From d2b2dc49ab32128515bcf69a3e11ee1afd5fd3ba Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sat, 27 Dec 2025 16:19:15 +0100 Subject: [PATCH] package/python-filelock: fix CVE-2025-68146 Fixes the following vulnerability: - CVE-2025-68146 A Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. For more informations, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-68146 - https://github.com/tox-dev/filelock/commit/18a99880087934252e7c0c994640f66e80e34be9 (cherry picked from commit d9c1379d1f7651951d00ce59b588d74aad049573) Signed-off-by: Thomas Perale --- ...-vulnerability-in-lock-file-creation.patch | 27 +++++++++++++++++++ package/python-filelock/python-filelock.mk | 3 +++ 2 files changed, 30 insertions(+) create mode 100644 package/python-filelock/0001-Fix-TOCTOU-symlink-vulnerability-in-lock-file-creation.patch diff --git a/package/python-filelock/0001-Fix-TOCTOU-symlink-vulnerability-in-lock-file-creation.patch b/package/python-filelock/0001-Fix-TOCTOU-symlink-vulnerability-in-lock-file-creation.patch new file mode 100644 index 0000000000..a1656e1fa1 --- /dev/null +++ b/package/python-filelock/0001-Fix-TOCTOU-symlink-vulnerability-in-lock-file-creation.patch @@ -0,0 +1,27 @@ +From 4724d7f8c3393ec1f048c93933e6e3e6ec321f0e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= +Date: Mon, 15 Dec 2025 15:52:12 -0800 +Subject: [PATCH] Fix TOCTOU symlink vulnerability in lock file creation (#461) + +CVE: CVE-2025-68146 +Upstream: https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e +[thomas: Dropped the windows part of the patch] +Signed-off-by: Thomas Perale +--- + src/filelock/_unix.py | 2 +- + src/filelock/_windows.py | 38 ++++++++++++++++++++++++++++++++++++++ + 2 files changed, 39 insertions(+), 1 deletion(-) + +diff --git a/src/filelock/_unix.py b/src/filelock/_unix.py +index b2fd0f33..25cbeca6 100644 +--- a/src/filelock/_unix.py ++++ b/src/filelock/_unix.py +@@ -38,7 +38,7 @@ class UnixFileLock(BaseFileLock): + + def _acquire(self) -> None: + ensure_directory_exists(self.lock_file) +- open_flags = os.O_RDWR | os.O_TRUNC ++ open_flags = os.O_RDWR | os.O_TRUNC | os.O_NOFOLLOW + if not Path(self.lock_file).exists(): + open_flags |= os.O_CREAT + fd = os.open(self.lock_file, open_flags, self._context.mode) diff --git a/package/python-filelock/python-filelock.mk b/package/python-filelock/python-filelock.mk index 44599ee865..48025d8345 100644 --- a/package/python-filelock/python-filelock.mk +++ b/package/python-filelock/python-filelock.mk @@ -12,4 +12,7 @@ PYTHON_FILELOCK_LICENSE = Public Domain PYTHON_FILELOCK_LICENSE_FILES = LICENSE PYTHON_FILELOCK_DEPENDENCIES = host-python-hatch-vcs +# 0001-Fix-TOCTOU-symlink-vulnerability-in-lock-file-creation.patch +PYTHON_FILELOCK_IGNORE_CVES += CVE-2025-68146 + $(eval $(python-package))