From ff726ffdd56b2fc0f0d4af9c8bcf240927f1f5671e600903625176ed78859af0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C4=9Bj=20Cepl?= Date: Tue, 4 Nov 2025 17:47:42 +0100 Subject: [PATCH] Add CVE-2025-8291-consistency-zip64.patch Checks consistency of the zip64 end of central directory record, and preventing obfuscation of the payload, i.e., you scanning for malicious content in a ZIP file with one ZIP parser (let's say a Rust one) then unpack it in production with another (e.g., the Python one) and get malicious content that the other parser did not see (CVE-2025-8291, bsc#1251305) Readjust patches while synchronizing between openSUSE and SLE trees: - F00251-change-user-install-location.patch - doc-py38-to-py36.patch - gh126985-mv-pyvenv.cfg2getpath.patch --- CVE-2025-8291-consistency-zip64.patch | 306 ++++++++++++++++++++++ F00251-change-user-install-location.patch | 16 +- doc-py38-to-py36.patch | 133 ++++------ gh126985-mv-pyvenv.cfg2getpath.patch | 8 +- python313.changes | 15 ++ python313.spec | 3 + 6 files changed, 390 insertions(+), 91 deletions(-) create mode 100644 CVE-2025-8291-consistency-zip64.patch diff --git a/CVE-2025-8291-consistency-zip64.patch b/CVE-2025-8291-consistency-zip64.patch new file mode 100644 index 0000000..e329f0b --- /dev/null +++ b/CVE-2025-8291-consistency-zip64.patch @@ -0,0 +1,306 @@ +From 1f2e4ec73cf7ece0a8c0a7a85cb73ec9ec0ef85a Mon Sep 17 00:00:00 2001 +From: Serhiy Storchaka +Date: Tue, 7 Oct 2025 20:15:26 +0300 +Subject: [PATCH] [3.13] gh-139700: Check consistency of the zip64 end of + central directory record (GH-139702) + +Support records with "zip64 extensible data" if there are no bytes +prepended to the ZIP file. +(cherry picked from commit 162997bb70e067668c039700141770687bc8f267) + +Co-authored-by: Serhiy Storchaka +--- + Lib/test/test_zipfile/test_core.py | 82 +++++++++- + Lib/zipfile/__init__.py | 51 +++--- + Misc/NEWS.d/next/Security/2025-10-07-19-31-34.gh-issue-139700.vNHU1O.rst | 3 + 3 files changed, 113 insertions(+), 23 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2025-10-07-19-31-34.gh-issue-139700.vNHU1O.rst + +Index: Python-3.13.9/Lib/test/test_zipfile/test_core.py +=================================================================== +--- Python-3.13.9.orig/Lib/test/test_zipfile/test_core.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Lib/test/test_zipfile/test_core.py 2025-11-04 17:42:44.951505949 +0100 +@@ -884,6 +884,8 @@ + self, file_size_64_set=False, file_size_extra=False, + compress_size_64_set=False, compress_size_extra=False, + header_offset_64_set=False, header_offset_extra=False, ++ extensible_data=b'', ++ end_of_central_dir_size=None, offset_to_end_of_central_dir=None, + ): + """Generate bytes sequence for a zip with (incomplete) zip64 data. + +@@ -937,6 +939,12 @@ + + central_dir_size = struct.pack(' 1: + raise BadZipFile("zipfiles that span multiple disks are not supported") + +- # Assume no 'zip64 extensible data' +- fpin.seek(offset - sizeEndCentDir64Locator - sizeEndCentDir64, 2) ++ offset -= sizeEndCentDir64 ++ if reloff > offset: ++ raise BadZipFile("Corrupt zip64 end of central directory locator") ++ # First, check the assumption that there is no prepended data. ++ fpin.seek(reloff) ++ extrasz = offset - reloff + data = fpin.read(sizeEndCentDir64) + if len(data) != sizeEndCentDir64: +- return endrec ++ raise OSError("Unknown I/O error") ++ if not data.startswith(stringEndArchive64) and reloff != offset: ++ # Since we already have seen the Zip64 EOCD Locator, it's ++ # possible we got here because there is prepended data. ++ # Assume no 'zip64 extensible data' ++ fpin.seek(offset) ++ extrasz = 0 ++ data = fpin.read(sizeEndCentDir64) ++ if len(data) != sizeEndCentDir64: ++ raise OSError("Unknown I/O error") ++ if not data.startswith(stringEndArchive64): ++ raise BadZipFile("Zip64 end of central directory record not found") ++ + sig, sz, create_version, read_version, disk_num, disk_dir, \ + dircount, dircount2, dirsize, diroffset = \ + struct.unpack(structEndArchive64, data) +- if sig != stringEndArchive64: +- return endrec ++ if (diroffset + dirsize != reloff or ++ sz + 12 != sizeEndCentDir64 + extrasz): ++ raise BadZipFile("Corrupt zip64 end of central directory record") + + # Update the original endrec using data from the ZIP64 record + endrec[_ECD_SIGNATURE] = sig +@@ -289,6 +305,7 @@ + endrec[_ECD_ENTRIES_TOTAL] = dircount2 + endrec[_ECD_SIZE] = dirsize + endrec[_ECD_OFFSET] = diroffset ++ endrec[_ECD_LOCATION] = offset - extrasz + return endrec + + +@@ -322,7 +339,7 @@ + endrec.append(filesize - sizeEndCentDir) + + # Try to read the "Zip64 end of central directory" structure +- return _EndRecData64(fpin, -sizeEndCentDir, endrec) ++ return _EndRecData64(fpin, filesize - sizeEndCentDir, endrec) + + # Either this is not a ZIP file, or it is a ZIP file with an archive + # comment. Search the end of the file for the "end of central directory" +@@ -346,8 +363,7 @@ + endrec.append(maxCommentStart + start) + + # Try to read the "Zip64 end of central directory" structure +- return _EndRecData64(fpin, maxCommentStart + start - filesize, +- endrec) ++ return _EndRecData64(fpin, maxCommentStart + start, endrec) + + # Unable to find a valid end of central directory structure + return None +@@ -1458,9 +1474,6 @@ + + # "concat" is zero, unless zip was concatenated to another file + concat = endrec[_ECD_LOCATION] - size_cd - offset_cd +- if endrec[_ECD_SIGNATURE] == stringEndArchive64: +- # If Zip64 extension structures are present, account for them +- concat -= (sizeEndCentDir64 + sizeEndCentDir64Locator) + + if self.debug > 2: + inferred = concat + offset_cd +@@ -2082,7 +2095,7 @@ + " would require ZIP64 extensions") + zip64endrec = struct.pack( + structEndArchive64, stringEndArchive64, +- 44, 45, 45, 0, 0, centDirCount, centDirCount, ++ sizeEndCentDir64 - 12, 45, 45, 0, 0, centDirCount, centDirCount, + centDirSize, centDirOffset) + self.fp.write(zip64endrec) + +Index: Python-3.13.9/Misc/NEWS.d/next/Security/2025-10-07-19-31-34.gh-issue-139700.vNHU1O.rst +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ Python-3.13.9/Misc/NEWS.d/next/Security/2025-10-07-19-31-34.gh-issue-139700.vNHU1O.rst 2025-11-04 17:42:44.952237544 +0100 +@@ -0,0 +1,3 @@ ++Check consistency of the zip64 end of central directory record. Support ++records with "zip64 extensible data" if there are no bytes prepended to the ++ZIP file. diff --git a/F00251-change-user-install-location.patch b/F00251-change-user-install-location.patch index 0e67e07..a1aa69d 100644 --- a/F00251-change-user-install-location.patch +++ b/F00251-change-user-install-location.patch @@ -28,10 +28,10 @@ Co-authored-by: Lumír Balhar Lib/test/test_sysconfig.py | 17 +++++++++++-- 2 files changed, 67 insertions(+), 7 deletions(-) -Index: Python-3.13.3/Lib/sysconfig/__init__.py +Index: Python-3.13.9/Lib/sysconfig/__init__.py =================================================================== ---- Python-3.13.3.orig/Lib/sysconfig/__init__.py 2025-04-08 15:54:08.000000000 +0200 -+++ Python-3.13.3/Lib/sysconfig/__init__.py 2025-04-11 21:52:31.769387873 +0200 +--- Python-3.13.9.orig/Lib/sysconfig/__init__.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Lib/sysconfig/__init__.py 2025-11-04 17:41:28.521141323 +0100 @@ -106,6 +106,11 @@ else: _INSTALL_SCHEMES['venv'] = _INSTALL_SCHEMES['posix_venv'] @@ -128,10 +128,10 @@ Index: Python-3.13.3/Lib/sysconfig/__init__.py _CONFIG_VARS['py_version'] = _PY_VERSION _CONFIG_VARS['py_version_short'] = _PY_VERSION_SHORT _CONFIG_VARS['py_version_nodot'] = _PY_VERSION_SHORT_NO_DOT -Index: Python-3.13.3/Lib/test/test_sysconfig.py +Index: Python-3.13.9/Lib/test/test_sysconfig.py =================================================================== ---- Python-3.13.3.orig/Lib/test/test_sysconfig.py 2025-04-08 15:54:08.000000000 +0200 -+++ Python-3.13.3/Lib/test/test_sysconfig.py 2025-04-11 21:52:31.769841915 +0200 +--- Python-3.13.9.orig/Lib/test/test_sysconfig.