Skip to content

Commit edcde9f

Browse files
azurelinux-securityjslobodzian
azurelinux-security
and
jslobodzian
authored
[AutoPR- Security] Patch python3 for CVE-2026-4519 [HIGH] (#16281)
Co-authored-by: jslobodzian <joslobo@microsoft.com>
1 parent f42b7f0 commit edcde9f

File tree

6 files changed

+154
-27
lines changed

6 files changed

+154
-27
lines changed

‎SPECS/python3/CVE-2026-4519.patch‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
From 3be471c77789110b81fe47160c504a3960e8ce4f Mon Sep 17 00:00:00 2001
2+
From: Seth Michael Larson <seth@python.org>
3+
Date: Fri, 20 Mar 2026 09:47:13 -0500
4+
Subject: [PATCH] gh-143930: Reject leading dashes in webbrowser URLs (cherry
5+
picked from commit 82a24a4442312bdcfc4c799885e8b3e00990f02b)
6+
7+
Co-authored-by: Seth Michael Larson <seth@python.org>
8+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
9+
Upstream-reference: https://github.com/python/cpython/pull/146359.patch
10+
---
11+
Lib/test/test_webbrowser.py | 5 +++++
12+
Lib/webbrowser.py | 14 ++++++++++++++
13+
.../2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst | 1 +
14+
3 files changed, 20 insertions(+)
15+
create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
16+
17+
diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
18+
index 519a943..f8e9234 100644
19+
--- a/Lib/test/test_webbrowser.py
20+
+++ b/Lib/test/test_webbrowser.py
21+
@@ -55,6 +55,11 @@ class GenericBrowserCommandTest(CommandTestMixin, unittest.TestCase):
22+
options=[],
23+
arguments=[URL])
24+
25+
+ def test_reject_dash_prefixes(self):
26+
+ browser = self.browser_class(name=CMD_NAME)
27+
+ with self.assertRaises(ValueError):
28+
+ browser.open(f"--key=val {URL}")
29+
+
30+
31+
class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase):
32+
33+
diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
34+
index 6023c1e..f5349db 100755
35+
--- a/Lib/webbrowser.py
36+
+++ b/Lib/webbrowser.py
37+
@@ -154,6 +154,12 @@ class BaseBrowser(object):
38+
def open_new_tab(self, url):
39+
return self.open(url, 2)
40+
41+
+ @staticmethod
42+
+ def _check_url(url):
43+
+ """Ensures that the URL is safe to pass to subprocesses as a parameter"""
44+
+ if url and url.lstrip().startswith("-"):
45+
+ raise ValueError(f"Invalid URL: {url}")
46+
+
47+
48+
class GenericBrowser(BaseBrowser):
49+
"""Class for all browsers started with a command
50+
@@ -171,6 +177,7 @@ class GenericBrowser(BaseBrowser):
51+
52+
def open(self, url, new=0, autoraise=True):
53+
sys.audit("webbrowser.open", url)
54+
+ self._check_url(url)
55+
cmdline = [self.name] + [arg.replace("%s", url)
56+
for arg in self.args]
57+
try:
58+
@@ -191,6 +198,7 @@ class BackgroundBrowser(GenericBrowser):
59+
cmdline = [self.name] + [arg.replace("%s", url)
60+
for arg in self.args]
61+
sys.audit("webbrowser.open", url)
62+
+ self._check_url(url)
63+
try:
64+
if sys.platform[:3] == 'win':
65+
p = subprocess.Popen(cmdline)
66+
@@ -256,6 +264,7 @@ class UnixBrowser(BaseBrowser):
67+
68+
def open(self, url, new=0, autoraise=True):
69+
sys.audit("webbrowser.open", url)
70+
+ self._check_url(url)
71+
if new == 0:
72+
action = self.remote_action
73+
elif new == 1:
74+
@@ -357,6 +366,7 @@ class Konqueror(BaseBrowser):
75+
76+
def open(self, url, new=0, autoraise=True):
77+
sys.audit("webbrowser.open", url)
78+
+ self._check_url(url)
79+
# XXX Currently I know no way to prevent KFM from opening a new win.
80+
if new == 2:
81+
action = "newTab"
82+
@@ -441,6 +451,7 @@ class Grail(BaseBrowser):
83+
84+
def open(self, url, new=0, autoraise=True):
85+
sys.audit("webbrowser.open", url)
86+
+ self._check_url(url)
87+
if new:
88+
ok = self._remote("LOADNEW " + url)
89+
else:
90+
@@ -599,6 +610,7 @@ if sys.platform[:3] == "win":
91+
class WindowsDefault(BaseBrowser):
92+
def open(self, url, new=0, autoraise=True):
93+
sys.audit("webbrowser.open", url)
94+
+ self._check_url(url)
95+
try:
96+
os.startfile(url)
97+
except OSError:
98+
@@ -629,6 +641,7 @@ if sys.platform == 'darwin':
99+
100+
def open(self, url, new=0, autoraise=True):
101+
sys.audit("webbrowser.open", url)
102+
+ self._check_url(url)
103+
assert "'" not in url
104+
# hack for local urls
105+
if not ':' in url:
106+
@@ -666,6 +679,7 @@ if sys.platform == 'darwin':
107+
self._name = name
108+
109+
def open(self, url, new=0, autoraise=True):
110+
+ self._check_url(url)
111+
if self._name == 'default':
112+
script = 'open location "%s"' % url.replace('"', '%22') # opens in default browser
113+
else:
114+
diff --git a/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
115+
new file mode 100644
116+
index 0000000..0f27eae
117+
--- /dev/null
118+
+++ b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
119+
@@ -0,0 +1 @@
120+
+Reject leading dashes in URLs passed to :func:`webbrowser.open`
121+
--
122+
2.45.4
123+

