diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/0001-cve-2026-19672.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/0001-cve-2026-19672.patch deleted file mode 100644 index 07250a72123..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/0001-cve-2026-19672.patch +++ /dev/null @@ -1,98 +0,0 @@ -From c7979f3a819011a3222bd16e671264b1e34282cb Mon Sep 17 00:00:00 2001 -From: "Miss Islington (bot)" - <31488909+miss-islington@users.noreply.github.com> -Date: Wed, 19 Aug 2026 15:33:25 +0200 -Subject: [PATCH] [3.13] gh-155999: `tarfile`: handle a member that leaves the - destination but comes back (GH-156000) (#156042) - -(cherry picked from commit 97688346ada2df3e5b9c279348862c3d64ab0823) - -Co-authored-by: Stan Ulbrych ---- - Doc/library/tarfile.rst | 8 ++++++++ - Lib/tarfile.py | 7 +++++++ - Lib/test/test_tarfile.py | 14 ++++++++++++++ - .../2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst | 5 +++++ - 4 files changed, 34 insertions(+) - create mode 100644 Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst - -diff --git a/Doc/library/tarfile.rst b/Doc/library/tarfile.rst -index c820e3d159b9a5b..d5c5328210cd7e4 100644 ---- a/Doc/library/tarfile.rst -+++ b/Doc/library/tarfile.rst -@@ -1049,6 +1049,10 @@ reused in custom filters: - paths (in case the name is absolute - even after stripping slashes, e.g. ``C:/foo`` on Windows). - This raises :class:`~tarfile.AbsolutePathError`. -+ - Normalize filenames (:attr:`TarInfo.name`) that contain ``..`` components -+ using :func:`os.path.normpath`. -+ Note that this removes internal ``..`` components, which may change the -+ meaning of the name if it traverses symbolic links. - - :ref:`Refuse ` to extract files whose absolute - path (after following symlinks) would end up outside the destination. - This raises :class:`~tarfile.OutsideDestinationError`. -@@ -1057,6 +1061,10 @@ reused in custom filters: - - Return the modified ``TarInfo`` member. - -+ .. versionchanged:: next -+ -+ Filenames containing ``..`` components are now normalized. -+ - .. function:: data_filter(member, path) - - Implements the ``'data'`` filter. -diff --git a/Lib/tarfile.py b/Lib/tarfile.py -index 9da2667abe15da6..3c59eac5d9a0f11 100755 ---- a/Lib/tarfile.py -+++ b/Lib/tarfile.py -@@ -808,6 +808,13 @@ def _get_filtered_attrs(member, dest_path, for_data=True): - # For example, 'C:/foo' on Windows. - raise AbsolutePathError(member) - # Ensure we stay in the destination -+ if '..' in name.replace(os.sep, '/').split('/'): -+ # Directories are created from the name as given, so a name that -+ # leaves the destination part-way through would create them -+ # outside it even if the resolved path stays inside. -+ normalized = os.path.normpath(name) -+ if normalized != name: -+ name = new_attrs['name'] = normalized - target_path = os.path.realpath(os.path.join(dest_path, name), - strict=os.path.ALLOW_MISSING) - if os.path.commonpath([target_path, dest_path]) != dest_path: -diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py -index 31e844328b31901..86fe8efac2e3495 100644 ---- a/Lib/test/test_tarfile.py -+++ b/Lib/test/test_tarfile.py -@@ -3948,6 +3948,20 @@ def test_absolute(self): - tarfile.AbsolutePathError, - """['"].*escaped.evil['"] has an absolute path""") - -+ def test_parent_dir_out_and_back(self): -+ # Test a member that leaves the destination and comes back. -+ # The containment check looks at the resolved path, which stays -+ # inside, but the intermediate directories are created from the -+ # name as given, which does not. -+ with ArchiveMaker() as arc: -+ arc.add(f'../escaped.evil/../{self.destdir.name}/sub/file', -+ content='content') -+ -+ for filter in 'tar', 'data': -+ with self.subTest(filter): -+ with self.check_context(arc.open(), filter): -+ self.expect_file('sub/file', content='content') -+ - @symlink_test - def test_parent_symlink(self): - # Test interplaying symlinks -diff --git a/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst b/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst -new file mode 100644 -index 000000000000000..59b725e55bbffda ---- /dev/null -+++ b/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst -@@ -0,0 +1,5 @@ -+Fix the :mod:`tarfile` ``tar`` and ``data`` extraction filters creating -+directories outside the destination for members whose name leaves the -+destination and returns to it, such as ``../evil/../dest/sub/file``. The -+containment check used the resolved path, but intermediate directories were -+created from the name as given. diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/README.md deleted file mode 100644 index 4595c93cc43..