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Lib/test/test_sysconfig.py 2025-11-04 17:41:28.521386489 +0100 @@ -130,8 +130,19 @@ for scheme in _INSTALL_SCHEMES: for name in _INSTALL_SCHEMES[scheme]: @@ -153,7 +153,7 @@ Index: Python-3.13.3/Lib/test/test_sysconfig.py os.path.normpath(expected), ) -@@ -386,7 +397,7 @@ +@@ -393,7 +404,7 @@ self.assertTrue(os.path.isfile(config_h), config_h) def test_get_scheme_names(self): @@ -162,7 +162,7 @@ Index: Python-3.13.3/Lib/test/test_sysconfig.py if HAS_USER_BASE: wanted.extend(['nt_user', 'osx_framework_user', 'posix_user']) self.assertEqual(get_scheme_names(), tuple(sorted(wanted))) -@@ -398,6 +409,8 @@ +@@ -405,6 +416,8 @@ cmd = "-c", "import sysconfig; print(sysconfig.get_platform())" self.assertEqual(py.call_real(*cmd), py.call_link(*cmd)) diff --git a/doc-py38-to-py36.patch b/doc-py38-to-py36.patch index 54c162a..4267164 100644 --- a/doc-py38-to-py36.patch +++ b/doc-py38-to-py36.patch @@ -7,7 +7,6 @@ Doc/library/doctest.rst | 1 Doc/library/email.compat32-message.rst | 1 Doc/library/xml.etree.elementtree.rst | 1 - Doc/Makefile | 8 +-- Doc/c-api/arg.rst | 1 Doc/c-api/typeobj.rst | 8 +-- Doc/conf.py | 29 ++++++++++--- @@ -25,36 +24,12 @@ Doc/tools/extensions/misc_news.py | 14 ++---- Doc/tools/extensions/patchlevel.py | 9 ++-- Doc/tools/extensions/pydoc_topics.py | 22 +++++----- - 18 files changed, 159 insertions(+), 130 deletions(-) + 17 files changed, 155 insertions(+), 126 deletions(-) -Index: Python-3.13.6/Doc/Makefile +Index: Python-3.13.9/Doc/c-api/arg.rst =================================================================== ---- Python-3.13.6.orig/Doc/Makefile 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/Makefile 2025-08-07 12:16:58.253706854 +0200 -@@ -14,15 +14,15 @@ - SOURCES = - DISTVERSION = $(shell $(PYTHON) tools/extensions/patchlevel.py) - REQUIREMENTS = requirements.txt --SPHINXERRORHANDLING = --fail-on-warning -+SPHINXERRORHANDLING = - - # Internal variables. - PAPEROPT_a4 = --define latex_elements.papersize=a4paper - PAPEROPT_letter = --define latex_elements.papersize=letterpaper - --ALLSPHINXOPTS = --builder $(BUILDER) \ -- --doctree-dir build/doctrees \ -- --jobs $(JOBS) \ -+ALLSPHINXOPTS = -b $(BUILDER) \ -+ -d build/doctrees \ -+ -j $(JOBS) \ - $(PAPEROPT_$(PAPER)) \ - $(SPHINXOPTS) $(SPHINXERRORHANDLING) \ - . build/$(BUILDER) $(SOURCES) -Index: Python-3.13.6/Doc/c-api/arg.rst -=================================================================== ---- Python-3.13.6.orig/Doc/c-api/arg.rst 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/c-api/arg.rst 2025-08-07 12:16:58.254160756 +0200 +--- Python-3.13.9.orig/Doc/c-api/arg.rst 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/c-api/arg.rst 2025-11-04 17:41:42.876411055 +0100 @@ -334,7 +334,6 @@ should raise an exception and leave the content of *address* unmodified. @@ -63,10 +38,10 @@ Index: Python-3.13.6/Doc/c-api/arg.rst If the *converter* returns :c:macro:`!Py_CLEANUP_SUPPORTED`, it may get called a second time if the argument parsing eventually fails, giving the converter a -Index: Python-3.13.6/Doc/c-api/typeobj.rst +Index: Python-3.13.9/Doc/c-api/typeobj.rst =================================================================== ---- Python-3.13.6.orig/Doc/c-api/typeobj.rst 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/c-api/typeobj.rst 2025-08-07 12:16:58.254692184 +0200 +--- Python-3.13.9.orig/Doc/c-api/typeobj.rst 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/c-api/typeobj.rst 2025-11-04 17:41:42.877033887 +0100 @@ -610,7 +610,7 @@ Functions like :c:func:`PyObject_NewVar` will take the value of N as an argument, and store in the instance's :c:member:`~PyVarObject.ob_size` field. @@ -97,10 +72,10 @@ Index: Python-3.13.6/Doc/c-api/typeobj.rst include :c:type:`PyObject` or :c:type:`PyVarObject` (depending on whether :c:member:`~PyVarObject.ob_size` should be included). These are usually defined by the macro :c:macro:`PyObject_HEAD` or -Index: Python-3.13.6/Doc/conf.py +Index: Python-3.13.9/Doc/conf.py =================================================================== ---- Python-3.13.6.orig/Doc/conf.py 2025-08-07 12:16:45.115568663 +0200 -+++ Python-3.13.6/Doc/conf.py 2025-08-07 12:16:58.255236531 +0200 +--- Python-3.13.9.orig/Doc/conf.py 2025-11-04 17:39:03.414159687 +0100 ++++ Python-3.13.9/Doc/conf.py 2025-11-04 17:41:42.877735198 +0100 @@ -11,6 +11,8 @@ from importlib import import_module from importlib.util import find_spec @@ -136,7 +111,7 @@ Index: Python-3.13.6/Doc/conf.py # Create table of contents entries for domain objects (e.g. functions, classes, # attributes, etc.). Default is True. -@@ -258,6 +260,9 @@ +@@ -257,6 +259,9 @@ # Avoid a warning with Sphinx >= 4.0 root_doc = 'contents' @@ -146,7 +121,7 @@ Index: Python-3.13.6/Doc/conf.py # Allow translation of index directives gettext_additional_targets = [ 'index', -@@ -297,7 +302,7 @@ +@@ -296,7 +301,7 @@ # (See .readthedocs.yml and https://docs.readthedocs.io/en/stable/reference/environment-variables.html) is_deployment_preview = os.getenv("READTHEDOCS_VERSION_TYPE") == "external" repository_url = os.getenv("READTHEDOCS_GIT_CLONE_URL", "") @@ -172,10 +147,10 @@ Index: Python-3.13.6/Doc/conf.py # Options for c_annotations extension # ----------------------------------- -Index: Python-3.13.6/Doc/library/doctest.rst +Index: Python-3.13.9/Doc/library/doctest.rst =================================================================== ---- Python-3.13.6.orig/Doc/library/doctest.rst 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/library/doctest.rst 2025-08-07 12:16:58.255583157 +0200 +--- Python-3.13.9.orig/Doc/library/doctest.rst 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/library/doctest.rst 2025-11-04 17:41:42.878188221 +0100 @@ -310,7 +310,6 @@ .. currentmodule:: None @@ -184,10 +159,10 @@ Index: Python-3.13.6/Doc/library/doctest.rst .. currentmodule:: doctest -Index: Python-3.13.6/Doc/library/email.compat32-message.rst +Index: Python-3.13.9/Doc/library/email.compat32-message.rst =================================================================== ---- Python-3.13.6.orig/Doc/library/email.compat32-message.rst 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/library/email.compat32-message.rst 2025-08-07 12:16:58.256095517 +0200 +--- Python-3.13.9.orig/Doc/library/email.compat32-message.rst 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/library/email.compat32-message.rst 2025-11-04 17:41:42.878726754 +0100 @@ -7,7 +7,6 @@ :synopsis: The base class representing email messages in a fashion backward compatible with Python 3.2 @@ -196,10 +171,10 @@ Index: Python-3.13.6/Doc/library/email.compat32-message.rst The :class:`Message` class is very similar to the -Index: Python-3.13.6/Doc/library/xml.etree.elementtree.rst +Index: Python-3.13.9/Doc/library/xml.etree.elementtree.rst =================================================================== ---- Python-3.13.6.orig/Doc/library/xml.etree.elementtree.rst 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/library/xml.etree.elementtree.rst 2025-08-07 12:16:58.256380542 +0200 +--- Python-3.13.9.orig/Doc/library/xml.etree.elementtree.rst 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/library/xml.etree.elementtree.rst 2025-11-04 17:41:42.879107050 +0100 @@ -873,7 +873,6 @@ .. module:: xml.etree.ElementTree @@ -208,10 +183,10 @@ Index: Python-3.13.6/Doc/library/xml.etree.elementtree.rst .. class:: Element(tag, attrib={}, **extra) -Index: Python-3.13.6/Doc/tools/check-warnings.py +Index: Python-3.13.9/Doc/tools/check-warnings.py =================================================================== ---- Python-3.13.6.orig/Doc/tools/check-warnings.py 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/tools/check-warnings.py 2025-08-07 12:16:58.256796101 +0200 +--- Python-3.13.9.orig/Doc/tools/check-warnings.