From 8ec67b7f35b8cd4fdb284ad23e69f5ca783e0fa8 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Thu, 6 Mar 2025 13:03:52 +0100 Subject: [PATCH 1/2] Fix CI tests to account for normalization of dist-info dirs (PEP 491) setuptools now normalizes the dist-info directory names to lowercase according to PEP 491 Also egg-info directories are not created anymore [skip changelog] (cherry picked from commit 97a9e3e2155364562c2438142982fbb7afb4629a) --- tests/pip_install_upgrade/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/pip_install_upgrade/runtest.sh b/tests/pip_install_upgrade/runtest.sh index 40e14a3..4c520f5 100755 --- a/tests/pip_install_upgrade/runtest.sh +++ b/tests/pip_install_upgrade/runtest.sh @@ -18,14 +18,14 @@ RPM_BUILD_ROOT=/ /usr/bin/pip install 'Pello==1.0.1' /usr/bin/pip freeze | grep '^Pello==1\.0\.2$' # Both installations should still exist -test -d "${RPM_SITELIB}/Pello-1.0.1-py${PYTHON_VERSION}.egg-info" || test -d "${RPM_SITELIB}/Pello-1.0.1.dist-info" +test -d "${RPM_SITELIB}/pello-1.0.1.dist-info" test -d "${LOCAL_SITELIB}/Pello-1.0.2.dist-info" # Let's ditch the local one /usr/bin/pip uninstall --yes Pello # It should only remove one of them -test -d "${RPM_SITELIB}/Pello-1.0.1-py${PYTHON_VERSION}.egg-info" || test -d "${RPM_SITELIB}/Pello-1.0.1.dist-info" +test -d "${RPM_SITELIB}/pello-1.0.1.dist-info" ! test -d "${LOCAL_SITELIB}/Pello-1.0.2.dist-info" # And pip should still see the RPM-installed one From 4a2bfe6c5776a6888848ab8fc485ce140e659d9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Wed, 10 Sep 2025 19:11:16 +0200 Subject: [PATCH 2/2] Security fix for the bundled urllib3 for CVE-2025-50181 --- python-pip.spec | 5 ++++ urllib3-CVE-2025-50181.patch | 51 ++++++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) create mode 100644 urllib3-CVE-2025-50181.patch diff --git a/python-pip.spec b/python-pip.spec index bb84847..7ba2520 100644 --- a/python-pip.spec +++ b/python-pip.spec @@ -68,6 +68,11 @@ Patch: dummy-certifi.patch # this warning is juts moot. Also, the warning breaks CPython test suite. Patch: nowarn-pip._internal.main.patch +# Patch for the bundled urllib3 for CVE-2025-50181 +# Redirects are not disabled when retries are disabled on PoolManager instantiation +# Upstream fix: https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857 +Patch: urllib3-CVE-2025-50181.patch + # Remove -s from Python shebang - ensure that packages installed with pip # to user locations are seen by pip itself %undefine _py3_shebang_s diff --git a/urllib3-CVE-2025-50181.patch b/urllib3-CVE-2025-50181.patch new file mode 100644 index 0000000..05e6353 --- /dev/null +++ b/urllib3-CVE-2025-50181.patch @@ -0,0 +1,51 @@ +From b3d543d7e16af844394316360ef1bf0b9d10f1b1 Mon Sep 17 00:00:00 2001 +From: Illia Volochii +Date: Wed, 18 Jun 2025 16:25:01 +0300 +Subject: [PATCH] Security fix for CVE-2025-50181 + +Co-authored-by: Seth Michael Larson +Co-authored-by: Quentin Pradet +Co-authored-by: Seth Michael Larson +--- + src/pip/_vendor/urllib3/poolmanager.py | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/src/pip/_vendor/urllib3/poolmanager.py b/src/pip/_vendor/urllib3/poolmanager.py +index fb51bf7..a8de7c6 100644 +--- a/src/pip/_vendor/urllib3/poolmanager.py ++++ b/src/pip/_vendor/urllib3/poolmanager.py +@@ -170,6 +170,22 @@ class PoolManager(RequestMethods): + + def __init__(self, num_pools=10, headers=None, **connection_pool_kw): + RequestMethods.__init__(self, headers) ++ if "retries" in connection_pool_kw: ++ retries = connection_pool_kw["retries"] ++ if not isinstance(retries, Retry): ++ # When Retry is initialized, raise_on_redirect is based ++ # on a redirect boolean value. ++ # But requests made via a pool manager always set ++ # redirect to False, and raise_on_redirect always ends ++ # up being False consequently. ++ # Here we fix the issue by setting raise_on_redirect to ++ # a value needed by the pool manager without considering ++ # the redirect boolean. ++ raise_on_redirect = retries is not False ++ retries = Retry.from_int(retries, redirect=False) ++ retries.raise_on_redirect = raise_on_redirect ++ connection_pool_kw = connection_pool_kw.copy() ++ connection_pool_kw["retries"] = retries + self.connection_pool_kw = connection_pool_kw + self.pools = RecentlyUsedContainer(num_pools) + +@@ -389,7 +405,7 @@ class PoolManager(RequestMethods): + kw["body"] = None + kw["headers"] = HTTPHeaderDict(kw["headers"])._prepare_for_method_change() + +- retries = kw.get("retries") ++ retries = kw.get("retries", response.retries) + if not isinstance(retries, Retry): + retries = Retry.from_int(retries, redirect=redirect) + +-- +2.51.0 +