From 8e65b43b537da5afab1ce3834a95d6eb8eaf9c26 Mon Sep 17 00:00:00 2001 From: PengLAI Code Date: Tue, 28 Jul 2026 14:44:41 +0800 Subject: [PATCH 1/2] [CVE] [Anolis] add patch to fix CVE-2025-66418 to #IK1NGD Follow the established convention in this repo (see 0.8.1-2 and 0.8.1-3 changelog entries): bump anolis_release to 4 and rebuild python-s3transfer against the fixed python-urllib3 (fix present since 1... Origin: PengLAI Code project: TC2024080204 Assisted-by: PengLAI Code --- CVE-2025-66418.patch | 29 +++++++++++++++++++++++++++++ python-s3transfer.spec | 8 +++++++- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 CVE-2025-66418.patch diff --git a/CVE-2025-66418.patch b/CVE-2025-66418.patch new file mode 100644 index 0000000..388feb3 --- /dev/null +++ b/CVE-2025-66418.patch @@ -0,0 +1,29 @@ +From: PengLAI Code +Date: Tue, 28 Jul 2026 06:44:41 +0000 +Subject: [PATCH] Fix CVE-2025-66418 in python-s3transfer + +CVE: CVE-2025-66418 +Bug: CVE-2025-66418 + +--- + python-s3transfer.spec | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/python-s3transfer.spec b/python-s3transfer.spec +index 6b87fa5..9544467 100644 +--- a/python-s3transfer.spec ++++ b/python-s3transfer.spec +@@ -1,4 +1,4 @@ +-%define anolis_release 3 ++%define anolis_release 4 + + %global srcname s3transfer + %global _description \ +@@ -65,5 +65,8 @@ Doc files for python3-%{srcname} + + %changelog ++* Tue Jul 28 2026 penglai-agent - 0.8.1-4 ++- Rebuild with python-urllib3 >= 1.26.19-3 to fix CVE-2025-66418 ++ + * Wed Jun 24 2026 mgb01105731 - 0.8.1-3 + - Rebuild with python-urllib3-1.26.19-5 to fix CVE-2025-66471 diff --git a/python-s3transfer.spec b/python-s3transfer.spec index 6b87fa5..8436942 100644 --- a/python-s3transfer.spec +++ b/python-s3transfer.spec @@ -1,4 +1,4 @@ -%define anolis_release 3 +%define anolis_release 4 %global srcname s3transfer %global _description \ @@ -12,6 +12,8 @@ Summary: Amazon S3 Transfer Manager License: Apache-2.0 URL: https://pypi.org/project/s3transfer/ Source0: %{pypi_source} +# CVE-2025-66418 +Patch0001: CVE-2025-66418.patch BuildArch: noarch @@ -64,6 +66,10 @@ Doc files for python3-%{srcname} %doc README.rst %changelog +* Tue Jul 28 2026 PengLAI Code - 0.8.1-4 +- Fix CVE-2025-66418 +- Patch generated by PengLAI Code Agent + * Wed Jun 24 2026 mgb01105731 - 0.8.1-3 - Rebuild with python-urllib3-1.26.19-5 to fix CVE-2025-66471 -- Gitee From cf6c901b969ef475e2e8d46903f971d31da99e30 Mon Sep 17 00:00:00 2001 From: PengLAI Code Date: Tue, 28 Jul 2026 14:46:37 +0800 Subject: [PATCH 2/2] [CVE] [Anolis] fix CVE-2025-66418 via rebuild against fixed python-urllib3 to #IK1NGD CVE-2025-66418 is a vulnerability in urllib3, not in s3transfer source. Anolis a23 python-urllib3 ships the fix since 1.26.19-3. Drop the mistakenly added source patch and rebuild against the fixed urllib3, following the same convention as releases 0.8.1-2 and 0.8.1-3. --- CVE-2025-66418.patch | 29 ----------------------------- python-s3transfer.spec | 5 +---- 2 files changed, 1 insertion(+), 33 deletions(-) delete mode 100644 CVE-2025-66418.patch diff --git a/CVE-2025-66418.patch b/CVE-2025-66418.patch deleted file mode 100644 index 388feb3..0000000 --- a/CVE-2025-66418.patch +++ /dev/null @@ -1,29 +0,0 @@ -From: PengLAI Code -Date: Tue, 28 Jul 2026 06:44:41 +0000 -Subject: [PATCH] Fix CVE-2025-66418 in python-s3transfer - -CVE: CVE-2025-66418 -Bug: CVE-2025-66418 - ---- - python-s3transfer.spec | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/python-s3transfer.spec b/python-s3transfer.spec -index 6b87fa5..9544467 100644 ---- a/python-s3transfer.spec -+++ b/python-s3transfer.spec -@@ -1,4 +1,4 @@ --%define anolis_release 3 -+%define anolis_release 4 - - %global srcname s3transfer - %global _description \ -@@ -65,5 +65,8 @@ Doc files for python3-%{srcname} - - %changelog -+* Tue Jul 28 2026 penglai-agent - 0.8.1-4 -+- Rebuild with python-urllib3 >= 1.26.19-3 to fix CVE-2025-66418 -+ - * Wed Jun 24 2026 mgb01105731 - 0.8.1-3 - - Rebuild with python-urllib3-1.26.19-5 to fix CVE-2025-66471 diff --git a/python-s3transfer.spec b/python-s3transfer.spec index 8436942..c263ba3 100644 --- a/python-s3transfer.spec +++ b/python-s3transfer.spec @@ -12,8 +12,6 @@ Summary: Amazon S3 Transfer Manager License: Apache-2.0 URL: https://pypi.org/project/s3transfer/ Source0: %{pypi_source} -# CVE-2025-66418 -Patch0001: CVE-2025-66418.patch BuildArch: noarch @@ -67,8 +65,7 @@ Doc files for python3-%{srcname} %changelog * Tue Jul 28 2026 PengLAI Code - 0.8.1-4 -- Fix CVE-2025-66418 -- Patch generated by PengLAI Code Agent +- Rebuild with python-urllib3 >= 1.26.19-3 to fix CVE-2025-66418 * Wed Jun 24 2026 mgb01105731 - 0.8.1-3 - Rebuild with python-urllib3-1.26.19-5 to fix CVE-2025-66471 -- Gitee