Release date:
2026-09-11 10:27:33 UTC
Description:
* SECURITY UPDATE: MANIFEST.in exclusion bypass via Unicode normalization
- debian/patches/CVE-2026-59890.patch: normalize both the MANIFEST.in
pattern and the walked path to NFC before matching, via a new
unicode_utils.normalize() helper and a _NormalizedMatcher wrapper in
translate_pattern(), so an exclude/global-exclude/recursive-exclude/
prune rule can no longer be bypassed by an NFC/NFD mismatch and leak
the excluded file into the source distribution (CWE-176/CWE-697).
- CVE-2026-59890
Updated packages:
-
alt-python313-setuptools_69.0.2-4_all.deb
sha:962585b2d66aff8b6722dd03a71969598c11098d
-
alt-python313-setuptools-wheel_69.0.2-4_all.deb
sha:5ca5b26b09c41fc3ecdf530c7d5d0191cc725197
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