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/python/README.md +++ /dev/null @@ -1,3 +0,0 @@ -Patch `0001-cve-2026-19672.patch` fixes a security issue in tarfile -module. The patch can be dropped after updating to python 3.13.16 or -3.14.8. diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0001-uniq-fix-read-overrun-with-w.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0001-uniq-fix-read-overrun-with-w.patch deleted file mode 100644 index cd8aaf13a49..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0001-uniq-fix-read-overrun-with-w.patch +++ /dev/null @@ -1,33 +0,0 @@ -From e2da005e28935f23b2c0f224f6fcbfe0d8c13c12 Mon Sep 17 00:00:00 2001 -From: Paul Eggert -Date: Tue, 28 Apr 2026 11:25:00 -0700 -Subject: [PATCH 1/2] uniq: fix read overrun with -w -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Problem reported by Michał Majchrowicz. -* src/uniq.c (find_field): Fix typo. -* tests/uniq/uniq.pl (add_z_variants): Test for the bug. ---- - src/uniq.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/uniq.c b/src/uniq.c -index 30463598a..5834596f9 100644 ---- a/src/uniq.c -+++ b/src/uniq.c -@@ -285,8 +285,8 @@ find_field (struct linebuffer const *line, idx_t *plen) - else - { - char *ep = lp; -- for (idx_t i = check_chars; 0 < i && lp < lim; i--) -- ep += mcel_scan (lp, lim).len; -+ for (idx_t i = check_chars; 0 < i && ep < lim; i--) -+ ep += mcel_scan (ep, lim).len; - len = ep - lp; - } - --- -2.54.0 - diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0002-unexpand-fix-heap-overflow.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0002-unexpand-fix-heap-overflow.patch deleted file mode 100644 index 37f25033278..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/0002-unexpand-fix-heap-overflow.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 6e661c674d213f49128efbb3107a7bb9ced7348a Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?P=C3=A1draig=20Brady?= -Date: Tue, 28 Apr 2026 20:33:10 +0100 -Subject: [PATCH 2/2] unexpand: fix heap overflow -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -* src/unexpand.c (unexpand): Use xinmalloc() to gracefully -handle overflow. Also use the runtime locale specific MB_CUR_MAX -rather than the worst case MB_LEN_MAX. -* tests/unexpand/mb.sh: Add a test case that fails in a default -glibc build with either MB_CUR_MAX or MB_LEN_MAX. -* NEWS: Mention the bug fix. -Reported by Michał Majchrowicz. ---- - src/unexpand.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/unexpand.c b/src/unexpand.c -index 4fbf9d3f8..761c8ead0 100644 ---- a/src/unexpand.c -+++ b/src/unexpand.c -@@ -131,7 +131,7 @@ unexpand (void) - /* The worst case is a non-blank character, then one blank, then a - tab stop, then MAX_COLUMN_WIDTH - 1 blanks, then a non-blank; so - allocate MAX_COLUMN_WIDTH bytes to store the blanks. */ -- pending_blank = ximalloc (max_column_width * sizeof (char) * MB_LEN_MAX); -+ pending_blank = xinmalloc (max_column_width, MB_CUR_MAX); - - while (true) - { --- -2.54.0 - diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/README.md deleted file mode 100644 index be0ad83b615..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/coreutils/README.md +++ /dev/null @@ -1,3 +0,0 @@ -The patches `0001-uniq-fix-read-overrun-with-w.patch` and -`0002-unexpand-fix-heap-overflow.patch` can be dropped after updating -to 9.12 (or 9.11.1). diff --git a/sdk_container/src/third_party/gentoo b/sdk_container/src/third_party/gentoo index 5f2bb58159c..9374e148b92 160000 --- a/sdk_container/src/third_party/gentoo +++ b/sdk_container/src/third_party/gentoo @@ -1 +1 @@ -Subproject commit 5f2bb58159ca5f10e9f8baf3b77a139c0afa304a +Subproject commit 9374e148b92394c5c8025d6a51ba2b217c42fd48