2.4.2
📦 poetryView on GitHub →
🐛 3 fixes🔧 1 symbols
Summary
This release addresses several security vulnerabilities, including path traversal issues in file downloads and sdist extraction. It also fixes an artifact installation problem related to lockfiles.
🐛 Bug Fixes
- Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact.
- Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source.
- Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory.