Skip to content

Matched advisory candidates (shard 28) - #1614

Open
BrewTestBot wants to merge 1 commit into
mainfrom
matched-advisories-28
Open

Matched advisory candidates (shard 28)#1614
BrewTestBot wants to merge 1 commit into
mainfrom
matched-advisories-28

Conversation

@BrewTestBot

@BrewTestBot BrewTestBot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Automated candidates via brew advisory-match --formula-list (planned workers) --new-history, sharded by formula (SHA-256 bucket 28). See CONTRIBUTING.md for the review checklist.

Partial daily run: successful buckets only; the older standing PR may overlap.

Run and review artifacts: https://github.com/Homebrew/advisory-database/actions/runs/40657111712

@coderabbitai

coderabbitai Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Review in Change Stack →

📝 Summary

Summary by CodeRabbit

  • New Features
    • Added Homebrew security advisories for newly reported vulnerabilities affecting packages including aqtinstall, bbot, biber and pytorch. Records include affected version ranges, severity information and supporting references.
    • Added coverage for issues involving file locking, DNS message processing, CSV handling and package installation.
  • Bug Fixes
    • Updated existing advisory records with corrected affected component versions and supporting evidence.
    • Added links to relevant advisory databases and package pages in existing records.

The pull request adds security advisories for Homebrew packages and updates existing aqtinstall and bbot advisory records. Updates include affected resource versions, upstream evidence, timestamps, and references.

Changes: Homebrew advisory records

Layer / File(s) Summary
Update existing advisory records
advisories/BREW-aqtinstall-*.json, advisories/BREW-bbot-*.json		 Existing records update affected resource versions, matching upstream evidence, modification timestamps, or references.
Add aqtinstall and bbot advisories
advisories/BREW-aqtinstall-CVE-2026-111497.json, advisories/BREW-bbot-CVE-2026-112940.json, advisories/BREW-bbot-CVE-2026-114605.json		 Adds records for issues involving Brotli, filelock, and dnspython.
Add biber advisories
advisories/BREW-biber-*.json		 Adds nine advisories concerning Text::CSV_XS and Mozilla::CA.
Add pytorch advisories
advisories/BREW-pytorch-*.json		 Adds advisories for filelock local file operations and a setuptools Windows path escape.

Priority: Normal

Merge Risk: Low · up to d87ff

The advisory can mislead macOS and Linux users and renders its proof of concept incorrectly. These issues warrant correction but have bounded impact.

Pre-merge checks: Passed 4
Check name Status Explanation
Title check Passed The title "Matched advisory candidates (shard 28)" names the main change: automated advisory candidates from a matching run for one shard. The changeset adds and updates Homebrew advisory JSON files, …
Description check Passed The description states that the candidates come from an automated run of brew advisory-match, sharded by formula (bucket 28), and links to the review checklist and run artifacts. It explains the origi…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Title check

Explanation

The title "Matched advisory candidates (shard 28)" names the main change: automated advisory candidates from a matching run for one shard. The changeset adds and updates Homebrew advisory JSON files, so the title is related. It does not name the ecosystems or advisories, but it refers to the real aspect of the change.

Full details: Description check

Explanation

The description states that the candidates come from an automated run of brew advisory-match, sharded by formula (bucket 28), and links to the review checklist and run artifacts. It explains the origin of the advisory files, so it relates to the changeset.

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@BrewTestBot
BrewTestBot force-pushed the matched-advisories-28 branch 3 times, most recently from 3aacea4 to f62a803 Compare October 27, 2026 11:18
coderabbitai[bot]
coderabbitai Bot reviewed Oct 27, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between 49b6e3a and f62a803.

