From 4a730b55c60d893456596c03eac4d3f5a086b45642591eb53dfa17edc4e9e642 Mon Sep 17 00:00:00 2001 From: Matej Cepl Date: Fri, 19 Jul 2019 12:54:06 +0000 Subject: [PATCH] Accepting request 717086 from home:mcepl:branches:devel:languages:python:Factory Add CVE patch. OBS-URL: https://build.opensuse.org/request/show/717086 OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python?expand=0&rev=247 --- CVE-2018-20852-cookie-domain-check.patch | 103 +++++++++++++++++++++++ python-base.changes | 9 ++ python-base.spec | 4 + python-doc.spec | 4 + python.spec | 4 + 5 files changed, 124 insertions(+) create mode 100644 CVE-2018-20852-cookie-domain-check.patch diff --git a/CVE-2018-20852-cookie-domain-check.patch b/CVE-2018-20852-cookie-domain-check.patch new file mode 100644 index 0000000..0f9095b --- /dev/null +++ b/CVE-2018-20852-cookie-domain-check.patch @@ -0,0 +1,103 @@ +From def9e64d6aee945c19d9dab896fa91e915d96843 Mon Sep 17 00:00:00 2001 +From: Karthikeyan Singaravelan +Date: Mon, 20 May 2019 00:33:52 +0530 +Subject: [PATCH] Prefix dot in domain for proper subdomain validation + +--- + Lib/cookielib.py | 13 +++++++++++-- + Lib/test/test_cookielib.py | 30 ++++++++++++++++++++++++++++++ + 2 files changed, 41 insertions(+), 2 deletions(-) + +diff --git a/Lib/cookielib.py b/Lib/cookielib.py +index 2dd7c48728e0..0b471a42f296 100644 +--- a/Lib/cookielib.py ++++ b/Lib/cookielib.py +@@ -1139,6 +1139,11 @@ def return_ok_domain(self, cookie, request): + req_host, erhn = eff_request_host(request) + domain = cookie.domain + ++ if domain and not domain.startswith("."): ++ dotdomain = "." + domain ++ else: ++ dotdomain = domain ++ + # strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't + if (cookie.version == 0 and + (self.strict_ns_domain & self.DomainStrictNonDomain) and +@@ -1151,7 +1156,7 @@ def return_ok_domain(self, cookie, request): + _debug(" effective request-host name %s does not domain-match " + "RFC 2965 cookie domain %s", erhn, domain) + return False +- if cookie.version == 0 and not ("."+erhn).endswith(domain): ++ if cookie.version == 0 and not ("."+erhn).endswith(dotdomain): + _debug(" request-host %s does not match Netscape cookie domain " + "%s", req_host, domain) + return False +@@ -1165,7 +1170,11 @@ def domain_return_ok(self, domain, request): + req_host = "."+req_host + if not erhn.startswith("."): + erhn = "."+erhn +- if not (req_host.endswith(domain) or erhn.endswith(domain)): ++ if domain and not domain.startswith("."): ++ dotdomain = "." + domain ++ else: ++ dotdomain = domain ++ if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)): + #_debug(" request domain %s does not match cookie domain %s", + # req_host, domain) + return False +diff --git a/Lib/test/test_cookielib.py b/Lib/test/test_cookielib.py +index f2dd9727d137..7f7ff614d61d 100644 +--- a/Lib/test/test_cookielib.py ++++ b/Lib/test/test_cookielib.py +@@ -368,6 +368,7 @@ def test_domain_return_ok(self): + ("http://foo.bar.com/", ".foo.bar.com", True), + ("http://foo.bar.com/", "foo.bar.com", True), + ("http://foo.bar.com/", ".bar.com", True), ++ ("http://foo.bar.com/", "bar.com", True), + ("http://foo.bar.com/", "com", True), + ("http://foo.com/", "rhubarb.foo.com", False), + ("http://foo.com/", ".foo.com", True), +@@ -378,6 +379,8 @@ def test_domain_return_ok(self): + ("http://foo/", "foo", True), + ("http://foo/", "foo.local", True), + ("http://foo/", ".local", True), ++ ("http://barfoo.com", ".foo.com", False), ++ ("http://barfoo.com", "foo.com", False), + ]: + request = urllib2.Request(url) + r = pol.domain_return_ok(domain, request) +@@ -938,6 +941,33 @@ def test_domain_block(self): + c.add_cookie_header(req) + self.assertFalse(req.has_header("Cookie")) + ++ c.clear() ++ ++ pol.set_blocked_domains([]) ++ req = Request("http://acme.com/") ++ res = FakeResponse(headers, "http://acme.com/") ++ cookies = c.make_cookies(res, req) ++ c.extract_cookies(res, req) ++ self.assertEqual(len(c), 1) ++ ++ req = Request("http://acme.com/") ++ c.add_cookie_header(req) ++ self.assertTrue(req.has_header("Cookie")) ++ ++ req = Request("http://badacme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(pol.return_ok(cookies[0], req)) ++ self.assertFalse(req.has_header("Cookie")) ++ ++ p = pol.set_blocked_domains(["acme.com"]) ++ req = Request("http://acme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(req.has_header("Cookie")) ++ ++ req = Request("http://badacme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(req.has_header("Cookie")) ++ + def test_secure(self): + from cookielib import CookieJar, DefaultCookiePolicy + diff --git a/python-base.changes b/python-base.changes index f54ec95..abf088e 100644 --- a/python-base.changes +++ b/python-base.changes @@ -1,3 +1,12 @@ +------------------------------------------------------------------- +Fri Jul 19 13:28:16 CEST 2019 - Matej Cepl + +- boo#1141853 (CVE-2018-20852) add + CVE-2018-20852-cookie-domain-check.patch fixing + http.cookiejar.DefaultPolicy.domain_return_ok which did not + correctly validate the domain: it could be tricked into sending + cookies to the wrong server. + ------------------------------------------------------------------- Fri Jul 19 11:19:42 UTC 2019 - Tomáš Chvátal diff --git a/python-base.spec b/python-base.spec index 1d20c25..eb86062 100644 --- a/python-base.spec +++ b/python-base.spec @@ -81,6 +81,9 @@ Patch52: CVE-2019-9948-avoid_local-file.patch # PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 mcepl@suse.com # bpo#30458: Disallow control chars in http URLs. Patch53: CVE-2019-9947-no-ctrl-char-http.patch +# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com +# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain +Patch54: CVE-2018-20852-cookie-domain-check.patch # COMMON-PATCH-END %define python_version %(echo %{tarversion} | head -c 3) BuildRequires: automake @@ -195,6 +198,7 @@ other applications. %patch51 -p1 %patch52 -p1 %patch53 -p1 +%patch54 -p1 # drop Autoconf version requirement sed -i 's/^version_required/dnl version_required/' configure.ac diff --git a/python-doc.spec b/python-doc.spec index 0735385..f18c2f4 100644 --- a/python-doc.spec +++ b/python-doc.spec @@ -81,6 +81,9 @@ Patch52: CVE-2019-9948-avoid_local-file.patch # PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 mcepl@suse.com # bpo#30458: Disallow control chars in http URLs. Patch53: CVE-2019-9947-no-ctrl-char-http.patch +# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com +# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain +Patch54: CVE-2018-20852-cookie-domain-check.patch # COMMON-PATCH-END Provides: pyth_doc Provides: pyth_ps @@ -141,6 +144,7 @@ Python, and Macintosh Module Reference in PDF format. %patch51 -p1 %patch52 -p1 %patch53 -p1 +%patch54 -p1 # drop Autoconf version requirement sed -i 's/^version_required/dnl version_required/' configure.ac diff --git a/python.spec b/python.spec index 41b0344..f8372cc 100644 --- a/python.spec +++ b/python.spec @@ -86,6 +86,9 @@ Patch52: CVE-2019-9948-avoid_local-file.patch # PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 mcepl@suse.com # bpo#30458: Disallow control chars in http URLs. Patch53: CVE-2019-9947-no-ctrl-char-http.patch +# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com +# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain +Patch54: CVE-2018-20852-cookie-domain-check.patch # COMMON-PATCH-END BuildRequires: automake BuildRequires: db-devel @@ -247,6 +250,7 @@ that rely on earlier non-verification behavior. %patch51 -p1 %patch52 -p1 %patch53 -p1 +%patch54 -p1 # drop Autoconf version requirement sed -i 's/^version_required/dnl version_required/' configure.ac