Skip to content

[Medium] Patch python-virtualenv for CVE-2025-50181, CVE-2026-24049, CVE-2026-1703#15951

Merged
kgodara912 merged 4 commits intomicrosoft:3.0-devfrom
BinduSri-6522866:topic_python-virtualenv-3.0
Mar 16, 2026
Merged

[Medium] Patch python-virtualenv for CVE-2025-50181, CVE-2026-24049, CVE-2026-1703#15951
kgodara912 merged 4 commits intomicrosoft:3.0-devfrom
BinduSri-6522866:topic_python-virtualenv-3.0

Conversation

@BinduSri-6522866
Copy link
Copy Markdown
Contributor

@BinduSri-6522866 BinduSri-6522866 commented Feb 23, 2026 •
edited
Loading

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge
Summary

Patch python-virtualenv for CVE-2025-50181 [Medium]

  • Patch modified: Yes
  • Patch was backported for poolmanager.py, rest of the files [CHANGES.rst, docs/reference/contrib/emscripten.rst, dummyserver/app.py, test/contrib/emscripten/test_emscripten.py, test/test_poolmanager.py, test/with_dummyserver/test_poolmanager.py] are not available for the version of urllib3 being used along with this package.
  • Astrolabe patch reference: https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857.patch

Patch python-virtualenv for CVE-2026-24049 [Medium]

Patch python-virtualenv for CVE-2026-1703 [Low]

  • Patch modified: Yes
  • tests/unit/test_utils_unpacking.py file is not present in python-virtualenv source tar ball, so patch didn't apply.
  • In pip-25.3-py3-none-any.whl the news/+1ee322a1.bugfix.rst new path is not added from upstream patch to maintain compatibility with existing virtualenv cleanup behavior after tightening path validation logic (commonpath). This avoids leaving non-runtime artifacts in site-packages during pip uninstall and allows existing tests to pass without modifying test code.
  • Astrolabe patch reference: https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735.patch
Change Log
Does this affect the toolchain?

NO

Links to CVEs
Test Methodology
image image image image image

@microsoft-github-policy-service microsoft-github-policy-service Bot added Packaging 3.0-dev PRs Destined for AzureLinux 3.0 labels Feb 23, 2026
@Kanishk-Bansal
Copy link
Copy Markdown
Contributor

Kanishk-Bansal commented Feb 23, 2026

Buddy Build

@BinduSri-6522866 BinduSri-6522866 changed the title [Medium] Patch python-virtualenv for CVE-2025-50181 [Medium] Patch python-virtualenv for CVE-2025-50181, CVE-2026-24049, CVE-2026-1703 Feb 24, 2026
@BinduSri-6522866
Copy link
Copy Markdown
Contributor Author

BinduSri-6522866 commented Feb 24, 2026

https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1055934&view=results
Buddy build passed

@BinduSri-6522866 BinduSri-6522866 marked this pull request as ready for review February 25, 2026 04:01
@BinduSri-6522866 BinduSri-6522866 requested a review from a team as a code owner February 25, 2026 04:01
mfrw
mfrw approved these changes Mar 5, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@mfrw mfrw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Patches apply cleanly
  • Patches look good w.r.t upstream
  • Test build passes
    Signed-Off by: @mfrw

Have asked a small nit-pick for the spec.

Comment thread SPECS/python-virtualenv/CVE-2026-1703v0.patch
abs_directory = os.path.abspath(directory)
abs_target = os.path.abspath(target)

- prefix = os.path.commonprefix([abs_directory, abs_target])
Copy link
Copy Markdown
Member

@mfrw mfrw Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch looks good w.r.t upstream

Comment thread SPECS/python-virtualenv/CVE-2026-1703v1.patch
abs_target = os.path.abspath(target)

- prefix = os.path.commonprefix([abs_directory, abs_target])
+ prefix = os.path.commonpath([abs_directory, abs_target])
Copy link
Copy Markdown
Member

@mfrw mfrw Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch looks good w.r.t upstream

Comment thread SPECS/python-virtualenv/CVE-2026-24049v0.patch
# https://github.com/python/cpython/issues/59999
permissions = zinfo.external_attr >> 16 & 0o777
- destination.joinpath(zinfo.filename).chmod(permissions)
+ target_path.chmod(permissions)
Copy link
Copy Markdown
Member

@mfrw mfrw Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch looks good w.r.t upstream

Comment thread SPECS/python-virtualenv/CVE-2026-24049v1.patch
# We have to do this manually due to
# https://github.com/python/cpython/issues/59999
permissions = zinfo.external_attr >> 16 & 0o777
- destination.joinpath(zinfo.filename).chmod(permissions)
Copy link
Copy Markdown
Member

@mfrw mfrw Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch looks good w.r.t upstream

Comment thread SPECS/python-virtualenv/CVE-2025-50181.patch

def __init__(self, num_pools=10, headers=None, **connection_pool_kw):
RequestMethods.__init__(self, headers)
+ if "retries" in connection_pool_kw:
Copy link
Copy Markdown
Member

@mfrw mfrw Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch looks good w.r.t upstream

Comment thread SPECS/python-virtualenv/python-virtualenv.spec
# For the poolmanager.py under tests, it is archived inside a .whl file, which in turn is archived inside another .whl file,
# so, we need to unpack the outer .whl, then unpack the inner .whl, apply the patch, and then re-zip both levels.

echo "Manually Patching virtualenv-20.36.1/src/virtualenv/seed/wheels/embed/pip-25.0.1-py3-none-any.whl/pip/_vendor/urllib3/poolmanager.py"
Copy link
Copy Markdown
Member

@mfrw mfrw Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we please add a note above each of this to clarify what patch. Also a comment so that we can justify why we are duplicating code, as the two parts alsmost are similar.

Copy link
Copy Markdown
Contributor Author

@BinduSri-6522866 BinduSri-6522866 Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Affected code is present in archive(.whl) files in source tarball and even though patch is same for diffrent archives, same patch is not applicable for affected archives due to different versions. So same procedure is repeated for different archives.

@Kanishk-Bansal Kanishk-Bansal added the ready-for-stable-review PR has passed initial review and is now ready for a second-level stable maintainer review label Mar 6, 2026
kgodara912
kgodara912 approved these changes Mar 16, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@kgodara912 kgodara912 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The patches almost match with upstream references except unimportant files. The changes are included in final rpm whl files. Buddy build is successful. Though, there are other possible ways to fix this, like keeping only one version of setuptools and pip in virtualenv, but as such it should work.

@kgodara912 kgodara912 merged commit a58a205 into microsoft:3.0-dev Mar 16, 2026
17 checks passed
BinduSri-6522866 added a commit to BinduSri-6522866/azurelinux that referenced this pull request Mar 31, 2026
@BinduSri-6522866
[Medium] Patch python-virtualenv for CVE-2025-50181, CVE-2026-24049, C…
1f069c2 
…VE-2026-1703 (microsoft#15951)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mfrw mfrw mfrw approved these changes

@kgodara912 kgodara912 kgodara912 approved these changes

Assignees

No one assigned

Labels

3.0-dev PRs Destined for AzureLinux 3.0 Packaging ready-for-stable-review PR has passed initial review and is now ready for a second-level stable maintainer review security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@BinduSri-6522866 @Kanishk-Bansal @mfrw @kgodara912