import UBI python3.9-3.9.25-7.el9_8.3

SOURCES/00492-cve-2026-11940.patch

@@ -0,0 +1,93 @@
+From 8db3857331be8920c65f641c2d57e4e51f71d6bc Mon Sep 17 00:00:00 2001
+From: Stan Ulbrych <stan@python.org>
+Date: Tue, 23 Jun 2026 14:31:38 +0100
+Subject: [PATCH 1/2] gh-151558: Fix symlink escape via `tarfile`
+ hardlink-extraction fallback (GH-151559)
+
+---
+ Lib/tarfile.py           |  3 +++
+ Lib/test/test_tarfile.py | 25 +++++++++++++++++++++++++
+ 2 files changed, 28 insertions(+)
+
+diff --git a/Lib/tarfile.py b/Lib/tarfile.py
+index fa3f922647..191fd38cba 100755
+--- a/Lib/tarfile.py
++++ b/Lib/tarfile.py
+@@ -2668,6 +2668,9 @@ class TarFile(object):
+                     "makelink_with_filter: if filter_function is not None, "
+                     + "extraction_root must also not be None")
+             try:
++                filter_function(
++                    unfiltered.replace(name=tarinfo.name, deep=False),
++                    extraction_root)
+                 filtered = filter_function(unfiltered, extraction_root)
+             except _FILTER_ERRORS as cause:
+                 raise LinkFallbackError(tarinfo, unfiltered.name) from cause
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index 8b9aea223c..34d0cff17b 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -3854,6 +3854,31 @@ class TestExtractionFilters(unittest.TestCase):
+                     self.expect_file("boom", symlink_to='../../link_here')
+                     self.expect_file("c", symlink_to='b')
+ 
++    @symlink_test
++    def test_sneaky_hardlink_fallback_deep(self):
++        # (CVE-2026-11940)
++        with ArchiveMaker() as arc:
++            arc.add("a/b/s", symlink_to=os.path.join("..", "escape"))
++            arc.add("s", hardlink_to=os.path.join("a", "b", "s"))
++
++        with self.check_context(arc.open(), 'data'):
++            e = self.expect_exception(
++                tarfile.LinkFallbackError,
++                "link 's' would be extracted as a copy of "
++                + "'a/b/s', which was rejected")
++            self.assertIsInstance(e.__cause__,
++                                  tarfile.LinkOutsideDestinationError)
++
++        for filter in 'tar', 'fully_trusted':
++            with self.subTest(filter), self.check_context(arc.open(), filter):
++                if not support.can_symlink():
++                    self.expect_file("a/")
++                    self.expect_file("a/b/")
++                else:
++                    self.expect_file("a/b/s", symlink_to=os.path.join('..', 'escape'))
++                    self.expect_file("s", symlink_to=os.path.join('..', 'escape'))
++
++    @symlink_test
+     def test_exfiltration_via_symlink(self):
+         # (CVE-2025-4138)
+         # Test changing symlinks that result in a symlink pointing outside
+
+From b803c1f883f01db47a9ae28a79c5caedb859cfce Mon Sep 17 00:00:00 2001
+From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
+Date: Thu, 6 Aug 2026 09:39:24 +0000
+Subject: [PATCH 2/2] Fix: replace undefined symlink_test decorator with
+ support.skip_unless_symlink for Python 3.9
+
+---
+ Lib/test/test_tarfile.py | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index 34d0cff17b..e45ca141c9 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -3854,7 +3854,7 @@ class TestExtractionFilters(unittest.TestCase):
+                     self.expect_file("boom", symlink_to='../../link_here')
+                     self.expect_file("c", symlink_to='b')
+ 
+-    @symlink_test
++    @support.skip_unless_symlink
+     def test_sneaky_hardlink_fallback_deep(self):
+         # (CVE-2026-11940)
+         with ArchiveMaker() as arc:
+@@ -3878,7 +3878,6 @@ class TestExtractionFilters(unittest.TestCase):
+                     self.expect_file("a/b/s", symlink_to=os.path.join('..', 'escape'))
+                     self.expect_file("s", symlink_to=os.path.join('..', 'escape'))
+ 
+-    @symlink_test
+     def test_exfiltration_via_symlink(self):
+         # (CVE-2025-4138)
+         # Test changing symlinks that result in a symlink pointing outside

SPECS/python3.9.spec

@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 7%{?dist}.2
+Release: 7%{?dist}.3
 License: Python
 
 
@@ -519,6 +519,12 @@ Patch489: 00489-openssl-3.5.7.patch
 # only joined and parsed once enough has piled up.
 Patch490: 00490-cve-2026-15308.patch
 
+# 00492 #
+# CVE-2026-11940
+#
+# Fix symlink escape via tarfile hardlink-extraction fallback
+Patch492: 00492-cve-2026-11940.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1930,6 +1936,10 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Aug 06 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.9.25-7.3
+- Security fix for CVE-2026-11940
+Resolves: RHEL-227228
+
 * Mon Jul 13 2026 Lukáš Zachar <lzachar@redhat.com> - 3.9.25-7.2
 - Security fix for CVE-2026-15308
 Resolves: RHEL-193786