Skip to content

bpo-46948: Fix CVE-2022-26488 by ensuring the Windows Installer correctly uses the install path during repair #31726

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 7, 2022
Merged

bpo-46948: Fix CVE-2022-26488 by ensuring the Windows Installer correctly uses the install path during repair #31726

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Misc/NEWS.d/next/Windows/2022-03-07-16-34-11.bpo-46948.Ufd4tG.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Prevent CVE-2022-26488 by ensuring the Add to PATH option in the Windows
installer uses the correct path when being repaired.
1 change: 1 addition & 0 deletions Tools/msi/appendpath/appendpath.wxs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
<Product Id="*" Language="!(loc.LCID)" Name="!(loc.Title)" Version="$(var.Version)" Manufacturer="!(loc.Manufacturer)" UpgradeCode="$(var.UpgradeCode)">
<Package InstallerVersion="500" Compressed="yes" InstallScope="perUser" />

<PropertyRef Id="DetectTargetDir" />
<PropertyRef Id="UpgradeTable" />
<PropertyRef Id="REGISTRYKEY" />

Expand Down
2 changes: 1 addition & 1 deletion Tools/msi/bundle/bundle.wxs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,8 +108,8 @@
<PackageGroupRef Id="crt" />
<?endif ?>
<PackageGroupRef Id="core" />
<PackageGroupRef Id="dev" />
<PackageGroupRef Id="exe" />
<PackageGroupRef Id="dev" />
<PackageGroupRef Id="lib" />
<PackageGroupRef Id="test" />
<PackageGroupRef Id="doc" />
Expand Down
16 changes: 14 additions & 2 deletions Tools/msi/common.wxs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,11 +53,23 @@
</Fragment>

<Fragment>
<?ifdef InstallDirectoryGuidSeed ?>
<Directory Id="TARGETDIR" Name="SourceDir">
<?ifdef InstallDirectoryGuidSeed ?>
<Directory Id="InstallDirectory" ComponentGuidGenerationSeed="$(var.InstallDirectoryGuidSeed)" />
<?endif ?>
</Directory>
<?endif ?>
</Fragment>

<Fragment>
<!-- Locate TARGETDIR automatically assuming we have executables installed -->
<Property Id="TARGETDIR">
<ComponentSearch Id="PythonExe_Directory" Guid="$(var.PythonExeComponentGuid)">
<DirectorySearch Id="PythonExe_Directory" AssignToProperty="yes" Path=".">
<FileSearch Id="PythonExe_DirectoryFile" Name="python.exe" />
</DirectorySearch>
</ComponentSearch>
</Property>
<Property Id="DetectTargetDir" Value="1" />
</Fragment>

<!-- Top-level directories -->
Expand Down
1 change: 1 addition & 0 deletions Tools/msi/dev/dev.wxs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
<Package InstallerVersion="500" Compressed="yes" InstallScope="perUser" />
<MediaTemplate EmbedCab="yes" CompressionLevel="high" />

<PropertyRef Id="DetectTargetDir" />
<PropertyRef Id="UpgradeTable" />

<Feature Id="DefaultFeature" AllowAdvertise="no" Title="!(loc.Title)" Description="!(loc.Description)">
Expand Down
1 change: 1 addition & 0 deletions Tools/msi/doc/doc.wxs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
<Package InstallerVersion="500" Compressed="yes" InstallScope="perUser" />
<MediaTemplate EmbedCab="yes" CompressionLevel="high" />

<PropertyRef Id="DetectTargetDir" />
<PropertyRef Id="UpgradeTable" />
<PropertyRef Id="REGISTRYKEY" />

Expand Down
1 change: 1 addition & 0 deletions Tools/msi/lib/lib.wxs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
<Package InstallerVersion="500" Compressed="yes" InstallScope="perUser" />
<MediaTemplate EmbedCab="yes" CompressionLevel="high" />

<PropertyRef Id="DetectTargetDir" />
<PropertyRef Id="UpgradeTable" />
<PropertyRef Id="REGISTRYKEY" />

Expand Down
3 changes: 2 additions & 1 deletion Tools/msi/path/path.wxs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@
<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">
<Product Id="*" Language="!(loc.LCID)" Name="!(loc.Title)" Version="$(var.Version)" Manufacturer="!(loc.Manufacturer)" UpgradeCode="$(var.UpgradeCode)">
<Package InstallerVersion="500" Compressed="yes" InstallScope="perUser" />


<PropertyRef Id="DetectTargetDir" />
<PropertyRef Id="UpgradeTable" />
<PropertyRef Id="REGISTRYKEY" />

Expand Down
1 change: 1 addition & 0 deletions Tools/msi/tcltk/tcltk.wxs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
<Package InstallerVersion="500" Compressed="yes" InstallScope="perUser" />
<MediaTemplate EmbedCab="yes" CompressionLevel="high" />

<PropertyRef Id="DetectTargetDir" />
<PropertyRef Id="UpgradeTable" />
<PropertyRef Id="REGISTRYKEY" />

Expand Down
1 change: 1 addition & 0 deletions Tools/msi/test/test.wxs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
<Package InstallerVersion="500" Compressed="yes" InstallScope="perUser" />
<MediaTemplate EmbedCab="yes" CompressionLevel="high" />

<PropertyRef Id="DetectTargetDir" />
<PropertyRef Id="UpgradeTable" />
<PropertyRef Id="REGISTRYKEY" />

Expand Down
1 change: 1 addition & 0 deletions Tools/msi/tools/tools.wxs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
<Package InstallerVersion="500" Compressed="yes" InstallScope="perUser" />
<MediaTemplate EmbedCab="yes" CompressionLevel="high" />

<PropertyRef Id="DetectTargetDir" />
<PropertyRef Id="UpgradeTable" />

<Feature Id="DefaultFeature" AllowAdvertise="no" Title="!(loc.Title)" Description="!(loc.Description)">
Expand Down
1 change: 1 addition & 0 deletions Tools/msi/ucrt/ucrt.wxs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
<Package InstallerVersion="500" Compressed="yes" InstallScope="perUser" />
<MediaTemplate EmbedCab="yes" CompressionLevel="high" />

<PropertyRef Id="DetectTargetDir" />
<PropertyRef Id="UpgradeTable" />
<PropertyRef Id="REGISTRYKEY" />

Expand Down