[Midnightbsd-cvs] [MidnightBSD/mports] bcde34: lang/python313: fix CVE-2026-12345 (tempfile.Tempo...

[Lucas Holt]

  Branch: refs/heads/lang/python313
  Home:   https://github.com/MidnightBSD/mports
  Commit: bcde342b5fe545d43b398f68a4302317bb6a0ce8
      https://github.com/MidnightBSD/mports/commit/bcde342b5fe545d43b398f68a4302317bb6a0ce8
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-29 (Tue, 29 Sep 2026)

  Changed paths:
    M lang/python313/Makefile
    A lang/python313/files/patch-Lib_shutil.py
    A lang/python313/files/patch-Lib_tempfile.py

  Log Message:
  -----------
  lang/python313: fix CVE-2026-12345 (tempfile.TemporaryDirectory race)

Backport the Lib/shutil.py and Lib/tempfile.py changes from
python/cpython#158429 (3.13 backport of gh-157580). TemporaryDirectory
cleanup could be redirected through a symlink swapped in during
removal, deleting files or resetting permissions/flags outside the
temporary directory. Also covers lang/python313t (same MASTERDIR).

One tempfile.py hunk was adjusted by hand: the 3.13 branch has an
unrelated DragonFly BSD IsADirectoryError change that 3.13.11 lacks;
that change is not included. The upstream test changes are not
included: they depend on test.support.requires_non_root_user, which is
only on main.

AI-Assisted-by: Claude Opus 5.5 <noreply at anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications