diff mbox series

[meta-python,wrynose,02/18] python3-virtualenv: fix CVE-2026-102930

Message ID 20261105090007.351866-3-hthakar@cisco.com
State New
Headers show
Series python3-virtualenv: Security fixes | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 5, 2026, 8:59 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

Backport the seed-wheel digest check [1], as identified by advisory
[5]. Include prerequisite [2] so the expected digests are obtained
over verified HTTPS, and follow-up [3] so missing digests cannot
silently disable verification.

Include follow-up [4] to verify wheels in private staging before
caching them and to use the same verification for the pip seeder.
This also fixes CVE-2026-113714 and CVE-2026-113717, tracked in [6]
and [7]. Apply the TLS prerequisite before the three wheel fixes.

Add python3-packaging for the upstream wheel-name and version checks.
Keep virtualenv at version 21.2.1 without unrelated feature changes.

[1] https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d
[2] https://github.com/pypa/virtualenv/commit/48f6fdcc14b8654236f9081adbff10a32f536940
[3] https://github.com/pypa/virtualenv/commit/91460add8f53f4654c4aae3898e739c03fb69946
[4] https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96
[5] https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45
[6] https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3
[7] https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../CVE-2026-102930-dependent.patch           | 115 +++
 .../CVE-2026-102930_p1.patch                  | 309 +++++++
 .../CVE-2026-102930_p2.patch                  | 293 +++++++
 .../CVE-2026-102930_p3.patch                  | 777 ++++++++++++++++++
 .../python/python3-virtualenv_21.2.1.bb       |   5 +
 5 files changed, 1499 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930-dependent.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930_p1.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930_p2.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930_p3.patch
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930-dependent.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930-dependent.patch
new file mode 100644
index 0000000000..87da5978ce
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930-dependent.patch
@@ -0,0 +1,115 @@ 
+From 48f6fdcc14b8654236f9081adbff10a32f536940 Mon Sep 17 00:00:00 2001
+From: Bernát Gábor <gaborjbernat@gmail.com>
+Date: Tue, 14 Apr 2026 13:20:04 -0700
+Subject: [PATCH]