diff mbox series

[meta-python,wrynose,18/18] python3-virtualenv: Ignore CVE-2026-113724

Message ID 20261105090007.351866-19-hthakar@cisco.com
State New
Headers show
Series python3-virtualenv: Security fixes | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 5, 2026, 9 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- The advisory [1] describes a deletion-error callback changing the
  permissions of a symlink target.
- In 21.2.1, safe_delete() always passes ignore_errors=True to
  shutil.rmtree(), which disables the supplied error callback.
  This remains true after the existing security backports.
- Upstream enabled that callback later in [2]. The chmod recovery
  path fixed by [3] is therefore unreachable in this recipe.

Reference:
[1] https://github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq
[2] https://github.com/pypa/virtualenv/pull/3222
[3] https://github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb
index b554c3a4f8..d5f598e576 100644
--- a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb
+++ b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb
@@ -56,3 +56,4 @@  CVE_PRODUCT = "virtualenv"
 # The batch activator only supports Windows interpreters.
 CVE_STATUS[CVE-2026-102937] = "${@'not-applicable-platform: Windows cmd.exe batch activation is not selected for Linux interpreters' if (d.getVar('TARGET_OS') or '').startswith('linux') else ''}"
 CVE_STATUS[CVE-2026-113718] = "not-applicable-config: Xonsh activation was introduced in virtualenv 21.3.0 and is absent from 21.2.1"
+CVE_STATUS[CVE-2026-113724] = "not-applicable-config: safe_delete() uses ignore_errors=True, so its chmod error callback is unreachable"