Skip to content

Commit 3d5a030

Browse files
Kanishk-BansalKanishk-Bansal
authored
Revert "[MEDIUM] Upgrade python-virtualenv to 20.36.1 for CVE-2026-22702" (#15957)
1 parent 3f85919 commit 3d5a030

File tree

8 files changed

+222
-41
lines changed

8 files changed

+222
-41
lines changed

‎SPECS/python-virtualenv/0001-replace-to-flit.patch‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
1-
From a778f8a379f75100d24159c4c3ffdbce4ff36e07 Mon Sep 17 00:00:00 2001
2-
From: Archana Shettigar <v-shettigara@microsoft.com>
3-
Date: Wed, 14 Jan 2026 15:30:01 +0530
1+
From efa2c18a0c114f2d32e2c101401b716e4ac9e6f4 Mon Sep 17 00:00:00 2001
2+
From: Kanishk-Bansal <kbkanishk975@gmail.com>
3+
Date: Wed, 26 Feb 2025 06:31:14 +0000
44
Subject: [PATCH] replace-to-flit
55

66
---
77
pyproject.toml | 23 ++++-------------------
88
1 file changed, 4 insertions(+), 19 deletions(-)
99

1010
diff --git a/pyproject.toml b/pyproject.toml
11-
index 0a7ca00..03706b2 100644
11+
index fabf434..179525d 100644
1212
--- a/pyproject.toml
1313
+++ b/pyproject.toml
1414
@@ -1,9 +1,6 @@
@@ -41,9 +41,9 @@ index 0a7ca00..03706b2 100644
4141
-]
4242
+version = "3.10.0"
4343
dependencies = [
44-
"distlib>=0.3.7,<1",
45-
"filelock>=3.16.1,<4; python_version<'3.10'",
46-
@@ -99,16 +94,6 @@ entry-points."virtualenv.discovery".builtin = "virtualenv.discovery.builtin:Buil
44+
"distlib<1,>=0.3.7",
45+
"filelock<4,>=3.12.2",
46+
@@ -95,16 +90,6 @@ entry-points."virtualenv.discovery".builtin = "virtualenv.discovery.builtin:Buil
4747
entry-points."virtualenv.seed".app-data = "virtualenv.seed.embed.via_app_data.via_app_data:FromAppData"
4848
entry-points."virtualenv.seed".pip = "virtualenv.seed.embed.pip_invoke:PipInvoke"
4949

@@ -58,8 +58,8 @@ index 0a7ca00..03706b2 100644
5858
-version.source = "vcs"
5959
-
6060
[tool.ruff]
61+
target-version = "py37"
6162
line-length = 120
62-
format.preview = true
6363
--
64-
2.45.4
64+
2.45.2
6565

‎SPECS/python-virtualenv/CVE-2025-50181v0.patch‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
From e942dd93a09e2eb8a52097c76075d0a42be20f39 Mon Sep 17 00:00:00 2001
2+
From: Aninda <v-anipradhan@microsoft.com>
3+
Date: Tue, 8 Jul 2025 10:53:14 -0400
4+
Subject: [PATCH] Address CVE-2025-50181-1
5+
Upstream Patch Reference: https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
6+
---
7+
pip/_vendor/urllib3/poolmanager.py | 18 +++++++++++++++++-
8+
1 file changed, 17 insertions(+), 1 deletion(-)
9+
10+
diff --git a/pip/_vendor/urllib3/poolmanager.py b/pip/_vendor/urllib3/poolmanager.py
11+
index 14b10da..574b7de 100644
12+
--- a/pip/_vendor/urllib3/poolmanager.py
13+
+++ b/pip/_vendor/urllib3/poolmanager.py
14+
@@ -170,6 +170,22 @@ class PoolManager(RequestMethods):
15+
16+
def __init__(self, num_pools=10, headers=None, **connection_pool_kw):
17+
RequestMethods.__init__(self, headers)
18+
+ if "retries" in connection_pool_kw:
19+
+ retries = connection_pool_kw["retries"]
20+
+ if not isinstance(retries, Retry):
21+
+ # When Retry is initialized, raise_on_redirect is based
22+
+ # on a redirect boolean value.
23+
+ # But requests made via a pool manager always set
24+
+ # redirect to False, and raise_on_redirect always ends
25+
+ # up being False consequently.
26+
+ # Here we fix the issue by setting raise_on_redirect to
27+
+ # a value needed by the pool manager without considering
28+
+ # the redirect boolean.
29+
+ raise_on_redirect = retries is not False
30+
+ retries = Retry.from_int(retries, redirect=False)
31+
+ retries.raise_on_redirect = raise_on_redirect
32+
+ connection_pool_kw = connection_pool_kw.copy()
33+
+ connection_pool_kw["retries"] = retries
34+
self.connection_pool_kw = connection_pool_kw
35+
self.pools = RecentlyUsedContainer(num_pools)
36+
37+
@@ -386,7 +402,7 @@ class PoolManager(RequestMethods):
38+
if response.status == 303:
39+
method = "GET"
40+
41+
- retries = kw.get("retries")
42+
+ retries = kw.get("retries", response.retries)
43+
if not isinstance(retries, Retry):
44+
retries = Retry.from_int(retries, redirect=redirect)
45+
46+
--
47+
2.34.1
48+

SPECS/python-virtualenv/CVE-2025-50181.patch renamed to SPECS/python-virtualenv/CVE-2025-50181v1.patch

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
From 58ec34d3c1b0505961c7d17a7e89c8a5e8e701cb Mon Sep 17 00:00:00 2001
2-
From: Archana Shettigar <v-shettigara@microsoft.com>
3-
Date: Thu, 15 Jan 2026 16:20:25 +0530
4-
Subject: [PATCH] Address CVE-2025-50181v0
1+
From 8275bde7d461c4d6cd44397529fcb75847eee97c Mon Sep 17 00:00:00 2001
2+
From: Aninda <v-anipradhan@microsoft.com>
3+
Date: Wed, 9 Jul 2025 22:12:03 -0400
4+
Subject: [PATCH] Address CVE-xxxx-yyyy
55
Upstream Patch Reference: https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
66
---
77
pip/_vendor/urllib3/poolmanager.py | 18 +++++++++++++++++-
@@ -44,5 +44,5 @@ index fb51bf7..a8de7c6 100644
4444
retries = Retry.from_int(retries, redirect=redirect)
4545

4646
--
47-
2.45.4
47+
2.34.1
4848

‎SPECS/python-virtualenv/CVE-2025-50181v2.patch‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
From b9f02b9d46967b99beab18718c79e79e08304c89 Mon Sep 17 00:00:00 2001
2+
From: Aninda <v-anipradhan@microsoft.com>
3+
Date: Tue, 8 Jul 2025 22:33:17 -0400
4+
Subject: [PATCH] Address CVE-2025-50181v2
5+
Upstream Patch Reference: https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
6+
---
7+
pip/_vendor/urllib3/poolmanager.py | 18 +++++++++++++++++-
8+
1 file changed, 17 insertions(+), 1 deletion(-)
9+
10+
diff --git a/pip/_vendor/urllib3/poolmanager.py b/pip/_vendor/urllib3/poolmanager.py
11+
index fe5491c..d03b343 100644
12+
--- a/pip/_vendor/urllib3/poolmanager.py
13+
+++ b/pip/_vendor/urllib3/poolmanager.py
14+
@@ -151,6 +151,22 @@ class PoolManager(RequestMethods):
15+
16+
def __init__(self, num_pools=10, headers=None, **connection_pool_kw):
17+
RequestMethods.__init__(self, headers)
18+
+ if "retries" in connection_pool_kw:
19+
+ retries = connection_pool_kw["retries"]
20+
+ if not isinstance(retries, Retry):
21+
+ # When Retry is initialized, raise_on_redirect is based
22+
+ # on a redirect boolean value.
23+
+ # But requests made via a pool manager always set
24+
+ # redirect to False, and raise_on_redirect always ends
25+
+ # up being False consequently.
26+
+ # Here we fix the issue by setting raise_on_redirect to
27+
+ # a value needed by the pool manager without considering
28+
+ # the redirect boolean.
29+
+ raise_on_redirect = retries is not False
30+
+ retries = Retry.from_int(retries, redirect=False)
31+
+ retries.raise_on_redirect = raise_on_redirect
32+
+ connection_pool_kw = connection_pool_kw.copy()
33+
+ connection_pool_kw["retries"] = retries
34+
self.connection_pool_kw = connection_pool_kw
35+
self.pools = RecentlyUsedContainer(num_pools,
36+
dispose_func=lambda p: p.close())
37+
@@ -333,7 +349,7 @@ class PoolManager(RequestMethods):
38+
if response.status == 303:
39+
method = 'GET'
40+
41+
- retries = kw.get('retries')
42+
+ retries = kw.get("retries", response.retries)
43+
if not isinstance(retries, Retry):
44+
retries = Retry.from_int(retries, redirect=redirect)
45+
46+
--
47+
2.34.1
48+

‎SPECS/python-virtualenv/CVE-2025-50181v3.patch‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
From 3d5efc9facfee6c0136bbe14e02000de2cfcef23 Mon Sep 17 00:00:00 2001
2+
From: Aninda <v-anipradhan@microsoft.com>
3+
Date: Wed, 9 Jul 2025 07:33:05 -0400
4+
Subject: [PATCH] Address CVE-2025-50181v3
5+
Upstream Patch Reference: https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
6+
---
7+
pip/_vendor/urllib3/poolmanager.py | 18 +++++++++++++++++-
8+
1 file changed, 17 insertions(+), 1 deletion(-)
9+
10+
diff --git a/pip/_vendor/urllib3/poolmanager.py b/pip/_vendor/urllib3/poolmanager.py
11+
index 242a2f8..c542cea 100644
12+
--- a/pip/_vendor/urllib3/poolmanager.py
13+
+++ b/pip/_vendor/urllib3/poolmanager.py
14+
@@ -158,6 +158,22 @@ class PoolManager(RequestMethods):
15+
16+
def __init__(self, num_pools=10, headers=None, **connection_pool_kw):
17+
RequestMethods.__init__(self, headers)
18+
+ if "retries" in connection_pool_kw:
19+
+ retries = connection_pool_kw["retries"]
20+
+ if not isinstance(retries, Retry):
21+
+ # When Retry is initialized, raise_on_redirect is based
22+
+ # on a redirect boolean value.
23+
+ # But requests made via a pool manager always set
24+
+ # redirect to False, and raise_on_redirect always ends
25+
+ # up being False consequently.
26+
+ # Here we fix the issue by setting raise_on_redirect to
27+
+ # a value needed by the pool manager without considering
28+
+ # the redirect boolean.
29+
+ raise_on_redirect = retries is not False
30+
+ retries = Retry.from_int(retries, redirect=False)
31+
+ retries.raise_on_redirect = raise_on_redirect
32+
+ connection_pool_kw = connection_pool_kw.copy()
33+
+ connection_pool_kw["retries"] = retries
34+
self.connection_pool_kw = connection_pool_kw
35+
self.pools = RecentlyUsedContainer(num_pools, dispose_func=lambda p: p.close())
36+
37+
@@ -340,7 +356,7 @@ class PoolManager(RequestMethods):
38+
if response.status == 303:
39+
method = "GET"
40+
41+
- retries = kw.get("retries")
42+
+ retries = kw.get("retries", response.retries)
43+
if not isinstance(retries, Retry):
44+
retries = Retry.from_int(retries, redirect=redirect)
45+
46+
--
47+
2.34.1
48+

‎SPECS/python-virtualenv/python-virtualenv.signatures.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
22
"Signatures": {
3-
"virtualenv-20.36.1.tar.gz": "8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba"
3+
"python-virtualenv-20.26.6.tar.gz": "280aede09a2a5c317e409a00102e7077c6432c5a38f0ef938e643805a7ad2c48"
44
}
55
}

‎SPECS/python-virtualenv/python-virtualenv.spec‎

Lines changed: 61 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,18 @@
11
Summary: Virtual Python Environment builder
22
Name: python-virtualenv
3-
Version: 20.36.1
4-
Release: 1%{?dist}
3+
Version: 20.26.6
4+
Release: 2%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
88
Group: Development/Languages/Python
99
URL: https://pypi.python.org/pypi/virtualenv
10-
Source0: https://files.pythonhosted.org/packages/aa/a3/4d310fa5f00863544e1d0f4de93bddec248499ccf97d4791bc3122c9d4f3/virtualenv-20.36.1.tar.gz
10+
Source0: https://files.pythonhosted.org/packages/3f/40/abc5a766da6b0b2457f819feab8e9203cbeae29327bd241359f866a3da9d/virtualenv-20.26.6.tar.gz#/%{name}-%{version}.tar.gz
1111
Patch0: 0001-replace-to-flit.patch
12-
Patch1000: CVE-2025-50181.patch
12+
Patch1000: CVE-2025-50181v0.patch
13+
Patch1001: CVE-2025-50181v1.patch
14+
Patch1002: CVE-2025-50181v2.patch
15+
Patch1003: CVE-2025-50181v3.patch
1316
BuildArch: noarch
1417

1518
%description
@@ -51,29 +54,66 @@ virtualenv is a tool to create isolated Python environment.
5154
# For the poolmanager.py under tests, it is archived inside a .whl file, which in turn is archived inside another .whl file,
5255
# so, we need to unpack the outer .whl, then unpack the inner .whl, apply the patch, and then re-zip both levels.
5356

54-
echo "Manually Patching virtualenv-20.36.1/src/virtualenv/seed/wheels/embed/pip-25.0.1-py3-none-any.whl/pip/_vendor/urllib3/poolmanager.py"
55-
mkdir -p unpacked_pip-25.0.1-py3-none-any
56-
unzip src/virtualenv/seed/wheels/embed/pip-25.0.1-py3-none-any.whl -d unpacked_pip-25.0.1-py3-none-any
57-
patch -p1 -d unpacked_pip-25.0.1-py3-none-any < %{PATCH1000}
57+
echo "Manually Patching virtualenv-20.26.6/src/virtualenv/seed/wheels/embed/pip-24.0-py3-none-any.whl/pip/_vendor/urllib3/poolmanager.py"
58+
mkdir -p unpacked_pip-24.0-py3-none-any
59+
unzip src/virtualenv/seed/wheels/embed/pip-24.0-py3-none-any.whl -d unpacked_pip-24.0-py3-none-any
60+
patch -p1 -d unpacked_pip-24.0-py3-none-any < %{PATCH1000}
5861
# Remove the original file
59-
rm -f src/virtualenv/seed/wheels/embed/pip-25.0.1-py3-none-any.whl
62+
rm -f src/virtualenv/seed/wheels/embed/pip-24.0-py3-none-any.whl
6063
# After patching, re-zip the contents back into a .whl
61-
pushd unpacked_pip-25.0.1-py3-none-any
62-
zip -r ../src/virtualenv/seed/wheels/embed/pip-25.0.1-py3-none-any.whl *
64+
pushd unpacked_pip-24.0-py3-none-any
65+
zip -r ../src/virtualenv/seed/wheels/embed/pip-24.0-py3-none-any.whl *
6366
popd
64-
rm -rf unpacked_pip-25.0.1-py3-none-any
67+
rm -rf unpacked_pip-24.0-py3-none-any
6568

66-
echo "Manually Patching virtualenv-20.36.1/src/virtualenv/seed/wheels/embed/pip-25.3-py3-none-any.whl/pip/_vendor/urllib3/poolmanager.py"
67-
mkdir -p unpacked_pip-25.3-py3-none-any
68-
unzip src/virtualenv/seed/wheels/embed/pip-25.3-py3-none-any.whl -d unpacked_pip-25.3-py3-none-any
69-
patch -p1 -d unpacked_pip-25.3-py3-none-any < %{PATCH1000}
69+
echo "Manually Patching virtualenv-20.26.6/src/virtualenv/seed/wheels/embed/pip-24.2-py3-none-any.whl/pip/_vendor/urllib3/poolmanager.py"
70+
mkdir -p unpacked_pip-24.2-py3-none-any
71+
unzip src/virtualenv/seed/wheels/embed/pip-24.2-py3-none-any.whl -d unpacked_pip-24.2-py3-none-any
72+
patch -p1 -d unpacked_pip-24.2-py3-none-any < %{PATCH1001}
7073
# Remove the original file
71-
rm -f src/virtualenv/seed/wheels/embed/pip-25.3-py3-none-any.whl
74+
rm -f src/virtualenv/seed/wheels/embed/pip-24.2-py3-none-any.whl
7275
# After patching, re-zip the contents back into a .whl
73-
pushd unpacked_pip-25.3-py3-none-any
74-
zip -r ../src/virtualenv/seed/wheels/embed/pip-25.3-py3-none-any.whl *
76+
pushd unpacked_pip-24.2-py3-none-any
77+
zip -r ../src/virtualenv/seed/wheels/embed/pip-24.2-py3-none-any.whl *
78+
popd
79+
rm -rf unpacked_pip-24.2-py3-none-any
80+
81+
echo "Manually Patching the poolmanager.py under tests, it needs to be unpacked from a .whl file, which is inside another .whl file"
82+
# unpack the outer wheel
83+
mkdir -p unpacked_virtualenv-16.7.9-py2.py3-none-any
84+
unzip tests/unit/create/virtualenv-16.7.9-py2.py3-none-any.whl -d unpacked_virtualenv-16.7.9-py2.py3-none-any
85+
86+
# This is the pip-19.1.1 wheel that is archived inside the virtualenv_support directory of the outer wheel
87+
# We need to unpack it, apply the patch, and then re-zip it
88+
echo "Manually Patching virtualenv-16.7.9-py2.py3-none-any/virtualenv_support/pip-19.1.1-py2.py3-none-any.whl/pip/_vendor/urllib3/poolmanager.py"
89+
# unpack the inner wheel
90+
mkdir -p unpacked_pip-19.1.1-py2.py3-none-any
91+
unzip unpacked_virtualenv-16.7.9-py2.py3-none-any/virtualenv_support/pip-19.1.1-py2.py3-none-any.whl -d unpacked_pip-19.1.1-py2.py3-none-any
92+
patch -p1 -d unpacked_pip-19.1.1-py2.py3-none-any < %{PATCH1002}
93+
rm -f unpacked_virtualenv-16.7.9-py2.py3-none-any/virtualenv_support/pip-19.1.1-py2.py3-none-any.whl
94+
pushd unpacked_pip-19.1.1-py2.py3-none-any
95+
zip -r ../unpacked_virtualenv-16.7.9-py2.py3-none-any/virtualenv_support/pip-19.1.1-py2.py3-none-any.whl *
96+
popd
97+
rm -rf unpacked_pip-19.1.1-py2.py3-none-any
98+
99+
# Now, we need to patch the pip-19.3.1 wheel that is archived inside the virtualenv_support directory of the outer wheel
100+
# We need to unpack it, apply the patch, and then re-zip it
101+
echo "Manually Patching virtualenv-16.7.9-py2.py3-none-any/virtualenv_support/pip-19.3.1-py2.py3-none-any.whl/pip/_vendor/urllib3/poolmanager.py"
102+
mkdir -p unpacked_pip-19.3.1-py2.py3-none-any
103+
unzip unpacked_virtualenv-16.7.9-py2.py3-none-any/virtualenv_support/pip-19.3.1-py2.py3-none-any.whl -d unpacked_pip-19.3.1-py2.py3-none-any
104+
patch -p1 -d unpacked_pip-19.3.1-py2.py3-none-any < %{PATCH1003}
105+
# Repack the inner wheel
106+
rm -f unpacked_virtualenv-16.7.9-py2.py3-none-any/virtualenv_support/pip-19.3.1-py2.py3-none-any.whl
107+
pushd unpacked_pip-19.3.1-py2.py3-none-any
108+
zip -r ../unpacked_virtualenv-16.7.9-py2.py3-none-any/virtualenv_support/pip-19.3.1-py2.py3-none-any.whl *
109+
popd
110+
rm -rf unpacked_pip-19.3.1-py2.py3-none-any
111+
112+
# Repack the outer wheel
113+
rm -f tests/unit/create/virtualenv-16.7.9-py2.py3-none-any.whl
114+
pushd unpacked_virtualenv-16.7.9-py2.py3-none-any
115+
zip -r ../tests/unit/create/unpacked_virtualenv-16.7.9-py2.py3-none-any *
75116
popd
76-
rm -rf unpacked_pip-25.3-py3-none-any
77117

78118
%generate_buildrequires
79119

@@ -86,7 +126,7 @@ rm -rf unpacked_pip-25.3-py3-none-any
86126
%check
87127
pip3 install 'tox>=3.27.1,<4.0.0'
88128
# skip "test_can_build_c_extensions" tests since they fail on python3_version >= 3.12. See https://src.fedoraproject.org/rpms/python-virtualenv/blob/rawhide/f/python-virtualenv.spec#_153
89-
export PYTEST_ADDOPTS='-k "not test_can_build_c_extensions"'
129+
sed -i 's/coverage run -m pytest {posargs:--junitxml {toxworkdir}\/junit\.{envname}\.xml tests --int}/coverage run -m pytest {posargs:--junitxml {toxworkdir}\/junit\.{envname}\.xml tests -k "not test_can_build_c_extensions" --int}/g' tox.ini
90130
tox -e py
91131

92132
%files -n python3-virtualenv
@@ -96,9 +136,6 @@ tox -e py
96136
%{_bindir}/virtualenv
97137

98138
%changelog
99-
* Thu Jan 15 2026 Archana Shettigar <v-shettigara@microsoft.com> - 20.36.1-1
100-
- Upgrade to 20.36.1 for CVE-2026-22702
101-
102139
* Wed Jul 09 2025 Aninda Pradhan <v-anipradhan@microsoft.com> - 20.26.6-2
103140
- Add patch to fix CVE-2025-50181 in urllib3 poolmanager.py
104141

‎cgmanifest.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24914,8 +24914,8 @@
2491424914
"type": "other",
2491524915
"other": {
2491624916
"name": "python-virtualenv",
24917-
"version": "20.36.1",
24918-
"downloadUrl": "https://files.pythonhosted.org/packages/aa/a3/4d310fa5f00863544e1d0f4de93bddec248499ccf97d4791bc3122c9d4f3/virtualenv-20.36.1.tar.gz"
24917+
"version": "20.26.6",
24918+
"downloadUrl": "https://files.pythonhosted.org/packages/3f/40/abc5a766da6b0b2457f819feab8e9203cbeae29327bd241359f866a3da9d/virtualenv-20.26.6.tar.gz"
2491924919
}
2492024920
}
2492124921
},

0 commit comments

Comments
 (0)