diff --git a/CVE-2026-24049.patch b/CVE-2026-24049.patch new file mode 100644 index 0000000..fbdf302 --- /dev/null +++ b/CVE-2026-24049.patch @@ -0,0 +1,126 @@ +From 7a7d2de96b22a9adf9208afcc9547e1001569fef Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Alex=20Gr=C3=B6nholm?= +Date: Thu, 22 Jan 2026 01:41:14 +0200 +Subject: [PATCH] Fixed security issue around wheel unpack (#675) + +A maliciously crafted wheel could cause the permissions of a file outside the unpack tree to be altered. + +Fixes CVE-2026-24049. +--- + docs/news.rst | 2 ++ + src/wheel/_commands/unpack.py | 4 ++-- + tests/commands/test_unpack.py | 23 +++++++++++++++++++++++ + 3 files changed, 27 insertions(+), 2 deletions(-) + +Index: wheel-0.42.0/src/wheel/cli/unpack.py +=================================================================== +--- wheel-0.42.0.orig/src/wheel/cli/unpack.py ++++ wheel-0.42.0/src/wheel/cli/unpack.py +@@ -19,12 +19,12 @@ def unpack(path: str, dest: str = ".") - + destination = Path(dest) / namever + print(f"Unpacking to: {destination}...", end="", flush=True) + for zinfo in wf.filelist: +- wf.extract(zinfo, destination) ++ target_path = Path(wf.extract(zinfo, destination)) + + # Set permissions to the same values as they were set in the archive + # We have to do this manually due to + # https://github.com/python/cpython/issues/59999 + permissions = zinfo.external_attr >> 16 & 0o777 +- destination.joinpath(zinfo.filename).chmod(permissions) ++ target_path.chmod(permissions) + + print("OK") +Index: wheel-0.42.0/tests/cli/test_unpack.py +=================================================================== +--- wheel-0.42.0.orig/tests/cli/test_unpack.py ++++ wheel-0.42.0/tests/cli/test_unpack.py +@@ -8,6 +8,7 @@ import pytest + from wheel.cli.unpack import unpack + from wheel.wheelfile import WheelFile + ++from .util import run_command + + def test_unpack(wheel_paths, tmp_path): + """ +@@ -34,3 +35,26 @@ def test_unpack_executable_bit(tmp_path) + unpack(str(wheel_path), str(tmp_path)) + assert not script_path.is_dir() + assert stat.S_IMODE(script_path.stat().st_mode) == 0o755 ++ ++ ++@pytest.mark.skipif( ++ platform.system() == "Windows", reason="Windows does not support chmod()" ++) ++def test_chmod_outside_unpack_tree(tmp_path_factory: TempPathFactory) -> None: ++ wheel_path = tmp_path_factory.mktemp("build") / "test-1.0-py3-none-any.whl" ++ with WheelFile(wheel_path, "w") as wf: ++ wf.writestr( ++ "test-1.0.dist-info/METADATA", ++ "Metadata-Version: 2.4\nName: test\nVersion: 1.0\n", ++ ) ++ wf.writestr("../../system-file", b"malicious data") ++ ++ extract_root_path = tmp_path_factory.mktemp("extract") ++ system_file = extract_root_path / "system-file" ++ extract_path = extract_root_path / "subdir" ++ system_file.write_bytes(b"important data") ++ system_file.chmod(0o755) ++ run_command("unpack", "--dest", extract_path, wheel_path) ++ ++ assert system_file.read_bytes() == b"important data" ++ assert stat.S_IMODE(system_file.stat().st_mode) == 0o755 +Index: wheel-0.42.0/tests/cli/util.py +=================================================================== +--- /dev/null ++++ wheel-0.42.0/tests/cli/util.py +@@ -0,0 +1,43 @@ ++from __future__ import annotations ++ ++import sys ++from io import StringIO ++from os import PathLike ++from subprocess import CalledProcessError ++from unittest.mock import patch ++ ++import pytest ++ ++from wheel.cli import main ++ ++ ++def run_command( ++ command: str, *args: str | PathLike, catch_systemexit: bool = True ++) -> str: ++ returncode = 0 ++ stdout = StringIO() ++ stderr = StringIO() ++ args = ("wheel", command) + tuple(str(arg) for arg in args) ++ with ( ++ patch.object(sys, "argv", args), ++ patch.object(sys, "stdout", stdout), ++ patch.object(sys, "stderr", stderr), ++ ): ++ try: ++ main() ++ except SystemExit as exc: ++ if not catch_systemexit: ++ raise CalledProcessError( ++ exc.code, args, stdout.getvalue(), stderr.getvalue() ++ ) from exc ++ ++ returncode = exc.code ++ ++ if returncode: ++ pytest.fail( ++ f"'wheel {command}' exited with return code {returncode}\n" ++ f"arguments: {args}\n" ++ f"error output:\n{stderr.getvalue()}" ++ ) ++ ++ return stdout.getvalue() +Index: wheel-0.42.0/tests/cli/__init__.py +=================================================================== +--- /dev/null ++++ wheel-0.42.0/tests/cli/__init__.py +@@ -0,0 +1 @@ ++ diff --git a/python-wheel.changes b/python-wheel.changes index cc55e63..ecbfb54 100644 --- a/python-wheel.changes +++ b/python-wheel.changes @@ -1,3 +1,8 @@ +------------------------------------------------------------------- +Wed Jan 28 09:12:46 UTC 2026 - Nico Krapp + +- Add CVE-2026-24049.patch to fix CVE-2026-24049 (bsc#1257100) + ------------------------------------------------------------------- Thu Mar 27 10:29:43 UTC 2025 - Markéta Machová diff --git a/python-wheel.spec b/python-wheel.spec index 277a516..223ed5e 100644 --- a/python-wheel.spec +++ b/python-wheel.spec @@ -40,7 +40,9 @@ Group: Development/Languages/Python URL: https://github.com/pypa/wheel Source: https://github.com/pypa/wheel/archive/%{version}.tar.gz#/wheel-%{version}.tar.gz # PATCH-FIX-UPSTREAM https://github.com/pypa/wheel/pull/651 fix test failures -Patch: tests.patch +Patch0: tests.patch +# PATCH-FIX-UPSTREAM CVE-2026-24049.patch bsc#1257100 gh#pypa/wheel@7a7d2de +Patch1: CVE-2026-24049.patch # Bootstrap: Don't BuildRequire setuptools or pip here! BuildRequires: %{python_module base >= 3.8} BuildRequires: %{python_module flit-core}