From b3fd0f03e5804a45231dec4cf0c92fe574b413bc Mon Sep 17 00:00:00 2001 From: Bo Ren Date: Tue, 12 Aug 2025 10:03:01 +0800 Subject: [PATCH] [CVE] add patch to Fix CVE-2025-47273 CVE-2024-6345 to #ICSH5E #ICSXT7 add patch to Fix CVE-2025-47273 Project: TC2024080204 Signed-off-by: Bo Ren --- CVE-2024-6345.patch | 104 +++++++++++++++++++++++++++++++++++++++++ CVE-2025-47273.patch | 28 +++++++++++ python-setuptools.spec | 10 +++- 3 files changed, 141 insertions(+), 1 deletion(-) create mode 100644 CVE-2024-6345.patch create mode 100644 CVE-2025-47273.patch diff --git a/CVE-2024-6345.patch b/CVE-2024-6345.patch new file mode 100644 index 0000000..c7a5608 --- /dev/null +++ b/CVE-2024-6345.patch @@ -0,0 +1,104 @@ +diff --git a/setuptools/package_index.py b/setuptools/package_index.py +index 3d6cd7a..ca21b5f 100644 +--- a/setuptools/package_index.py ++++ b/setuptools/package_index.py +@@ -1,6 +1,7 @@ + """PyPI and direct package downloading.""" + + import sys ++import subprocess + import os + import re + import io +@@ -886,17 +887,11 @@ class PackageIndex(Environment): + url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True) + + self.info("Doing git clone from %s to %s", url, filename) +- os.system("git clone --quiet %s %s" % (url, filename)) ++ subprocess.check_call(["git", "clone", "--quiet", url, filename]) + + if rev is not None: + self.info("Checking out %s", rev) +- os.system( +- "git -C %s checkout --quiet %s" +- % ( +- filename, +- rev, +- ) +- ) ++ subprocess.check_call(["git", "-C", filename, "checkout", "--quiet", rev]) + + return filename + +@@ -905,17 +900,11 @@ class PackageIndex(Environment): + url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True) + + self.info("Doing hg clone from %s to %s", url, filename) +- os.system("hg clone --quiet %s %s" % (url, filename)) ++ subprocess.check_call(["hg", "clone", "--quiet", url, filename]) + + if rev is not None: + self.info("Updating to %s", rev) +- os.system( +- "hg --cwd %s up -C -r %s -q" +- % ( +- filename, +- rev, +- ) +- ) ++ subprocess.check_call(["hg", "--cwd", filename, "up", "-C", "-r", rev, "-q"]) + + return filename + +diff --git a/setuptools/tests/test_packageindex.py b/setuptools/tests/test_packageindex.py +index f1fa745..24abc7d 100644 +--- a/setuptools/tests/test_packageindex.py ++++ b/setuptools/tests/test_packageindex.py +@@ -190,37 +190,37 @@ class TestPackageIndex: + url = 'git+https://github.example/group/project@master#egg=foo' + index = setuptools.package_index.PackageIndex() + +- with mock.patch("os.system") as os_system_mock: ++ with mock.patch("subprocess.check_call") as subprocess_check_call_mock: + result = index.download(url, str(tmpdir)) + +- os_system_mock.assert_called() ++ subprocess_check_call_mock.assert_called() + + expected_dir = str(tmpdir / 'project@master') + expected = ( + 'git clone --quiet ' 'https://github.example/group/project {expected_dir}' +- ).format(**locals()) +- first_call_args = os_system_mock.call_args_list[0][0] ++ ).format(**locals()).split() ++ first_call_args = subprocess_check_call__mock.call_args_list[0][0] + assert first_call_args == (expected,) + + tmpl = 'git -C {expected_dir} checkout --quiet master' +- expected = tmpl.format(**locals()) +- assert os_system_mock.call_args_list[1][0] == (expected,) ++ expected = tmpl.format(**locals()).split() ++ assert subprocess_check_call__mock.call_args_list[1][0] == (expected,) + assert result == expected_dir + + def test_download_git_no_rev(self, tmpdir): + url = 'git+https://github.example/group/project#egg=foo' + index = setuptools.package_index.PackageIndex() + +- with mock.patch("os.system") as os_system_mock: ++ with mock.patch("subprocess.check_call") as subprocess_check_call_mock: + result = index.download(url, str(tmpdir)) + +- os_system_mock.assert_called() ++ subprocess_check_call_mock.assert_called() + + expected_dir = str(tmpdir / 'project') + expected = ( + 'git clone --quiet ' 'https://github.example/group/project {expected_dir}' +- ).format(**locals()) +- os_system_mock.assert_called_once_with(expected) ++ ).format(**locals()).split() ++ subprocess_check_call_mock.assert_called_once_with(expected) + + def test_download_svn(self, tmpdir): + url = 'svn+https://svn.example/project#egg=foo' diff --git a/CVE-2025-47273.patch b/CVE-2025-47273.patch new file mode 100644 index 0000000..65e23e4 --- /dev/null +++ b/CVE-2025-47273.patch @@ -0,0 +1,28 @@ +From 08536b9b318a81818295a421636c82a63c775a79 Mon Sep 17 00:00:00 2001 +From: "Jason R. Coombs" +Date: Mon, 11 Aug 2025 17:58:04 +0800 +Subject: [PATCH] Add a check to ensure the name resolves relative to + the tmpdir. + +--- + setuptools/package_index.py | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/setuptools/package_index.py b/setuptools/package_index.py +index 3130ace..3d6cd7a 100644 +--- a/setuptools/package_index.py ++++ b/setuptools/package_index.py +@@ -828,6 +828,10 @@ class PackageIndex(Environment): + + filename = os.path.join(tmpdir, name) + ++ # ensure path resolves within the tmpdir ++ if not filename.startswith(str(tmpdir)): ++ raise ValueError(f"Invalid filename {filename}") ++ + # Download the file + # + if scheme == 'svn' or scheme.startswith('svn+'): +-- +2.43.0 + diff --git a/python-setuptools.spec b/python-setuptools.spec index 38f978a..a69c023 100644 --- a/python-setuptools.spec +++ b/python-setuptools.spec @@ -1,4 +1,4 @@ -%define anolis_release 2 +%define anolis_release 3 %bcond_with tests %global srcname setuptools @@ -12,6 +12,10 @@ Summary: Easily build and distribute Python packages License: MIT and ASL 2.0 and (BSD or ASL 2.0) and Python URL: https://pypi.python.org/pypi/%{srcname} Source0: %{pypi_source %{srcname} %{version}} +# https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b +Patch1: CVE-2025-47273.patch +# https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0 +Patch2: CVE-2024-6345.patch BuildArch: noarch BuildRequires: python3-devel @@ -133,6 +137,10 @@ PYTHONPATH=$(pwd) %pytest \ %doc CHANGES.rst README.rst %changelog +* Mon Aug 11 2025 Bo Ren - - 68.0.0-3 +- fix CVE-2025-47273 +- fix CVE-2024-6345 + * Mon Mar 11 2024 Zhao Hang - 68.0.0-2 - Rebuild with python3.11 -- Gitee