Accepting request 717086 from home:mcepl:branches:devel:languages:python:Factory
Add CVE patch. OBS-URL: https://build.opensuse.org/request/show/717086 OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python?expand=0&rev=247
This commit is contained in:
Git OBS Bridge
parent
f532ba5ac3
commit
4a730b55c6
103
CVE-2018-20852-cookie-domain-check.patch
Normal file
103
CVE-2018-20852-cookie-domain-check.patch
Normal file
@ -0,0 +1,103 @@
|
||||
From def9e64d6aee945c19d9dab896fa91e915d96843 Mon Sep 17 00:00:00 2001
|
||||
From: Karthikeyan Singaravelan <tir.karthi@gmail.com>
|
||||
Date: Mon, 20 May 2019 00:33:52 +0530
|
||||
Subject: [PATCH] Prefix dot in domain for proper subdomain validation
|
||||
|
||||
---
|
||||
Lib/cookielib.py | 13 +++++++++++--
|
||||
Lib/test/test_cookielib.py | 30 ++++++++++++++++++++++++++++++
|
||||
2 files changed, 41 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/Lib/cookielib.py b/Lib/cookielib.py
|
||||
index 2dd7c48728e0..0b471a42f296 100644
|
||||
--- a/Lib/cookielib.py
|
||||
+++ b/Lib/cookielib.py
|
||||
@@ -1139,6 +1139,11 @@ def return_ok_domain(self, cookie, request):
|
||||
req_host, erhn = eff_request_host(request)
|
||||
domain = cookie.domain
|
||||
|
||||
+ if domain and not domain.startswith("."):
|
||||
+ dotdomain = "." + domain
|
||||
+ else:
|
||||
+ dotdomain = domain
|
||||
+
|
||||
# strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't
|
||||
if (cookie.version == 0 and
|
||||
(self.strict_ns_domain & self.DomainStrictNonDomain) and
|
||||
@@ -1151,7 +1156,7 @@ def return_ok_domain(self, cookie, request):
|
||||
_debug(" effective request-host name %s does not domain-match "
|
||||
"RFC 2965 cookie domain %s", erhn, domain)
|
||||
return False
|
||||
- if cookie.version == 0 and not ("."+erhn).endswith(domain):
|
||||
+ if cookie.version == 0 and not ("."+erhn).endswith(dotdomain):
|
||||
_debug(" request-host %s does not match Netscape cookie domain "
|
||||
"%s", req_host, domain)
|
||||
return False
|
||||
@@ -1165,7 +1170,11 @@ def domain_return_ok(self, domain, request):
|
||||
req_host = "."+req_host
|
||||
if not erhn.startswith("."):
|
||||
erhn = "."+erhn
|
||||
- if not (req_host.endswith(domain) or erhn.endswith(domain)):
|
||||
+ if domain and not domain.startswith("."):
|
||||
+ dotdomain = "." + domain
|
||||
+ else:
|
||||
+ dotdomain = domain
|
||||
+ if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)):
|
||||
#_debug(" request domain %s does not match cookie domain %s",
|
||||
# req_host, domain)
|
||||
return False
|
||||
diff --git a/Lib/test/test_cookielib.py b/Lib/test/test_cookielib.py
|
||||
index f2dd9727d137..7f7ff614d61d 100644
|
||||
--- a/Lib/test/test_cookielib.py
|
||||
+++ b/Lib/test/test_cookielib.py
|
||||
@@ -368,6 +368,7 @@ def test_domain_return_ok(self):
|
||||
("http://foo.bar.com/", ".foo.bar.com", True),
|
||||
("http://foo.bar.com/", "foo.bar.com", True),
|
||||
("http://foo.bar.com/", ".bar.com", True),
|
||||
+ ("http://foo.bar.com/", "bar.com", True),
|
||||
("http://foo.bar.com/", "com", True),
|
||||
("http://foo.com/", "rhubarb.foo.com", False),
|
||||
("http://foo.com/", ".foo.com", True),
|
||||
@@ -378,6 +379,8 @@ def test_domain_return_ok(self):
|
||||
("http://foo/", "foo", True),
|
||||
("http://foo/", "foo.local", True),
|
||||
("http://foo/", ".local", True),
|
||||
+ ("http://barfoo.com", ".foo.com", False),
|
||||
+ ("http://barfoo.com", "foo.com", False),
|
||||
]:
|
||||
request = urllib2.Request(url)
|
||||
r = pol.domain_return_ok(domain, request)
|
||||
@@ -938,6 +941,33 @@ def test_domain_block(self):
|
||||
c.add_cookie_header(req)
|
||||
self.assertFalse(req.has_header("Cookie"))
|
||||
|
||||
+ c.clear()
|
||||
+
|
||||
+ pol.set_blocked_domains([])
|
||||
+ req = Request("http://acme.com/")
|
||||
+ res = FakeResponse(headers, "http://acme.com/")
|
||||
+ cookies = c.make_cookies(res, req)
|
||||
+ c.extract_cookies(res, req)
|
||||
+ self.assertEqual(len(c), 1)
|
||||
+
|
||||
+ req = Request("http://acme.com/")
|
||||
+ c.add_cookie_header(req)
|
||||
+ self.assertTrue(req.has_header("Cookie"))
|
||||
+
|
||||
+ req = Request("http://badacme.com/")
|
||||
+ c.add_cookie_header(req)
|
||||
+ self.assertFalse(pol.return_ok(cookies[0], req))
|
||||
+ self.assertFalse(req.has_header("Cookie"))
|
||||
+
|
||||
+ p = pol.set_blocked_domains(["acme.com"])
|
||||
+ req = Request("http://acme.com/")
|
||||
+ c.add_cookie_header(req)
|
||||
+ self.assertFalse(req.has_header("Cookie"))
|
||||
+
|
||||
+ req = Request("http://badacme.com/")
|
||||
+ c.add_cookie_header(req)
|
||||
+ self.assertFalse(req.has_header("Cookie"))
|
||||
+
|
||||
def test_secure(self):
|
||||
from cookielib import CookieJar, DefaultCookiePolicy
|
||||
|
||||
@ -1,3 +1,12 @@
|
||||
-------------------------------------------------------------------
|
||||
Fri Jul 19 13:28:16 CEST 2019 - Matej Cepl <mcepl@suse.com>
|
||||
|
||||
- boo#1141853 (CVE-2018-20852) add
|
||||
CVE-2018-20852-cookie-domain-check.patch fixing
|
||||
http.cookiejar.DefaultPolicy.domain_return_ok which did not
|
||||
correctly validate the domain: it could be tricked into sending
|
||||
cookies to the wrong server.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Jul 19 11:19:42 UTC 2019 - Tomáš Chvátal <tchvatal@suse.com>
|
||||
|
||||
|
||||
@ -81,6 +81,9 @@ Patch52: CVE-2019-9948-avoid_local-file.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 mcepl@suse.com
|
||||
# bpo#30458: Disallow control chars in http URLs.
|
||||
Patch53: CVE-2019-9947-no-ctrl-char-http.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com
|
||||
# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain
|
||||
Patch54: CVE-2018-20852-cookie-domain-check.patch
|
||||
# COMMON-PATCH-END
|
||||
%define python_version %(echo %{tarversion} | head -c 3)
|
||||
BuildRequires: automake
|
||||
@ -195,6 +198,7 @@ other applications.
|
||||
%patch51 -p1
|
||||
%patch52 -p1
|
||||
%patch53 -p1
|
||||
%patch54 -p1
|
||||
|
||||
# drop Autoconf version requirement
|
||||
sed -i 's/^version_required/dnl version_required/' configure.ac
|
||||
|
||||
@ -81,6 +81,9 @@ Patch52: CVE-2019-9948-avoid_local-file.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 mcepl@suse.com
|
||||
# bpo#30458: Disallow control chars in http URLs.
|
||||
Patch53: CVE-2019-9947-no-ctrl-char-http.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com
|
||||
# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain
|
||||
Patch54: CVE-2018-20852-cookie-domain-check.patch
|
||||
# COMMON-PATCH-END
|
||||
Provides: pyth_doc
|
||||
Provides: pyth_ps
|
||||
@ -141,6 +144,7 @@ Python, and Macintosh Module Reference in PDF format.
|
||||
%patch51 -p1
|
||||
%patch52 -p1
|
||||
%patch53 -p1
|
||||
%patch54 -p1
|
||||
|
||||
# drop Autoconf version requirement
|
||||
sed -i 's/^version_required/dnl version_required/' configure.ac
|
||||
|
||||
@ -86,6 +86,9 @@ Patch52: CVE-2019-9948-avoid_local-file.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 mcepl@suse.com
|
||||
# bpo#30458: Disallow control chars in http URLs.
|
||||
Patch53: CVE-2019-9947-no-ctrl-char-http.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com
|
||||
# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain
|
||||
Patch54: CVE-2018-20852-cookie-domain-check.patch
|
||||
# COMMON-PATCH-END
|
||||
BuildRequires: automake
|
||||
BuildRequires: db-devel
|
||||
@ -247,6 +250,7 @@ that rely on earlier non-verification behavior.
|
||||
%patch51 -p1
|
||||
%patch52 -p1
|
||||
%patch53 -p1
|
||||
%patch54 -p1
|
||||
|
||||
# drop Autoconf version requirement
|
||||
sed -i 's/^version_required/dnl version_required/' configure.ac
|
||||
|
||||
Loading…
Reference in New Issue
Block a user