Repository navigation
setuptools 68.0.0.3 (Py3.7): CVE-2026-59890, GHSA-xmj3-9gf7-h52w - #7
Merged
Merged
Conversation
…patterns FileList matched MANIFEST.in patterns against on-disk names byte-for-byte with no Unicode normalization. On macOS APFS/HFS+, a file stored NFD and a pattern authored NFC denote the same file but differ byte-for-byte, so an exclude/global-exclude/recursive-exclude/prune rule could silently fail to drop a non-ASCII-named file, publishing it in the sdist despite the rule. Normalize both the pattern and the candidate path to NFC before matching, via a new unicode_utils.normalize() helper and a _NormalizedMatcher wrapper around the compiled pattern in translate_pattern. Fixes GHSA-h35f-9h28-mq5c. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> (cherry picked from commit dd9f436) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> 68.0.0.x: backported from the ActiveState 82.0.1.x fix (bb32ccb); only the test module's imports conflicted. The fix uses no Python 3.8+ features (re.Pattern exists from 3.7), so 68.0.0.x keeps Python 3.7. The towncrier fragment is dropped; CHANGES.rst gets the entry in the release commit. (cherry picked from commit bb32ccb)
Entries in a wheel's namespace_packages.txt were split on '.' and passed straight to os.path.join, which interprets its arguments as paths. An entry that is absolute, drive-qualified, or UNC therefore discarded the destination egg directory entirely and placed a fixed-content __init__.py at a path chosen by the wheel. The report framed this as Windows-only, but only the drive-letter form is; an absolute POSIX path escapes just as readily. Namespace entries are now validated as dotted module names on every platform, with a containment check as defense in depth. This sink is reachable only through the deprecated setup_requires mechanism when setup() is invoked outside a PEP 517 frontend. The setuptools build backend disables setup_requires installation in every hook, so it does not reach it. Ref GHSA-xmj3-9gf7-h52w. (cherry picked from commit 6d07b8d) 68.0.0.x: hand-applied. 68.0.0 reads namespace_packages.txt in Wheel._fix_namespace_packages() with the same os.path.join(destination_eggdir, *mod.split('.')) sink; that line now calls _resolve_namespace_dir(). The helper and tests are taken unchanged (str.isidentifier() and f-strings are fine on Python 3.7). The towncrier fragment is dropped; CHANGES.rst gets the entry in the release commit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security release of the setuptools 68.0.0 line (the last setuptools that supports Python 3.7): CVE-2026-59890 (GHSA-h35f-9h28-mq5c) and GHSA-xmj3-9gf7-h52w. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ezequielp-activestate
approved these changes
Oct 29, 2026
ezequielp-activestate
left a comment
ezequielp-activestate
left a comment
There was a problem hiding this comment.
Approving. Both fixes are exact ports, and with them every setuptools advisory affecting 68.0.0 is now fixed on this line.
Provenance
- CVE-2026-59890 (d5a5c75): the
egg_info.pyandunicode_utils.pyhunks are identical to the fork's 82.0.1 fix (bb32ccb, upstream dd9f436). On 68.0.0 everytranslate_pattern()caller uses only.match, which_NormalizedMatcherprovides.egg_info.pyalready importsunicode_utils, andunicode_utils.pyalready importsunicodedata. - GHSA-xmj3-9gf7-h52w (ea21ac2): the
wheel.pydiff matches upstream 6d07b8d line for line. - Follow-ups: I walked upstream
mainafter both fixes. Neither has a follow-up inegg_info.py,unicode_utils.pyorwheel.py; the only later change there is a Ruff lint pass. - Advisory coverage: GitHub's advisory database lists six setuptools advisories. The other four were fixed in 65.5.1 (in 68.0.0 already), 68.0.0.1, 68.0.0.2, and 0.7.
Tests (python:3.7, full image)
- Suite:
test_manifest,test_wheel,test_egg_info,test_sdistplus thesetuptools/wheel.pydoctests: base 186 passed, 1 xfailed; this branch 197 passed, 1 xfailed. The full image has a compiler, sotest_wheel_install[extension]passes too. - New tests on the base code: both Unicode tests and the end-to-end
test_install_as_egg_rejects_namespace_escapefail on68.0.0.x. I dropped the_resolve_namespace_dirimport so the module would load, which means the helper's unit tests can't run there.
Release commit: the same three files as 68.0.0.2 (setup.cfg, .bumpversion.cfg, CHANGES.rst).
Merged
icanhasmath
added a commit
that referenced
this pull request
Oct 29, 2026
Release the 68.0.0.3 security fixes (#7) as 68.0.0.post3, following the X.Y.Z.postN scheme the ActiveState forks now use for security releases. Only the version strings change. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
icanhasmath
added a commit
to ActiveState/cpython
that referenced
this pull request
Oct 29, 2026
setuptools 68.0.0.2 still had CVE-2026-59890 (GHSA-h35f-9h28-mq5c, MANIFEST.in exclusion bypass in sdist) and GHSA-xmj3-9gf7-h52w (path escape via namespace_packages.txt during legacy wheel installation). ActiveState setuptools 68.0.0.post3 (ActiveState/setuptools#7, #8) fixes both. The wheel is the release asset, sha256 95bb21258fbcb75b5d7d3740ce296991641e8c78a0de9590747ba2d11aa81c43. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security release setuptools 68.0.0.3 for the Python 3.7 line (68.0.0 is the last setuptools that supports 3.7). It fixes the two advisories still open in 68.0.0.2, so CPython 3.7.17.8 (ActiveState/cpython#117) can bundle a setuptools with no known open advisories.
Already fixed on this line: CVE-2024-6345 (68.0.0.1) and CVE-2025-47273 (68.0.0.2). CVE-2022-40897 was fixed upstream in 65.5.1, before 68.0.0.
Changes
CVE-2026-59890: MANIFEST.in exclusions bypassed through Unicode normalization.
translate_pattern()matched patterns against file names byte for byte.excluderule written in composed (NFC) form, so it could end up in the sdist.GHSA-xmj3-9gf7-h52w: path escape through
namespace_packages.txt.Wheel._fix_namespace_packages()joined each entry onto the destination egg directory as a path.__init__.pyoutside that directory._resolve_namespace_dir()(6d07b8d, released in 84.1.0).setup_requirespath reaches this code.Release commit: version 68.0.0.3 in
setup.cfgand.bumpversion.cfg, plus aCHANGES.rstentry, the same files 68.0.0.2 changed. Both fixes are Python 3.7 compatible.Validation (
python:3.7-slim)Tests:
test_manifest,test_wheel,test_egg_info,test_sdist, plus the doctests insetuptools/wheel.py.test_wheel_install[extension], which needs a C compiler that the slim image doesn't have. It fails the same way on 68.0.0.2.Wheel: built with
setup.py bdist_wheel, the same way as the 68.0.0.2 wheel CPython 3.7.17.8 currently bundles.setuptools/command/egg_info.py,setuptools/unicode_utils.pyandsetuptools/wheel.pychange, plusMETADATAandRECORD. The file list is identical.After merge: tag
v68.0.0.3, publish the release with the wheel attached, then bundle it in CPython 3.7.17.8.