rpms/python3
7
0
Fork 0
Code Issues Pull Requests Releases Activity
Interpreter of the Python programming language
35 Commits 6 Branches 81 Tags 1.6 MiB
Python 46.7%
Roff 30.9%
Shell 22.4%
294a585edf
Go to file
RHEL Packaging Agent 294a585edf Fix CVE-2026-11940: symlink escape via tarfile hardlink fallback 
Security fix for CVE-2026-11940: a symlink escape vulnerability
via tarfile hardlink-extraction fallback. The new backport patch
(00491-cve-2026-11940.patch) adds a filter check on the
hardlink's target name before performing the fallback copy,
preventing extraction of symlinks that point outside the
destination directory.

CVE: CVE-2026-11940
Upstream patches:
 - 27dd970bf6.patch
Resolves: RHEL-227194

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-08-10 15:50:24 +02:00
.fmf Use tmt for gating 2026-05-14 14:06:21 +02:00
.gitignore Replace whole repo with latest content from branch rhel-8.8.0 2023-05-15 16:41:20 +02:00
00001-rpath.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00102-lib64.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00111-no-static-lib.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00132-add-rpmbuild-hooks-to-unittest.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00155-avoid-ctypes-thunks.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00160-disable-test_fs_holes-in-rpm-build.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00163-disable-parts-of-test_socket-in-rpm-build.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00170-gc-assertions.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00189-use-rpm-wheels.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00251-change-user-install-location.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00257-threading-condition-wait.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00262-pep538_coerce_legacy_c_locale.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00294-define-TLS-cipher-suite-on-build-time.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00316-mark-bdist_wininst-unsupported.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00317-CVE-2019-5010.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00318-fixes-for-tls-13.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00319-test_tarfile_ppc64.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00320-CVE-2019-9636-and-CVE-2019-10160.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00324-disallow-control-chars-in-http-urls.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00325-CVE-2019-9948.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00326-do-not-set-PHA-verify-flag-on-client-side.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00327-enable-tls-1.3-PHA-in-http.client.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00329-fips.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00330-CVE-2018-20852.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00332-CVE-2019-16056.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00333-reduce-pgo-tests.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00338-fix-test_gdb-for-LTO.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00344-CVE-2019-16935.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00345-fix-test_site-with-extra-pth-files.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00346-CVE-2020-8492.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00351-avoid-infinite-loop-in-the-tarfile-module.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00352-resolve-hash-collisions-for-ipv4interface-and-ipv6interface.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00353-architecture-names-upstream-downstream.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00354-cve-2020-26116-http-request-method-crlf-injection-in-httplib.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00355-CVE-2020-27619.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00356-k_and_a_options_for_pathfix.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00357-CVE-2021-3177.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00359-CVE-2021-23336.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00360-CVE-2021-3426.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00362-threading-enumerate-rlock.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00364-thread-exit.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00366-CVE-2021-3733.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00368-CVE-2021-3737.