‎SPECS/python3/python3.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
Summary: A high-level scripting language
1313
Name: python3
1414
Version: 3.9.19
15-
Release: 19%{?dist}
15+
Release: 20%{?dist}
1616
License: PSF
1717
Vendor: Microsoft Corporation
1818
Distribution: Mariner
@@ -54,6 +54,7 @@ Patch1004: CVE-2024-37891.patch
5454
Patch1005: CVE-2025-50181.patch
5555
Patch1006: CVE-2023-5752.patch
5656
Patch1007: CVE-2023-45803.patch
57+
Patch1008: CVE-2026-4519.patch
5758

5859
BuildRequires: bzip2-devel
5960
BuildRequires: expat-devel >= 2.1.0
@@ -387,6 +388,9 @@ make test TESTOPTS="-x test_multiprocessing_spawn -x test_socket -x test_email"
387388
%{_libdir}/python%{majmin}/test/*
388389

389390
%changelog
391+
* Wed Mar 25 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.9.19-20
392+
- Patch for CVE-2026-4519
393+
390394
* Fri Jan 30 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.9.19-19
391395
- Patch for CVE-2026-0865, CVE-2025-12084
392396

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -237,10 +237,10 @@ ca-certificates-base-2.0.0-25.cm2.noarch.rpm
237237
ca-certificates-2.0.0-25.cm2.noarch.rpm
238238
dwz-0.14-2.cm2.aarch64.rpm
239239
unzip-6.0-22.cm2.aarch64.rpm
240-
python3-3.9.19-19.cm2.aarch64.rpm
241-
python3-devel-3.9.19-19.cm2.aarch64.rpm
242-
python3-libs-3.9.19-19.cm2.aarch64.rpm
243-
python3-setuptools-3.9.19-19.cm2.noarch.rpm
240+
python3-3.9.19-20.cm2.aarch64.rpm
241+
python3-devel-3.9.19-20.cm2.aarch64.rpm
242+
python3-libs-3.9.19-20.cm2.aarch64.rpm
243+
python3-setuptools-3.9.19-20.cm2.noarch.rpm
244244
python3-pygments-2.4.2-7.cm2.noarch.rpm
245245
which-2.21-8.cm2.aarch64.rpm
246246
libselinux-3.2-1.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -237,10 +237,10 @@ ca-certificates-base-2.0.0-25.cm2.noarch.rpm
237237
ca-certificates-2.0.0-25.cm2.noarch.rpm
238238
dwz-0.14-2.cm2.x86_64.rpm
239239
unzip-6.0-22.cm2.x86_64.rpm
240-
python3-3.9.19-19.cm2.x86_64.rpm
241-
python3-devel-3.9.19-19.cm2.x86_64.rpm
242-
python3-libs-3.9.19-19.cm2.x86_64.rpm
243-
python3-setuptools-3.9.19-19.cm2.noarch.rpm
240+
python3-3.9.19-20.cm2.x86_64.rpm
241+
python3-devel-3.9.19-20.cm2.x86_64.rpm
242+
python3-libs-3.9.19-20.cm2.x86_64.rpm
243+
python3-setuptools-3.9.19-20.cm2.noarch.rpm
244244
python3-pygments-2.4.2-7.cm2.noarch.rpm
245245
which-2.21-8.cm2.x86_64.rpm
246246
libselinux-3.2-1.cm2.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -510,28 +510,28 @@ procps-ng-devel-3.3.17-2.cm2.aarch64.rpm
510510
procps-ng-lang-3.3.17-2.cm2.aarch64.rpm
511511
pyproject-rpm-macros-1.0.0~rc1-4.cm2.noarch.rpm
512512
python-markupsafe-debuginfo-2.1.0-1.cm2.aarch64.rpm
513-
python3-3.9.19-19.cm2.aarch64.rpm
513+
python3-3.9.19-20.cm2.aarch64.rpm
514514
python3-audit-3.0.6-8.cm2.aarch64.rpm
515515
python3-cracklib-2.9.7-5.cm2.aarch64.rpm
516-
python3-curses-3.9.19-19.cm2.aarch64.rpm
516+
python3-curses-3.9.19-20.cm2.aarch64.rpm
517517
python3-Cython-0.29.33-2.cm2.aarch64.rpm
518-
python3-debuginfo-3.9.19-19.cm2.aarch64.rpm