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/tools/check-warnings.py 2025-11-04 17:41:42.879425179 +0100 @@ -228,7 +228,8 @@ print(filename) for warning in warnings: @@ -231,10 +206,10 @@ Index: Python-3.13.6/Doc/tools/check-warnings.py for warning in warnings if "Doc/" in warning } -Index: Python-3.13.6/Doc/tools/extensions/audit_events.py +Index: Python-3.13.9/Doc/tools/extensions/audit_events.py =================================================================== ---- Python-3.13.6.orig/Doc/tools/extensions/audit_events.py 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/tools/extensions/audit_events.py 2025-08-07 12:16:58.257103336 +0200 +--- Python-3.13.9.orig/Doc/tools/extensions/audit_events.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/tools/extensions/audit_events.py 2025-11-04 17:41:42.879679368 +0100 @@ -1,9 +1,6 @@ """Support for documenting audit events.""" @@ -370,10 +345,10 @@ Index: Python-3.13.6/Doc/tools/extensions/audit_events.py ) -> nodes.row: row = nodes.row() name_node = nodes.paragraph("", nodes.Text(name)) -Index: Python-3.13.6/Doc/tools/extensions/availability.py +Index: Python-3.13.9/Doc/tools/extensions/availability.py =================================================================== ---- Python-3.13.6.orig/Doc/tools/extensions/availability.py 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/tools/extensions/availability.py 2025-08-07 12:16:58.257352322 +0200 +--- Python-3.13.9.orig/Doc/tools/extensions/availability.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/tools/extensions/availability.py 2025-11-04 17:41:42.879900324 +0100 @@ -1,8 +1,6 @@ """Support for documenting platform availability""" @@ -427,10 +402,10 @@ Index: Python-3.13.6/Doc/tools/extensions/availability.py app.add_directive("availability", Availability) return { -Index: Python-3.13.6/Doc/tools/extensions/c_annotations.py +Index: Python-3.13.9/Doc/tools/extensions/c_annotations.py =================================================================== ---- Python-3.13.6.orig/Doc/tools/extensions/c_annotations.py 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/tools/extensions/c_annotations.py 2025-08-07 12:16:58.257571556 +0200 +--- Python-3.13.9.orig/Doc/tools/extensions/c_annotations.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/tools/extensions/c_annotations.py 2025-11-04 17:41:42.880074051 +0100 @@ -9,22 +9,26 @@ * Set ``stable_abi_file`` to the path to stable ABI list. """ @@ -568,10 +543,10 @@ Index: Python-3.13.6/Doc/tools/extensions/c_annotations.py return { "version": "1.0", "parallel_read_safe": True, -Index: Python-3.13.6/Doc/tools/extensions/changes.py +Index: Python-3.13.9/Doc/tools/extensions/changes.py =================================================================== ---- Python-3.13.6.orig/Doc/tools/extensions/changes.py 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/tools/extensions/changes.py 2025-08-07 12:16:58.257773818 +0200 +--- Python-3.13.9.orig/Doc/tools/extensions/changes.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/tools/extensions/changes.py 2025-11-04 17:41:42.880259370 +0100 @@ -1,7 +1,5 @@ """Support for documenting version of changes, additions, deprecations.""" @@ -607,10 +582,10 @@ Index: Python-3.13.6/Doc/tools/extensions/changes.py # Override Sphinx's directives with support for 'next' app.add_directive("versionadded", PyVersionChange, override=True) app.add_directive("versionchanged", PyVersionChange, override=True) -Index: Python-3.13.6/Doc/tools/extensions/glossary_search.py +Index: Python-3.13.9/Doc/tools/extensions/glossary_search.py =================================================================== ---- Python-3.13.6.orig/Doc/tools/extensions/glossary_search.py 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/tools/extensions/glossary_search.py 2025-08-07 12:16:58.257959947 +0200 +--- Python-3.13.9.orig/Doc/tools/extensions/glossary_search.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/tools/extensions/glossary_search.py 2025-11-04 17:41:42.880446332 +0100 @@ -1,21 +1,27 @@ """Feature search results for glossary items prominently.""" @@ -654,10 +629,10 @@ Index: Python-3.13.6/Doc/tools/extensions/glossary_search.py app.connect('doctree-resolved', process_glossary_nodes) app.connect('build-finished', write_glossary_json) -Index: Python-3.13.6/Doc/tools/extensions/implementation_detail.py +Index: Python-3.13.9/Doc/tools/extensions/implementation_detail.py =================================================================== ---- Python-3.13.6.orig/Doc/tools/extensions/implementation_detail.py 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/tools/extensions/implementation_detail.py 2025-08-07 12:16:58.258140488 +0200 +--- Python-3.13.9.orig/Doc/tools/extensions/implementation_detail.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/tools/extensions/implementation_detail.py 2025-11-04 17:41:42.880613957 +0100 @@ -1,17 +1,10 @@ """Support for marking up implementation details.""" @@ -708,10 +683,10 @@ Index: Python-3.13.6/Doc/tools/extensions/implementation_detail.py app.add_directive("impl-detail", ImplementationDetail) return { -Index: Python-3.13.6/Doc/tools/extensions/issue_role.py +Index: Python-3.13.9/Doc/tools/extensions/issue_role.py =================================================================== ---- Python-3.13.6.orig/Doc/tools/extensions/issue_role.py 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/tools/extensions/issue_role.py 2025-08-07 12:16:58.258306293 +0200 +--- Python-3.13.9.orig/Doc/tools/extensions/issue_role.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/tools/extensions/issue_role.py 2025-11-04 17:41:42.880769320 +0100 @@ -1,22 +1,18 @@ """Support for referencing issues in the tracker.""" @@ -757,10 +732,10 @@ Index: Python-3.13.6/Doc/tools/extensions/issue_role.py app.add_role("issue", BPOIssue()) app.add_role("gh", GitHubIssue()) -Index: Python-3.13.6/Doc/tools/extensions/misc_news.py +Index: Python-3.13.9/Doc/tools/extensions/misc_news.py =================================================================== ---- Python-3.13.6.orig/Doc/tools/extensions/misc_news.py 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/tools/extensions/misc_news.py 2025-08-07 12:16:58.258481107 +0200 +--- Python-3.13.9.orig/Doc/tools/extensions/misc_news.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/tools/extensions/misc_news.py 2025-11-04 17:41:42.880942406 +0100 @@ -1,7 +1,5 @@ """Support for including Misc/NEWS.""" @@ -813,10 +788,10 @@ Index: Python-3.13.6/Doc/tools/extensions/misc_news.py app.add_directive("miscnews", MiscNews) return { -Index: Python-3.13.6/Doc/tools/extensions/patchlevel.py +Index: Python-3.13.9/Doc/tools/extensions/patchlevel.py =================================================================== ---- Python-3.13.6.orig/Doc/tools/extensions/patchlevel.py 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/tools/extensions/patchlevel.py 2025-08-07 12:16:58.258716335 +0200 +--- Python-3.13.9.orig/Doc/tools/extensions/patchlevel.