[CLSA-2026:1788351866] Fix CVE(s): CVE-2026-59890

Type:

security

Severity:

Moderate

Release date:

2026-09-02 12:24:37 UTC

Description:

   * SECURITY UPDATE: sdist could include files excluded by MANIFEST.in
     - debian/patches/CVE-2026-59890.patch: normalize the Unicode form when
       matching MANIFEST.in patterns, backport of pypa/setuptools
       dd9f436a36486b4cb8a4c70a2321548b0be09b8f (GHSA-h35f-9h28-mq5c).
       FileList compiled each exclude/global-exclude/recursive-exclude/prune
       glob to a regex and matched it byte-for-byte against the on-disk file
       name, so a rule authored in NFC did not match a name stored in NFD and
       the intended exclusion silently failed, packing the file into the sdist.
     - CVE-2026-59890

CVEs fixed:

CVE-2026-59890

Updated packages:

alt-python27-setuptools_36.3.0-10_all.deb
sha:0e1cb5e7733ea0beef0a70b5771987932d1a00e2

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.