Skip to content

Release 20.3.4.post3

Choose a tag to compare

View all tags
@icanhasmath icanhasmath released this 22 Oct 19:06
· 2837 commits to main since this release
20.3.4.post3
bf6f019
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Third ActiveState security release on the Python 2.7 pip 20.3.4 line. Merged in #3 and #8.

CVE Advisory Status
CVE-2026-6357 GHSA-jp4c-xjxw-mgf9 Patched. The self-version check fetches before the install and only prints afterwards.

Corrections to earlier 20.3.4 releases:

  • CVE-2026-6357 was wrongly marked not applicable in 20.3.4+security.1. 20.3.4+security.1 and 20.3.4.post2 are both vulnerable: a wheel that ships a top-level _manylinux.py is executed by the post-install version check.
  • Mercurial installs were broken in 20.3.4+security.1 and 20.3.4.post2. The CVE-2023-5752 fix passed -r=<rev>, which hg rejects, so every hg+…@rev install failed. It now uses --rev= (pypa#12373).
  • The CVE-2025-8869 fix was incomplete in every earlier 20.3.4.x. Python 2.7 always uses the tar fallback, and the pypa#14127 symlink-redirection hardening is now ported.

Review-round hardening (also in this release):

  • CVE-2025-8869 follow-up: pypa#14127 is ported, rejecting symlink redirection in the tar fallback.
  • Path checks: containment checks are root-safe and //-safe.
  • Archive members: symlink targets are matched against normalized member names.
  • Error messages: an unsafe download file name now gives a pip ERROR: instead of a traceback.

Validated on the built wheel, in the matching python:X-slim image:

  • CVE-2026-6357: the end-to-end _manylinux exploit is not executed.
  • CVE-2026-1703: the sibling-prefix wheel is blocked.
  • CVE-2025-8869: both pypa#14127 escape archives are refused.
  • Archive shapes: valid ./-prefixed and implied-directory archives unpack.
  • Bundled certifi: the bundle has no emSign ECC G3, TrustCor, E-Tugra or GLOBALTRUST roots.
  • Network: a real pip download from PyPI works.

sha256

  • pip-20.3.4.post3.tar.gz: 407f8e38a490398f39d97ac30970c60cc604ace682d65f9925fa87cc9692c0af
  • pip-20.3.4.post3-py2.py3-none-any.whl: e1e5a1543954a109fed9bc1c3af01f0cde6c46f79d3389c2afb884b64fcf2949
Assets 4
Loading