d2b2dc49ab
Fixes the following vulnerability:
- CVE-2025-68146
A Time-of-Check-Time-of-Use (TOCTOU) race condition allows local
attackers to corrupt or truncate arbitrary user files through symlink
attacks.
For more informations, see:
- https://nvd.nist.gov/vuln/detail/CVE-2025-68146
- 18a9988008
(cherry picked from commit d9c1379d1f7651951d00ce59b588d74aad049573)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
19 lines
726 B
Makefile
19 lines
726 B
Makefile
################################################################################
|
|
#
|
|
# python-filelock
|
|
#
|
|
################################################################################
|
|
|
|
PYTHON_FILELOCK_VERSION = 3.17.0
|
|
PYTHON_FILELOCK_SOURCE = filelock-$(PYTHON_FILELOCK_VERSION).tar.gz
|
|
PYTHON_FILELOCK_SITE = https://files.pythonhosted.org/packages/dc/9c/0b15fb47b464e1b663b1acd1253a062aa5feecb07d4e597daea542ebd2b5
|
|
PYTHON_FILELOCK_SETUP_TYPE = hatch
|
|
PYTHON_FILELOCK_LICENSE = Public Domain
|
|
PYTHON_FILELOCK_LICENSE_FILES = LICENSE
|
|
PYTHON_FILELOCK_DEPENDENCIES = host-python-hatch-vcs
|
|
|
|
# 0001-Fix-TOCTOU-symlink-vulnerability-in-lock-file-creation.patch
|
|
PYTHON_FILELOCK_IGNORE_CVES += CVE-2025-68146
|
|
|
|
$(eval $(python-package))
|