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/tools/extensions/patchlevel.py 2025-11-04 17:41:42.881098319 +0100 @@ -3,7 +3,7 @@ import re import sys @@ -854,10 +829,10 @@ Index: Python-3.13.6/Doc/tools/extensions/patchlevel.py version = f"{info.major}.{info.minor}" release = f"{info.major}.{info.minor}.{info.micro}" if info.releaselevel != "final": -Index: Python-3.13.6/Doc/tools/extensions/pydoc_topics.py +Index: Python-3.13.9/Doc/tools/extensions/pydoc_topics.py =================================================================== ---- Python-3.13.6.orig/Doc/tools/extensions/pydoc_topics.py 2025-08-06 15:05:20.000000000 +0200 -+++ Python-3.13.6/Doc/tools/extensions/pydoc_topics.py 2025-08-07 12:16:58.258911962 +0200 +--- Python-3.13.9.orig/Doc/tools/extensions/pydoc_topics.py 2025-10-14 15:52:31.000000000 +0200 ++++ Python-3.13.9/Doc/tools/extensions/pydoc_topics.py 2025-11-04 17:41:42.881251888 +0100 @@ -1,21 +1,23 @@ """Support for building "topic help" for pydoc.""" diff --git a/gh126985-mv-pyvenv.cfg2getpath.patch b/gh126985-mv-pyvenv.cfg2getpath.patch index d4dace5..810464f 100644 --- a/gh126985-mv-pyvenv.cfg2getpath.patch +++ b/gh126985-mv-pyvenv.cfg2getpath.patch @@ -8,10 +8,10 @@ Date: Tue Nov 26 13:46:33 2024 +0000 Lib/test/test_sysconfig.py | 67 --------------------------------------------- 1 file changed, 1 insertion(+), 66 deletions(-) -Index: Python-3.13.5/Lib/test/test_sysconfig.py +Index: Python-3.13.9/Lib/test/test_sysconfig.py =================================================================== ---- Python-3.13.5.orig/Lib/test/test_sysconfig.py 2025-06-12 19:55:42.184491497 +0200 -+++ Python-3.13.5/Lib/test/test_sysconfig.py 2025-06-12 19:56:05.737665419 +0200 +--- Python-3.13.9.orig/Lib/test/test_sysconfig.py 2025-11-04 17:41:28.521386489 +0100 ++++ Python-3.13.9/Lib/test/test_sysconfig.py 2025-11-04 17:42:36.888243505 +0100 @@ -110,6 +110,7 @@ **venv_create_args, ) @@ -20,7 +20,7 @@ Index: Python-3.13.5/Lib/test/test_sysconfig.py def test_get_path_names(self): self.assertEqual(get_path_names(), sysconfig._SCHEME_KEYS) -@@ -604,72 +605,6 @@ +@@ -611,72 +612,6 @@ suffix = sysconfig.get_config_var('EXT_SUFFIX') self.assertTrue(suffix.endswith('-darwin.so'), suffix) diff --git a/python313.changes b/python313.changes index 0793f2d..ed8b40c 100644 --- a/python313.changes +++ b/python313.changes @@ -1,3 +1,18 @@ +------------------------------------------------------------------- +Tue Nov 4 16:44:05 UTC 2025 - Matej Cepl + +- Add CVE-2025-8291-consistency-zip64.patch which checks + consistency of the zip64 end of central directory record, and + preventing obfuscation of the payload, i.e., you scanning for + malicious content in a ZIP file with one ZIP parser (let's say + a Rust one) then unpack it in production with another (e.g., + the Python one) and get malicious content that the other parser + did not see (CVE-2025-8291, bsc#1251305) +- Readjust patches while synchronizing between openSUSE and SLE trees: + - F00251-change-user-install-location.patch + - doc-py38-to-py36.patch + - gh126985-mv-pyvenv.cfg2getpath.patch + ------------------------------------------------------------------- Wed Oct 15 09:15:38 UTC 2025 - Daniel Garcia diff --git a/python313.spec b/python313.spec index 1335e0e..faf5685 100644 --- a/python313.spec +++ b/python313.spec @@ -235,6 +235,9 @@ Patch43: bsc1243155-sphinx-non-determinism.patch Patch44: gh138131-exclude-pycache-from-digest.patch # PATCH-FIX-OPENSUSE gh139257-Support-docutils-0.22.patch gh#python/cpython#139257 daniel.garcia@suse.com Patch45: gh139257-Support-docutils-0.22.patch +# PATCH-FIX-UPSTREAM CVE-2025-8291-consistency-zip64.patch bsc#1251305 mcepl@suse.com +# Check consistency of the zip64 end of central directory record +Patch46: CVE-2025-8291-consistency-zip64.patch BuildRequires: autoconf-archive BuildRequires: automake BuildRequires: fdupes