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00369-rollover-only-regular-files-in-logging-handlers.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00370-GIL-monotonic-clock.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00372-CVE-2021-4189.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00377-CVE-2022-0391.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00378-support-expat-2-4-5.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00382-cve-2015-20107.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00386-cve-2021-28861.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00387-cve-2020-10735-prevent-dos-by-very-large-int.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00394-cve-2022-45061-cpu-denial-of-service-via-inefficient-idna-decoder.patch Import rpm: c8s 2023-02-27 15:12:25 -05:00
00397-tarfile-filter.patch Fix symlink handling in the fix for CVE-2007-4559 2023-08-10 16:58:21 +02:00
00399-cve-2023-24329.patch Security fix for CVE-2023-24329 2023-06-30 12:15:41 +02:00
00404-cve-2023-40217.patch Security fix for CVE-2023-40217 2023-09-25 22:00:45 +02:00
00408-CVE-2022-48560.patch Security fix for CVE-2022-48560 2023-11-28 15:14:15 +01:00
00413-CVE-2022-48564.patch Security fix for CVE-2022-48564 2023-12-12 13:06:27 +01:00
00414-skip_test_zlib_s390x.patch Skip two tests on s390x 2023-12-13 12:58:15 +01:00
00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch Security fix for CVE-2023-27043 2024-01-05 10:33:27 +01:00
00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch Fix build with expat with fixed CVE-2023-52425 2024-04-24 12:57:46 +02:00
00426-CVE-2023-6597.patch Security fix for CVE-2023-6597 2024-04-24 12:57:46 +02:00
00427-CVE-2024-0450.patch Security fix for CVE-2024-0450 2024-04-24 12:57:46 +02:00
00431-cve-2024-4032.patch Security fix for CVE-2024-4032 2024-07-04 10:51:09 +02:00
00435-cve-2024-6923.patch Security fix for CVE-2024-6923 2024-08-20 10:52:42 +02:00
00437-cve-2024-6232.patch Security fix for CVE-2024-6232 2024-09-06 12:13:02 +02:00
00443-gh-124651-quote-template-strings-in-venv-activation-scripts.patch Security fix for CVE-2024-9287 2024-11-05 12:51:47 +01:00
00444-security-fix-for-cve-2024-11168.patch Security fix for CVE-2024-11168 2024-11-15 09:06:30 +01:00
00450-cve-2025-0938-disallow-square-brackets-and-in-domain-names-for-parsed-urls.patch Security fix for CVE-2025-0938 2026-03-06 21:49:38 +01:00
00465-tarfile-cves.patch Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435 2025-06-27 14:13:11 +02:00
00467-tarfile-cve-2025-8194.patch Security fix for CVE-2025-8194 2025-08-11 13:41:36 +02:00
00471-cve-2025-12084.patch Security fix for CVE-2025-12084 2026-01-06 13:11:04 +01:00
00473-cve-2026-0865.patch Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367, CVE-2026-1299 2026-02-02 12:42:47 +01:00
00474-cve-2025-15366.patch Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367, CVE-2026-1299 2026-02-02 12:42:47 +01:00
00475-cve-2025-15367.patch Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367, CVE-2026-1299 2026-02-02 12:42:47 +01:00
00476-cve-2026-1299.patch Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367, CVE-2026-1299 2026-02-02 12:42:47 +01:00
00478-cve-2026-4519.patch Security fix for CVE-2026-4519 2026-03-26 11:56:55 +01:00
00480-cve-2026-4786.patch Security fixes for CVE-2026-4786, CVE-2026-6100 2026-04-17 05:41:32 +02:00
00482-cve-2026-6100.patch Security fixes for CVE-2026-4786, CVE-2026-6100 2026-04-17 05:41:32 +02:00
00490-cve-2026-15308.patch Security fix for CVE-2026-15308 2026-07-10 11:36:35 +02:00
00492-cve-2026-11940.patch Fix CVE-2026-11940: symlink escape via tarfile hardlink fallback 2026-08-10 15:50:24 +02:00
check-pyc-and-pyo-timestamps.py Import rpm: c8s 2023-02-27 15:12:25 -05:00
gating.yaml Use tmt for gating 2026-05-14 14:06:21 +02:00
get-source.sh Import rpm: c8s 2023-02-27 15:12:25 -05:00
idle3.appdata.xml Import rpm: c8s 2023-02-27 15:12:25 -05:00
idle3.desktop Import rpm: c8s 2023-02-27 15:12:25 -05:00
no-python Import rpm: c8s 2023-02-27 15:12:25 -05:00
plan.fmf Use tmt for gating 2026-05-14 14:06:21 +02:00
python3.rpmlintrc Replace whole repo with latest content from branch rhel-8.8.0 2023-05-15 16:41:20 +02:00
python3.spec Fix CVE-2026-11940: symlink escape via tarfile hardlink fallback 2026-08-10 15:50:24 +02:00
rpminspect.yaml rpminspect: Ignore "VERIFY" report for empty python3-devel 2026-01-07 13:12:44 +01:00
sources Import rpm: c8s 2023-02-27 15:12:25 -05:00
unversioned-python.1 Import rpm: c8s 2023-02-27 15:12:25 -05:00