519-
python3-devel-3.9.19-19.cm2.aarch64.rpm
518+
python3-debuginfo-3.9.19-20.cm2.aarch64.rpm
519+
python3-devel-3.9.19-20.cm2.aarch64.rpm
520520
python3-gpg-1.16.0-2.cm2.aarch64.rpm
521521
python3-jinja2-3.0.3-7.cm2.noarch.rpm
522522
python3-libcap-ng-0.8.2-2.cm2.aarch64.rpm
523-
python3-libs-3.9.19-19.cm2.aarch64.rpm
523+
python3-libs-3.9.19-20.cm2.aarch64.rpm
524524
python3-libxml2-2.10.4-11.cm2.aarch64.rpm
525525
python3-lxml-4.9.1-1.cm2.aarch64.rpm
526526
python3-magic-5.40-3.cm2.noarch.rpm
527527
python3-markupsafe-2.1.0-1.cm2.aarch64.rpm
528528
python3-newt-0.52.21-5.cm2.aarch64.rpm
529-
python3-pip-3.9.19-19.cm2.noarch.rpm
529+
python3-pip-3.9.19-20.cm2.noarch.rpm
530530
python3-pygments-2.4.2-7.cm2.noarch.rpm
531531
python3-rpm-4.18.0-4.cm2.aarch64.rpm
532-
python3-setuptools-3.9.19-19.cm2.noarch.rpm
533-
python3-test-3.9.19-19.cm2.aarch64.rpm
534-
python3-tools-3.9.19-19.cm2.aarch64.rpm
532+
python3-setuptools-3.9.19-20.cm2.noarch.rpm
533+
python3-test-3.9.19-20.cm2.aarch64.rpm
534+
python3-tools-3.9.19-20.cm2.aarch64.rpm
535535
readline-8.1-1.cm2.aarch64.rpm
536536
readline-debuginfo-8.1-1.cm2.aarch64.rpm
537537
readline-devel-8.1-1.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -516,28 +516,28 @@ procps-ng-devel-3.3.17-2.cm2.x86_64.rpm
516516
procps-ng-lang-3.3.17-2.cm2.x86_64.rpm
517517
pyproject-rpm-macros-1.0.0~rc1-4.cm2.noarch.rpm
518518
python-markupsafe-debuginfo-2.1.0-1.cm2.x86_64.rpm
519-
python3-3.9.19-19.cm2.x86_64.rpm
519+
python3-3.9.19-20.cm2.x86_64.rpm
520520
python3-audit-3.0.6-8.cm2.x86_64.rpm
521521
python3-cracklib-2.9.7-5.cm2.x86_64.rpm
522-
python3-curses-3.9.19-19.cm2.x86_64.rpm
522+
python3-curses-3.9.19-20.cm2.x86_64.rpm
523523
python3-Cython-0.29.33-2.cm2.x86_64.rpm
524-
python3-debuginfo-3.9.19-19.cm2.x86_64.rpm
525-
python3-devel-3.9.19-19.cm2.x86_64.rpm
524+
python3-debuginfo-3.9.19-20.cm2.x86_64.rpm
525+
python3-devel-3.9.19-20.cm2.x86_64.rpm
526526
python3-gpg-1.16.0-2.cm2.x86_64.rpm
527527
python3-jinja2-3.0.3-7.cm2.noarch.rpm
528528
python3-libcap-ng-0.8.2-2.cm2.x86_64.rpm
529-
python3-libs-3.9.19-19.cm2.x86_64.rpm
529+
python3-libs-3.9.19-20.cm2.x86_64.rpm
530530
python3-libxml2-2.10.4-11.cm2.x86_64.rpm
531531
python3-lxml-4.9.1-1.cm2.x86_64.rpm
532532
python3-magic-5.40-3.cm2.noarch.rpm
533533
python3-markupsafe-2.1.0-1.cm2.x86_64.rpm
534534
python3-newt-0.52.21-5.cm2.x86_64.rpm
535-
python3-pip-3.9.19-19.cm2.noarch.rpm
535+
python3-pip-3.9.19-20.cm2.noarch.rpm
536536
python3-pygments-2.4.2-7.cm2.noarch.rpm
537537
python3-rpm-4.18.0-4.cm2.x86_64.rpm
538-
python3-setuptools-3.9.19-19.cm2.noarch.rpm
539-
python3-test-3.9.19-19.cm2.x86_64.rpm
540-
python3-tools-3.9.19-19.cm2.x86_64.rpm
538+
python3-setuptools-3.9.19-20.cm2.noarch.rpm
539+
python3-test-3.9.19-20.cm2.x86_64.rpm
540+
python3-tools-3.9.19-20.cm2.x86_64.rpm
541541
readline-8.1-1.cm2.x86_64.rpm
542542
readline-debuginfo-8.1-1.cm2.x86_64.rpm
543543
readline-devel-8.1-1.cm2.x86_64.rpm

0 commit comments

Comments
 (0)