[Midnightbsd-cvs] [MidnightBSD/mports] 976f47: lang/python314: fix CVE-2026-12345 (tempfile.Tempo...

[Lucas Holt]

  Branch: refs/heads/lang/python314
  Home:   https://github.com/MidnightBSD/mports
  Commit: 976f47c49c3006a39f3f1fc62ee71b3692d342fc
      https://github.com/MidnightBSD/mports/commit/976f47c49c3006a39f3f1fc62ee71b3692d342fc
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-29 (Tue, 29 Sep 2026)

  Changed paths:
    M lang/python314/Makefile
    A lang/python314/files/patch-Lib_shutil.py
    A lang/python314/files/patch-Lib_tempfile.py

  Log Message:
  -----------
  lang/python314: fix CVE-2026-12345 (tempfile.TemporaryDirectory race)

Backport the Lib/shutil.py and Lib/tempfile.py changes from
python/cpython#158430 (3.14 backport of gh-157580). TemporaryDirectory
cleanup could be redirected through a symlink swapped in during
removal, deleting files or resetting permissions/flags outside the
temporary directory.

The upstream test changes are not included: they depend on
test.support.requires_non_root_user, which is only on main.

AI-Assisted-by: Claude Opus 5.5 <noreply at anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications