mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-09 06:40:17 +00:00
Code Issues Projects Releases Wiki Activity

python3-filelock: fix CVE-2026-22701

Browse Source 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-22701

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Darsh Kelaiya
2026-09-01 06:57:20 +05:30
committed by Anuj Mittal
parent ac73fd1e99
commit b9534a154d
2 changed files with 45 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-python/recipes-devtools/python/python3-filelock/CVE-2026-22701.patch
+44
View File
@@ -0,0 +1,44 @@
From c07f9db7726babc801ea3bd6f7c0f09d92a48bc7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Fri, 9 Jan 2026 09:53:50 -0800
Subject: [PATCH] Fix TOCTOU symlink vulnerability in SoftFileLock (#465)
CVE: CVE-2026-22701
Upstream-Status: Backport [https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5]
Backport Changes:
- Omitted docs/index.rst because the filelock 3.13.4 source archive
does not contain the upstream documentation tree. The omission does
not affect the SoftFileLock security fix.
Co-authored-by: Claude <noreply@anthropic.com>
(cherry picked from commit 41b42dd2c72aecf7da83dbda5903b8087dddc4d5)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
src/filelock/_soft.py | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/filelock/_soft.py b/src/filelock/_soft.py
index 28c67f7..93709c5 100644
--- a/src/filelock/_soft.py
+++ b/src/filelock/_soft.py
@@ -16,13 +16,15 @@ class SoftFileLock(BaseFileLock):
def _acquire(self) -> None:
raise_on_not_writable_file(self.lock_file)
ensure_directory_exists(self.lock_file)
- # first check for exists and read-only mode as the open will mask this case as EEXIST
flags = (
os.O_WRONLY # open for writing only
| os.O_CREAT
| os.O_EXCL # together with above raise EEXIST if the file specified by filename exists
| os.O_TRUNC # truncate the file to zero byte
)
+ o_nofollow = getattr(os, "O_NOFOLLOW", None)
+ if o_nofollow is not None:
+ flags |= o_nofollow
try:
file_handler = os.open(self.lock_file, flags, self._context.mode)
except OSError as exception: # re-raise unless expected exception
--
2.44.4