc-c++ BuildRequires: gmp-devel BuildRequires: lzma-devel BuildRequires: netcfg @@ -459,6 +464,8 @@ %package -n %{python_pkg_name}-devel Summary: Include Files and Libraries Mandatory for Building Python Modules Requires: %{python_pkg_name}-base = %{version} +Requires: gcc +Requires: gcc-c++ %obsolete_python_versioned devel %description -n %{python_pkg_name}-devel ++++++ CVE-2026-11940-tarfile-escape.patch ++++++ >From 41426f20172933a24c6b6d01f1b36e40e3913107 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych <[email protected]> Date: Tue, 23 Jun 2026 14:31:38 +0100 Subject: [PATCH] gh-151558: Fix symlink escape via `tarfile` hardlink-extraction fallback (GH-151559) (cherry picked from commit 27dd970bf6b17ebca7c8ed486a40ab043ed7af8f) Co-authored-by: Stan Ulbrych <[email protected]> --- Lib/tarfile.py | 3 + Lib/test/test_tarfile.py | 24 ++++++++++ Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst | 3 + 3 files changed, 30 insertions(+) create mode 100644 Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst Index: Python-3.15.0b3/Lib/tarfile.py =================================================================== --- Python-3.15.0b3.orig/Lib/tarfile.py 2026-07-02 01:10:06.153619921 +0200 +++ Python-3.15.0b3/Lib/tarfile.py 2026-07-02 01:10:12.099552839 +0200 @@ -2804,6 +2804,9 @@ "makelink_with_filter: if filter_function is not None, " + "extraction_root must also not be None") try: + filter_function( + unfiltered.replace(name=tarinfo.name, deep=False), + extraction_root) filtered = filter_function(unfiltered, extraction_root) except _FILTER_ERRORS as cause: raise LinkFallbackError(tarinfo, unfiltered.name) from cause Index: Python-3.15.0b3/Lib/test/test_tarfile.py =================================================================== --- Python-3.15.0b3.orig/Lib/test/test_tarfile.py 2026-07-02 01:10:08.476833304 +0200 +++ Python-3.15.0b3/Lib/test/test_tarfile.py 2026-07-02 01:10:12.100857124 +0200 @@ -4385,6 +4385,30 @@ self.expect_file("c", symlink_to='b') @symlink_test + def test_sneaky_hardlink_fallback_deep(self): + # (CVE-2026-11940) + with ArchiveMaker() as arc: + arc.add("a/b/s", symlink_to=os.path.join("..", "escape")) + arc.add("s", hardlink_to=os.path.join("a", "b", "s")) + + with self.check_context(arc.open(), 'data'): + e = self.expect_exception( + tarfile.LinkFallbackError, + "link 's' would be extracted as a copy of " + + "'a/b/s', which was rejected") + self.assertIsInstance(e.__cause__, + tarfile.LinkOutsideDestinationError) + + for filter in 'tar', 'fully_trusted': + with self.subTest(filter), self.check_context(arc.open(), filter): + if not os_helper.can_symlink(): + self.expect_file("a/") + self.expect_file("a/b/") + else: + self.expect_file("a/b/s", symlink_to=os.path.join('..', 'escape')) + self.expect_file("s", symlink_to=os.path.join('..', 'escape')) + + @symlink_test def test_exfiltration_via_symlink(self): # (CVE-2025-4138) # Test changing symlinks that result in a symlink pointing outside Index: Python-3.15.0b3/Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ Python-3.15.0b3/Misc/NEWS.d/next/Security/2026-06-10-13-08-19.gh-issue-151558.mL74i2.rst 2026-07-02 01:10:12.101419805 +0200 @@ -0,0 +1,3 @@ +Fixed an vulnerability in the :mod:`tarfile` ``data`` and ``tar`` extraction +filters where crafted archives could create a symlink pointing outside the +destination directory. This was a bypass of :cve:`2025-4330`. ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.cguDD1/_old 2026-07-15 17:02:00.547938776 +0200 +++ /var/tmp/diff_new_pack.cguDD1/_new 2026-07-15 17:02:00.551938913 +0200 @@ -1,6 +1,6 @@ -mtime: 1782668971 -commit: 735232921896c0bf6d11d383dc7177fc290f819bf197ccd1dd46f8e1e023d92f +mtime: 1782986381 +commit: aeb0b976aba17ecc9a6e9e572bfe964b06957c2682f69cef8729937d4ddb7fe0 url: https://src.opensuse.org/python-interpreters/python315 -revision: 735232921896c0bf6d11d383dc7177fc290f819bf197ccd1dd46f8e1e023d92f +revision: aeb0b976aba17ecc9a6e9e572bfe964b06957c2682f69cef8729937d4ddb7fe0 projectscmsync: https://src.opensuse.org/python-interpreters/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-07-02 11:59:41.000000000 +0200 @@ -0,0 +1,5 @@ +*.obscpio +*.osc +_build.* +.pbuild +python315-*-build/
