Your message dated Sat, 11 Jul 2026 10:32:48 +0000
with message-id <[email protected]>
and subject line Released in 13.6
has caused the Debian Bug report #1140948,
regarding trixie-pu: package python-virtualenv/20.31.2+ds-1+deb13u1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1140948: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140948
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:python-virtualenv
User: [email protected]
Usertags: pu
* CVE-2026-22702: Time-of-Check-Time-of-Use Vulnerabilities
in Directory Creation (Closes: #1125191)
diffstat for python-virtualenv-20.31.2+ds python-virtualenv-20.31.2+ds
changelog | 8 +
patches/0001-Merge-pull-request-3013-from-gaborbernat-fix-sec.patch | 60
++++++++++
patches/series | 1
3 files changed, 69 insertions(+)
diff -Nru python-virtualenv-20.31.2+ds/debian/changelog
python-virtualenv-20.31.2+ds/debian/changelog
--- python-virtualenv-20.31.2+ds/debian/changelog 2025-05-09
16:08:14.000000000 +0300
+++ python-virtualenv-20.31.2+ds/debian/changelog 2026-06-28
18:25:34.000000000 +0300
@@ -1,3 +1,11 @@
+python-virtualenv (20.31.2+ds-1+deb13u1) trixie; urgency=medium
+
+ * Non-maintainer upload.
+ * CVE-2026-22702: Time-of-Check-Time-of-Use Vulnerabilities
+ in Directory Creation (Closes: #1125191)
+
+ -- Adrian Bunk <[email protected]> Sun, 28 Jun 2026 18:25:34 +0300
+
python-virtualenv (20.31.2+ds-1) unstable; urgency=medium
[ Stefano Rivera ]
diff -Nru
python-virtualenv-20.31.2+ds/debian/patches/0001-Merge-pull-request-3013-from-gaborbernat-fix-sec.patch
python-virtualenv-20.31.2+ds/debian/patches/0001-Merge-pull-request-3013-from-gaborbernat-fix-sec.patch
---
python-virtualenv-20.31.2+ds/debian/patches/0001-Merge-pull-request-3013-from-gaborbernat-fix-sec.patch
1970-01-01 02:00:00.000000000 +0200
+++
python-virtualenv-20.31.2+ds/debian/patches/0001-Merge-pull-request-3013-from-gaborbernat-fix-sec.patch
2026-06-28 17:40:26.000000000 +0300
@@ -0,0 +1,60 @@
+From 8e8cb1e67337f5d20184a71e7cf1164a0a45ce36 Mon Sep 17 00:00:00 2001
+From: Bernát Gábor <[email protected]>
+Date: Fri, 9 Jan 2026 10:19:39 -0800
+Subject: Merge pull request #3013 from gaborbernat/fix-sec
+
+---
+ src/virtualenv/app_data/__init__.py | 11 +++++------
+ src/virtualenv/util/lock.py | 7 +++----
+ 2 files changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/src/virtualenv/app_data/__init__.py
b/src/virtualenv/app_data/__init__.py
+index d7f14802..7a9d38e9 100644
+--- a/src/virtualenv/app_data/__init__.py
++++ b/src/virtualenv/app_data/__init__.py
+@@ -36,12 +36,11 @@ def make_app_data(folder, **kwargs):
+ if is_read_only:
+ return ReadOnlyAppData(folder)
+
+- if not os.path.isdir(folder):
+- try:
+- os.makedirs(folder)
+- LOGGER.debug("created app data folder %s", folder)
+- except OSError as exception:
+- LOGGER.info("could not create app data folder %s due to %r",
folder, exception)
++ try:
++ os.makedirs(folder, exist_ok=True)
++ LOGGER.debug("created app data folder %s", folder)
++ except OSError as exception:
++ LOGGER.info("could not create app data folder %s due to %r", folder,
exception)
+
+ if os.access(folder, os.W_OK):
+ return AppDataDiskFolder(folder)
+diff --git a/src/virtualenv/util/lock.py b/src/virtualenv/util/lock.py
+index b8c9cf83..b003d2c5 100644
+--- a/src/virtualenv/util/lock.py
++++ b/src/virtualenv/util/lock.py
+@@ -17,9 +17,8 @@ LOGGER = logging.getLogger(__name__)
+ class _CountedFileLock(FileLock):
+ def __init__(self, lock_file) -> None:
+ parent = os.path.dirname(lock_file)
+- if not os.path.isdir(parent):
+- with suppress(OSError):
+- os.makedirs(parent)
++ with suppress(OSError):
++ os.makedirs(parent, exist_ok=True)
+
+ super().__init__(lock_file)
+ self.count = 0
+@@ -111,7 +110,7 @@ class ReentrantFileLock(PathLockBase):
+ # a lock, but that lock might then become expensive, and it's not
clear where that lock should live.
+ # Instead here we just ignore if we fail to create the directory.
+ with suppress(OSError):
+- os.makedirs(str(self.path))
++ os.makedirs(str(self.path), exist_ok=True)
+
+ try:
+ lock.acquire(0.0001)
+--
+2.47.3
+
diff -Nru python-virtualenv-20.31.2+ds/debian/patches/series
python-virtualenv-20.31.2+ds/debian/patches/series
--- python-virtualenv-20.31.2+ds/debian/patches/series 2025-05-09
16:08:14.000000000 +0300
+++ python-virtualenv-20.31.2+ds/debian/patches/series 2026-06-28
18:25:30.000000000 +0300
@@ -2,3 +2,4 @@
debian_update_for_available_wheels.patch
disable-periodic-update.patch
wheel-package-error
+0001-Merge-pull-request-3013-from-gaborbernat-fix-sec.patch
--- End Message ---
--- Begin Message ---
Version: 13.6
This update was released as part of 13.6.
--- End Message ---
