Your message dated Thu, 3 Sep 2026 08:48:49 +0200
with message-id <[email protected]>
and subject line fixed in 84.0.0-1
has caused the Debian Bug report #1126729,
regarding setuptools: CVE-2026-23949
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1126729: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126729
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: setuptools
Version: 78.1.1-0.1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Control: found -1 80.9.0-1
Hi,
The following vulnerability was published for setuptools.
CVE-2026-23949[0]:
| jaraco.context, an open-source software package that provides some
| useful decorators and context managers, has a Zip Slip path
| traversal vulnerability in the `jaraco.context.tarball()` function
| starting in version 5.2.0 and prior to version 6.1.0. The
| vulnerability may allow attackers to extract files outside the
| intended extraction directory when malicious tar archives are
| processed. The strip_first_component filter splits the path on the
| first `/` and extracts the second component, while allowing `../`
| sequences. Paths like `dummy_dir/../../etc/passwd` become
| `../../etc/passwd`. Note that this suffers from a nested tarball
| attack as well with multi-level tar files such as
| `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a
| traversal `dummy_dir/../../config/.env` that also gets translated to
| `../../config/.env`. Version 6.1.0 contains a patch for the issue.
setuptools includes a bundled version of jaraco.context.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-23949
https://www.cve.org/CVERecord?id=CVE-2026-23949
[1]
https://github.com/jaraco/jaraco.context/security/advisories/GHSA-58pv-8j8x-9vj2
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Version: 84.0.0-1
fixed in 84.0.0-1
--- End Message ---
