[AutoPR- Security] Patch python-requests for CVE-2026-25645 [MEDIUM] (#16352)

Author: azurelinux-security

SPECS/python-requests/CVE-2026-25645.patch

@@ -0,0 +1,39 @@
+From 4478bc8cfa1c40dbf62b9744c52a25b7709e6406 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Mon, 30 Mar 2026 11:20:24 +0000
+Subject: [PATCH] Backport: Use mkstemp to extract zip members to temp file to
+ avoid path issues and race conditions
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7.patch
+---
+ requests/utils.py | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/requests/utils.py b/requests/utils.py
+index cb9d01d..1bf4d1f 100644
+--- a/requests/utils.py
++++ b/requests/utils.py
+@@ -264,12 +264,13 @@ def extract_zipped_paths(path):
+         return path
+ 
+     # we have a valid zip archive and a valid member of that archive
+-    tmp = tempfile.gettempdir()
+-    extracted_path = os.path.join(tmp, member.split('/')[-1])
+-    if not os.path.exists(extracted_path):
+-        # use read + write to avoid the creating nested folders, we only want the file, avoids mkdir racing condition
+-        with atomic_open(extracted_path) as file_handler:
+-            file_handler.write(zip_file.read(member))
++    suffix = os.path.splitext(member.split("/")[-1])[-1]
++    fd, extracted_path = tempfile.mkstemp(suffix=suffix)
++    try:
++        os.write(fd, zip_file.read(member))
++    finally:
++        os.close(fd)
++
+     return extracted_path
+ 
+ 
+-- 
+2.45.4
+

SPECS/python-requests/python-requests.spec

@@ -1,7 +1,7 @@
 Summary:        Awesome Python HTTP Library That's Actually Usable
 Name:           python-requests
 Version:        2.27.1
-Release:        8%{?dist}
+Release:        9%{?dist}
 License:        ASL 2.0
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -11,6 +11,7 @@ Source0:        https://github.com/requests/requests/archive/v%{version}/request
 Patch0:         CVE-2023-32681.patch
 Patch1:         CVE-2024-35195.patch
 Patch2:         CVE-2024-47081.patch
+Patch3:         CVE-2026-25645.patch
 BuildArch:      noarch
 
 %description
@@ -74,6 +75,9 @@ LANG=en_US.UTF-8 tox -e py%{python3_version_nodots}
 %{python3_sitelib}/*
 
 %changelog
+* Mon Mar 30 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.27.1-9
+- Patch for CVE-2026-25645
+
 * Tue Jun 17 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 2.27.1-8
 - Add patch for CVE-2024-47081