Fix CVE-2026-9323: use secure random session identifiers in web display

Backport upstream commit 1a2fda3 to replace insecure
PRNG-based session identifiers with cryptographically secure
UUIDs in the web display module. The patch replaces
`import random` with `import uuid`, uses `uuid.uuid4().hex`
for generating session IDs, and updates the pipe name prefix
to `urwid_` for consistency with upstream.

CVE: CVE-2026-9323
Upstream patches:
 - 1a2fda3470.patch
Resolves: RHEL-212562

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir

python-urwid-1.3.1-CVE-2026-9323.patch

@@ -0,0 +1,35 @@
+From 399db11a836d02ff0ccf150d20508841dab69079 Mon Sep 17 00:00:00 2001
+From: Aleksei Stepanov <penguinolog@users.noreply.github.com>
+Date: Tue, 28 Apr 2026 16:38:21 +0200
+Subject: [PATCH] Web display: use secure random session identifiers (#1128)
+
+Use UUID4 instead of pseudorandom numeric
+---
+ urwid/web_display.py | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/urwid/web_display.py b/urwid/web_display.py
+index 44a505c..4eb5ccf 100755
+--- a/urwid/web_display.py
++++ b/urwid/web_display.py
+@@ -25,7 +25,7 @@ Urwid web application display module
+ import os
+ import sys
+ import signal
+-import random
++import uuid
+ import select
+ import socket
+ import glob
+@@ -656,9 +656,8 @@ class Screen:
+             sys.stdout.write("Status: 503 Sever Busy\r\n\r\n")
+             sys.exit(0)
+ 
+-        urwid_id = "%09d%09d"%(random.randrange(10**9),
+-            random.randrange(10**9))
+-        self.pipe_name = os.path.join(_prefs.pipe_dir,"urwid"+urwid_id)
++        urwid_id = uuid.uuid4().hex
++        self.pipe_name = os.path.join(_prefs.pipe_dir,"urwid_"+urwid_id)
+         os.mkfifo(self.pipe_name+".in",0600)
+         signal.signal(signal.SIGTERM,self._cleanup_pipe)
+ 

python-urwid.spec

@@ -1,6 +1,6 @@
 Name:          python-urwid
 Version:       1.3.1
-Release:       4%{?dist}
+Release:       5%{?dist}
 Summary:       Console user interface library
 
 License:       LGPLv2+
@@ -16,6 +16,10 @@ Patch1:        python-urwid-test_vterm-NUL.patch
 # https://github.com/urwid/urwid/commit/4b0ed8b6030450e6d99909a7c683e9642e546387
 Patch2:        python-urwid-test_event_loops.patch
 
+# https://issues.redhat.com/browse/RHEL-212562
+# https://github.com/urwid/urwid/commit/1a2fda3470be49c1ada06b6f262c0456ec957df5
+Patch3:        python-urwid-1.3.1-CVE-2026-9323.patch
+
 %global _description\
 Urwid is a Python library for making text console applications.  It has\
 many features including fluid interface resizing, support for UTF-8 and\
@@ -41,6 +45,7 @@ BuildRequires: %{_bindir}/2to3
 %patch0 -p1
 %patch1 -p1
 %patch2 -p1
+%patch3 -p1
 find urwid -type f -name "*.py" -exec sed -i -e '/^#!\//, 1d' {} \;
 find urwid -type f -name "*.py" -exec chmod 644 {} \;
 
@@ -62,6 +67,10 @@ find examples -type f -exec chmod 0644 \{\} \;
 %{python3_sitearch}/urwid-%{version}*.egg-info
 
 %changelog
+* Tue Jul 21 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.3.1-5
+- Use secure random session identifiers in web display (CVE-2026-9323)
+- Resolves: RHEL-212562
+
 * Thu May 31 2018 Petr Viktorin <pviktori@redhat.com> - 1.3.1-4
 - Remove Python 2 subpackage
   https://bugzilla.redhat.com/show_bug.cgi?id=1567166