- Add CVE-2023-26112.patch (bsc#1210070)

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-configobj?expand=0&rev=44

CVE-2023-26112.patch

@@ -0,0 +1,24 @@
+From a82ea8fb0338f2bd46cf627c4b763094448e6bd7 Mon Sep 17 00:00:00 2001
+From: cdcadman <mythirty@gmail.com>
+Date: Wed, 17 May 2023 03:57:08 -0700
+Subject: [PATCH] Address CVE-2023-26112 ReDoS
+
+---
+ src/configobj/validate.py         |  2 +-
+ src/tests/test_validate_errors.py | 10 +++++++++-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/validate.py b/validate.py
+index 9267a3f..98d879f 100644
+--- a/src/configobj/validate.py
++++ b/src/configobj/validate.py
+@@ -541,7 +541,7 @@ class Validator(object):
+     """
+ 
+     # this regex does the initial parsing of the checks
+-    _func_re = re.compile(r'(.+?)\((.*)\)', re.DOTALL)
++    _func_re = re.compile(r'([^\(\)]+?)\((.*)\)', re.DOTALL)
+ 
+     # this regex takes apart keyword arguments
+     _key_arg = re.compile(r'^([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.*)$',  re.DOTALL)
+

python-configobj.changes

@@ -4,6 +4,11 @@ Wed Jul  5 07:29:38 UTC 2023 - Matej Cepl <mcepl@suse.com>
 - Add remove_six.patch (gh#DiffSK/configobj#239) removing the
   need for six.
 
+-------------------------------------------------------------------
+Tue Jul  4 10:51:42 UTC 2023 - Markéta Machová <mmachova@suse.com>
+
+- Add CVE-2023-26112.patch (bsc#1210070)
+
 -------------------------------------------------------------------
 Thu May  4 18:56:05 UTC 2023 - Dirk Müller <dmueller@suse.com>
 

python-configobj.spec

@@ -26,9 +26,11 @@ License:        BSD-3-Clause
 Group:          Development/Languages/Python
 URL:            https://github.com/DiffSK/configobj
 Source:         https://files.pythonhosted.org/packages/source/c/configobj/configobj-%{version}.tar.gz
+# PATCH-FIX-UPSTREAM https://github.com/DiffSK/configobj/pull/236 Address CVE-2023-26112 ReDoS
+Patch0:         CVE-2023-26112.patch
 # PATCH-FIX-UPSTREAM remove_six.patch gh#DiffSK/configobj#239 mcepl@suse.com
 # We don't need six anymore
-Patch0:         remove_six.patch
+Patch1:         remove_six.patch
 BuildRequires:  %{python_module pip}
 BuildRequires:  %{python_module wheel}
 BuildRequires:  fdupes