Files selected for processing: 36
  • advisories/BREW-aqtinstall-CVE-2025-6176.json
  • advisories/BREW-aqtinstall-CVE-2026-111497.json
  • advisories/BREW-aqtinstall-CVE-2026-23879.json
  • advisories/BREW-aqtinstall-CVE-2026-49476.json
  • advisories/BREW-aqtinstall-CVE-2026-49477.json
  • advisories/BREW-aqtinstall-CVE-2026-55195.json
  • advisories/BREW-aqtinstall-CVE-2026-55206.json
  • advisories/BREW-aqtinstall-CVE-2026-85999.json
  • advisories/BREW-aqtinstall-CVE-2026-86000.json
  • advisories/BREW-bbot-CVE-2023-4237.json
  • advisories/BREW-bbot-CVE-2023-52323.json
  • advisories/BREW-bbot-CVE-2023-5764.json
  • advisories/BREW-bbot-CVE-2024-0690.json
  • advisories/BREW-bbot-CVE-2024-11079.json
  • advisories/BREW-bbot-CVE-2024-8775.json
  • advisories/BREW-bbot-CVE-2024-9902.json
  • advisories/BREW-bbot-CVE-2025-67221.json
  • advisories/BREW-bbot-CVE-2025-68146.json
  • advisories/BREW-bbot-CVE-2026-112940.json
  • advisories/BREW-bbot-CVE-2026-11332.json
  • advisories/BREW-bbot-CVE-2026-22701.json
  • advisories/BREW-bbot-CVE-2026-49476.json
  • advisories/BREW-bbot-CVE-2026-49477.json
  • advisories/BREW-bbot-CVE-2026-85999.json
  • advisories/BREW-bbot-CVE-2026-86000.json
  • advisories/BREW-biber-CVE-2026-110752.json
  • advisories/BREW-biber-CVE-2026-110753.json
  • advisories/BREW-biber-CVE-2026-110754.json
  • advisories/BREW-biber-CVE-2026-110755.json
  • advisories/BREW-biber-CVE-2026-110756.json
  • advisories/BREW-biber-CVE-2026-110757.json
  • advisories/BREW-biber-CVE-2026-110758.json
  • advisories/BREW-biber-CVE-2026-110759.json
  • advisories/BREW-biber-CVE-2026-113812.json
  • advisories/BREW-pytorch-CVE-2026-112940.json
  • advisories/BREW-pytorch-GHSA-xmj3-9gf7-h52w.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Comment thread advisories/BREW-pytorch-GHSA-xmj3-9gf7-h52w.json
Comment on lines +16 to +25
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
}
]
}
],

@coderabbitai coderabbitai Bot Oct 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Major · Data Integrity & Integration · Quick win

Remove the Windows-only advisory for pytorch.

This range marks Homebrew pytorch as affected from version 2.2.0. The upstream path escape requires Windows path handling, but Homebrew formulae run on macOS or Linux; WSL runs the Linux version. A matching setuptools resource version therefore does not make this vulnerability applicable to the formula. Remove this candidate and add its ID to data/rejected-candidates.txt so the next matching run does not restore it. (github.com)

@BrewTestBot
BrewTestBot force-pushed the matched-advisories-28 branch from f62a803 to 13c1f60 Compare October 27, 2026 21:38
coderabbitai[bot]
coderabbitai Bot reviewed Oct 27, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between f62a803 and 13c1f60.

Files selected for processing: 40
  • advisories/BREW-aqtinstall-CVE-2025-6176.json
  • advisories/BREW-aqtinstall-CVE-2026-111497.json
  • advisories/BREW-aqtinstall-CVE-2026-23879.json
  • advisories/BREW-aqtinstall-CVE-2026-49476.json
  • advisories/BREW-aqtinstall-CVE-2026-49477.json
  • advisories/BREW-aqtinstall-CVE-2026-55195.json
  • advisories/BREW-aqtinstall-CVE-2026-55206.json
  • advisories/BREW-aqtinstall-CVE-2026-85999.json
  • advisories/BREW-aqtinstall-CVE-2026-86000.json
  • advisories/BREW-bbot-CVE-2023-4237.json
  • advisories/BREW-bbot-CVE-2023-52323.json
  • advisories/BREW-bbot-CVE-2023-5764.json
  • advisories/BREW-bbot-CVE-2024-0690.json
  • advisories/BREW-bbot-CVE-2024-11079.json
  • advisories/BREW-bbot-CVE-2024-8775.json
  • advisories/BREW-bbot-CVE-2024-9902.json
  • advisories/BREW-bbot-CVE-2025-10283.json
  • advisories/BREW-bbot-CVE-2025-10284.json
  • advisories/BREW-bbot-CVE-2025-58367.json
  • advisories/BREW-bbot-CVE-2025-67221.json
  • advisories/BREW-bbot-CVE-2025-68146.json
  • advisories/BREW-bbot-CVE-2026-112940.json
  • advisories/BREW-bbot-CVE-2026-11332.json
  • advisories/BREW-bbot-CVE-2026-114605.json
  • advisories/BREW-bbot-CVE-2026-22701.json
  • advisories/BREW-bbot-CVE-2026-49476.json
  • advisories/BREW-bbot-CVE-2026-49477.json
  • advisories/BREW-bbot-CVE-2026-85999.json
  • advisories/BREW-bbot-CVE-2026-86000.json
  • advisories/BREW-biber-CVE-2026-110752.json
  • advisories/BREW-biber-CVE-2026-110753.json
  • advisories/BREW-biber-CVE-2026-110754.json
  • advisories/BREW-biber-CVE-2026-110755.json
  • advisories/BREW-biber-CVE-2026-110756.json
  • advisories/BREW-biber-CVE-2026-110757.json
  • advisories/BREW-biber-CVE-2026-110758.json
  • advisories/BREW-biber-CVE-2026-110759.json
  • advisories/BREW-biber-CVE-2026-113812.json
  • advisories/BREW-pytorch-CVE-2026-112940.json
  • advisories/BREW-pytorch-GHSA-xmj3-9gf7-h52w.json
Files skipped from review as they are similar to previous changes: 22

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Comment thread advisories/BREW-pytorch-GHSA-xmj3-9gf7-h52w.json
]
},
"summary": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description",
"details": "### Summary\n\nOn Windows, attacker-controlled content in a wheel's\n`.dist-info/namespace_packages.txt` can cause setuptools' legacy wheel\ninstallation path to create an `__init__.py` outside the requested\n`destination_eggdir`.\n\nThe attacker can influence the destination path, but not the contents of\nthe created file.\n\n### Details\n\nTested setuptools commit:\n\n`6ead555c5fb29bc57fe6105b1bffc163f56fd558`\n\nRelevant source:\n\n`setuptools/wheel.py`\n\nSHA-256:\n\n`359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd`\n\nThe relevant call path is:\n\n`Wheel(wheel_path).install_as_egg(destination)`\n→ `_install_as_egg`\n→ `_convert_metadata`\n→ `_fix_namespace_packages`\n\nA wheel can provide attacker-controlled content in:\n\n`<distribution>.dist-info/namespace_packages.txt`\n\nThe namespace value is eventually used approximately as:\n\n```python\nmod_dir = os.path.join(destination_eggdir, *mod.split('.'))\nmod_init = os.path.join(mod_dir, '__init__.py')\n\nIf mod is a Windows drive-qualified absolute path containing no dots,\nmod.split('.') preserves it as a single component.\nOn Windows, os.path.join(destination_eggdir, absolute_component) discards\nthe original base directory and resolves to the attacker-supplied absolute\npath.\nThe existing wheel filename and ZIP traversal checks do not validate this\nmetadata value before it is subsequently interpreted as a filesystem path.\n\n```markdown\n### PoC\n\nThe reproduction was performed entirely inside a disposable temporary\ndirectory.\n\nLayout:\n\n```text\nsandbox/\n destination/\n outside/\n input/\n canary.txt\n```\n\nA synthetic wheel was created containing:\n\n`demo_pkg-1.0.dist-info/namespace_packages.txt`\n\nwhose content was the absolute path of:\n\n`sandbox\\outside`\n\nThe real acquired setuptools implementation was then invoked:\n\n```python\nsetuptools.wheel.Wheel(synthetic_wheel).install_as_egg(\n sandbox_destination\n)\n```\n\nThe operation completed without exception.\n\nExpected metadata was created under:\n\n`sandbox\\destination\\EGG-INFO`\n\nbut setuptools also created:\n\n`sandbox\\outside\\__init__.py`\n\nThe file did not exist before execution.\n\nIts contents were:\n\n```python\n__import__('pkg_resources').declare_namespace(__name__)\n```\n\nThe unrelated canary remained byte-identical.\n\nThe sandbox was deleted after recording the evidence.\n```\n\n\n### Impact\n\nA crafted wheel can cause setuptools to create a fixed-content\n`__init__.py` outside the intended installation directory at a\nfilesystem path influenced by the wheel, with the permissions of the\nprocess performing the installation.\n\nThe demonstrated reproduction required the target parent directory to\nalready exist.",

@coderabbitai coderabbitai Bot Oct 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor · Functional Correctness · Quick win

Close the Python code fence before the PoC section.

```markdown does not close the preceding ```python fence. GitHub renders the PoC heading and its content as Python code until the later bare fence. Replace it with a closing ````, then place### PoC` outside the code block.

@BrewTestBot
BrewTestBot force-pushed the matched-advisories-28 branch from 13c1f60 to d87ff6e Compare October 28, 2026 11:03
coderabbitai[bot]
coderabbitai Bot reviewed Oct 28, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between 13c1f60 and d87ff6e.

Files selected for processing: 40
  • advisories/BREW-aqtinstall-CVE-2025-6176.json
  • advisories/BREW-aqtinstall-CVE-2026-111497.json
  • advisories/BREW-aqtinstall-CVE-2026-23879.json
  • advisories/BREW-aqtinstall-CVE-2026-49476.json
  • advisories/BREW-aqtinstall-CVE-2026-49477.json
  • advisories/BREW-aqtinstall-CVE-2026-55195.json
  • advisories/BREW-aqtinstall-CVE-2026-55206.json
  • advisories/BREW-aqtinstall-CVE-2026-85999.json
  • advisories/BREW-aqtinstall-CVE-2026-86000.json
  • advisories/BREW-bbot-CVE-2023-4237.json
  • advisories/BREW-bbot-CVE-2023-52323.json
  • advisories/BREW-bbot-CVE-2023-5764.json
  • advisories/BREW-bbot-CVE-2024-0690.json
  • advisories/BREW-bbot-CVE-2024-11079.json
  • advisories/BREW-bbot-CVE-2024-8775.json
  • advisories/BREW-bbot-CVE-2024-9902.json
  • advisories/BREW-bbot-CVE-2025-10283.json
  • advisories/BREW-bbot-CVE-2025-10284.json
  • advisories/BREW-bbot-CVE-2025-58367.json
  • advisories/BREW-bbot-CVE-2025-67221.json
  • advisories/BREW-bbot-CVE-2025-68146.json
  • advisories/BREW-bbot-CVE-2026-112940.json
  • advisories/BREW-bbot-CVE-2026-11332.json
  • advisories/BREW-bbot-CVE-2026-114605.json
  • advisories/BREW-bbot-CVE-2026-22701.json
  • advisories/BREW-bbot-CVE-2026-49476.json
  • advisories/BREW-bbot-CVE-2026-49477.json
  • advisories/BREW-bbot-CVE-2026-85999.json
  • advisories/BREW-bbot-CVE-2026-86000.json
  • advisories/BREW-biber-CVE-2026-110752.json
  • advisories/BREW-biber-CVE-2026-110753.json
  • advisories/BREW-biber-CVE-2026-110754.json
  • advisories/BREW-biber-CVE-2026-110755.json
  • advisories/BREW-biber-CVE-2026-110756.json
  • advisories/BREW-biber-CVE-2026-110757.json
  • advisories/BREW-biber-CVE-2026-110758.json
  • advisories/BREW-biber-CVE-2026-110759.json
  • advisories/BREW-biber-CVE-2026-113812.json
  • advisories/BREW-pytorch-CVE-2026-112940.json
  • advisories/BREW-pytorch-GHSA-xmj3-9gf7-h52w.json
Files skipped from review as they are similar to previous changes: 24

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Comment thread advisories/BREW-pytorch-GHSA-xmj3-9gf7-h52w.json
}
]
},
"summary": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description",

@coderabbitai coderabbitai Bot Oct 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor · Security & Privacy · Quick win

Describe the POSIX path escape as well.

This summary calls the vulnerability Windows-specific. The setuptools fix also covers absolute POSIX paths: a crafted namespace entry can discard the destination directory on macOS or Linux. Update the summary and details so Homebrew users do not dismiss an applicable advisory. Do not reject this candidate solely because the upstream advisory describes a Windows reproduction. (github.com)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@BrewTestBot