Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:python-virtualenv
User: [email protected]
Usertags: pu
* CVE-2026-22702: Time-of-Check-Time-of-Use Vulnerabilities
in Directory Creation (Closes: #1125191)
diffstat for python-virtualenv-20.31.2+ds python-virtualenv-20.31.2+ds
changelog | 8 +
patches/0001-Merge-pull-request-3013-from-gaborbernat-fix-sec.patch | 60
++++++++++
patches/series | 1
3 files changed, 69 insertions(+)
diff -Nru python-virtualenv-20.31.2+ds/debian/changelog
python-virtualenv-20.31.2+ds/debian/changelog
--- python-virtualenv-20.31.2+ds/debian/changelog 2025-05-09
16:08:14.000000000 +0300
+++ python-virtualenv-20.31.2+ds/debian/changelog 2026-06-28
18:25:34.000000000 +0300
@@ -1,3 +1,11 @@
+python-virtualenv (20.31.2+ds-1+deb13u1) trixie; urgency=medium
+
+ * Non-maintainer upload.
+ * CVE-2026-22702: Time-of-Check-Time-of-Use Vulnerabilities
+ in Directory Creation (Closes: #1125191)
+
+ -- Adrian Bunk <[email protected]> Sun, 28 Jun 2026 18:25:34 +0300
+
python-virtualenv (20.31.2+ds-1) unstable; urgency=medium
[ Stefano Rivera ]
diff -Nru
python-virtualenv-20.31.2+ds/debian/patches/0001-Merge-pull-request-3013-from-gaborbernat-fix-sec.patch
python-virtualenv-20.31.2+ds/debian/patches/0001-Merge-pull-request-3013-from-gaborbernat-fix-sec.patch
---
python-virtualenv-20.31.2+ds/debian/patches/0001-Merge-pull-request-3013-from-gaborbernat-fix-sec.patch
1970-01-01 02:00:00.000000000 +0200
+++
python-virtualenv-20.31.2+ds/debian/patches/0001-Merge-pull-request-3013-from-gaborbernat-fix-sec.patch
2026-06-28 17:40:26.000000000 +0300
@@ -0,0 +1,60 @@
+From 8e8cb1e67337f5d20184a71e7cf1164a0a45ce36 Mon Sep 17 00:00:00 2001
+From: Bernát Gábor <[email protected]>
+Date: Fri, 9 Jan 2026 10:19:39 -0800
+Subject: Merge pull request #3013 from gaborbernat/fix-sec
+
+---
+ src/virtualenv/app_data/__init__.py | 11 +++++------
+ src/virtualenv/util/lock.py | 7 +++----
+ 2 files changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/src/virtualenv/app_data/__init__.py
b/src/virtualenv/app_data/__init__.py
+index d7f14802..7a9d38e9 100644
+--- a/src/virtualenv/app_data/__init__.py
++++ b/src/virtualenv/app_data/__init__.py
+@@ -36,12 +36,11 @@ def make_app_data(folder, **kwargs):
+ if is_read_only:
+ return ReadOnlyAppData(folder)
+
+- if not os.path.isdir(folder):
+- try:
+- os.makedirs(folder)
+- LOGGER.debug("created app data folder %s", folder)
+- except OSError as exception:
+- LOGGER.info("could not create app data folder %s due to %r",
folder, exception)
++ try:
++ os.makedirs(folder, exist_ok=True)
++ LOGGER.debug("created app data folder %s", folder)
++ except OSError as exception:
++ LOGGER.info("could not create app data folder %s due to %r", folder,
exception)
+
+ if os.access(folder, os.W_OK):
+ return AppDataDiskFolder(folder)
+diff --git a/src/virtualenv/util/lock.py b/src/virtualenv/util/lock.py
+index b8c9cf83..b003d2c5 100644
+--- a/src/virtualenv/util/lock.py
++++ b/src/virtualenv/util/lock.py
+@@ -17,9 +17,8 @@ LOGGER = logging.getLogger(__name__)
+ class _CountedFileLock(FileLock):
+ def __init__(self, lock_file) -> None:
+ parent = os.path.dirname(lock_file)
+- if not os.path.isdir(parent):
+- with suppress(OSError):
+- os.makedirs(parent)
++ with suppress(OSError):
++ os.makedirs(parent, exist_ok=True)
+
+ super().__init__(lock_file)
+ self.count = 0
+@@ -111,7 +110,7 @@ class ReentrantFileLock(PathLockBase):
+ # a lock, but that lock might then become expensive, and it's not
clear where that lock should live.
+ # Instead here we just ignore if we fail to create the directory.
+ with suppress(OSError):
+- os.makedirs(str(self.path))
++ os.makedirs(str(self.path), exist_ok=True)
+
+ try:
+ lock.acquire(0.0001)
+--
+2.47.3
+
diff -Nru python-virtualenv-20.31.2+ds/debian/patches/series
python-virtualenv-20.31.2+ds/debian/patches/series
--- python-virtualenv-20.31.2+ds/debian/patches/series 2025-05-09
16:08:14.000000000 +0300
+++ python-virtualenv-20.31.2+ds/debian/patches/series 2026-06-28
18:25:30.000000000 +0300
@@ -2,3 +2,4 @@
debian_update_for_available_wheels.patch
disable-periodic-update.patch
wheel-package-error
+0001-Merge-pull-request-3013-from-gaborbernat-fix-sec.patch
