From f532ba5ac35b689607de1d7a1e3144ac411ad5203f02c27200d50647db0dea8a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Chv=C3=A1tal?= Date: Fri, 19 Jul 2019 11:20:26 +0000 Subject: [PATCH 1/2] - Skip test_urllib2_localnet that randomly fails in OBS - Skip test_urllib2_localnet that randomly fails in OBS OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python?expand=0&rev=246 --- python-base.changes | 5 +++++ python-base.spec | 3 ++- python.changes | 5 +++++ python.spec | 2 +- 4 files changed, 13 insertions(+), 2 deletions(-) diff --git a/python-base.changes b/python-base.changes index 3e7bc68..f54ec95 100644 --- a/python-base.changes +++ b/python-base.changes @@ -1,3 +1,8 @@ +------------------------------------------------------------------- +Fri Jul 19 11:19:42 UTC 2019 - Tomáš Chvátal + +- Skip test_urllib2_localnet that randomly fails in OBS + ------------------------------------------------------------------- Wed May 29 08:58:16 UTC 2019 - Martin Liška diff --git a/python-base.spec b/python-base.spec index b8d43e2..1d20c25 100644 --- a/python-base.spec +++ b/python-base.spec @@ -235,7 +235,8 @@ LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH \ %ifnarch hppa # test_file(2k) fails in autobuild env - "stdin.seek(-1)" wrongly succeeds. probably an issue with autobuild's stdin # test_urllib2 relies on being able to resolve local address, which is notoriously impossible in autobuild -EXCLUDE="test_urllib2 test_file test_file2k" +# test_urllib2_localnet randomly fails out +EXCLUDE="test_urllib2 test_urllib2_localnet test_file test_file2k" # test_nis and test_threading are AWFULLY slow. EXCLUDE="$EXCLUDE test_nis test_threading" # test_gdb fails if gdb with (different) python support is part of the buildsystem diff --git a/python.changes b/python.changes index be80caf..9ba2d5f 100644 --- a/python.changes +++ b/python.changes @@ -1,3 +1,8 @@ +------------------------------------------------------------------- +Fri Jul 19 11:19:42 UTC 2019 - Tomáš Chvátal + +- Skip test_urllib2_localnet that randomly fails in OBS + ------------------------------------------------------------------- Wed May 29 08:58:16 UTC 2019 - Martin Liška diff --git a/python.spec b/python.spec index 9c0198e..41b0344 100644 --- a/python.spec +++ b/python.spec @@ -284,7 +284,7 @@ LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH \ if test $(ulimit -v) = unlimited || test $(ulimit -v) -gt 10000000; then ulimit -v 10000000 || : fi -LIST="test_urllib test_ssl test_hashlib test_hmac test_urllib2_localnet test_unicodedata test_tarfile test_sqlite test_tcl test_dbm test_anydbm test_dumbdbm test_gdbm test_whichdb test_tk test_ttk_textonly test_bsddb test_bsddb3 test_readline" +LIST="test_urllib test_ssl test_hashlib test_hmac test_unicodedata test_tarfile test_sqlite test_tcl test_dbm test_anydbm test_dumbdbm test_gdbm test_whichdb test_tk test_ttk_textonly test_bsddb test_bsddb3 test_readline" make test TESTOPTS="$LIST" TESTPYTHONOPTS="-R" %endif From 4a730b55c60d893456596c03eac4d3f5a086b45642591eb53dfa17edc4e9e642 Mon Sep 17 00:00:00 2001 From: Matej Cepl Date: Fri, 19 Jul 2019 12:54:06 +0000 Subject: [PATCH 2/2] Accepting request 717086 from home:mcepl:branches:devel:languages:python:Factory Add CVE patch. OBS-URL: https://build.opensuse.org/request/show/717086 OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python?expand=0&rev=247 --- CVE-2018-20852-cookie-domain-check.patch | 103 +++++++++++++++++++++++ python-base.changes | 9 ++ python-base.spec | 4 + python-doc.spec | 4 + python.spec | 4 + 5 files changed, 124 insertions(+) create mode 100644 CVE-2018-20852-cookie-domain-check.patch diff --git a/CVE-2018-20852-cookie-domain-check.patch b/CVE-2018-20852-cookie-domain-check.patch new file mode 100644 index 0000000..0f9095b --- /dev/null +++ b/CVE-2018-20852-cookie-domain-check.patch @@ -0,0 +1,103 @@ +From def9e64d6aee945c19d9dab896fa91e915d96843 Mon Sep 17 00:00:00 2001 +From: Karthikeyan Singaravelan +Date: Mon, 20 May 2019 00:33:52 +0530 +Subject: [PATCH] Prefix dot in domain for proper subdomain validation + +--- + Lib/cookielib.py | 13 +++++++++++-- + Lib/test/test_cookielib.py | 30 ++++++++++++++++++++++++++++++ + 2 files changed, 41 insertions(+), 2 deletions(-) + +diff --git a/Lib/cookielib.py b/Lib/cookielib.py +index 2dd7c48728e0..0b471a42f296 100644 +--- a/Lib/cookielib.py ++++ b/Lib/cookielib.py +@@ -1139,6 +1139,11 @@ def return_ok_domain(self, cookie, request): + req_host, erhn = eff_request_host(request) + domain = cookie.domain + ++ if domain and not domain.startswith("."): ++ dotdomain = "." + domain ++ else: ++ dotdomain = domain ++ + # strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't + if (cookie.version == 0 and + (self.strict_ns_domain & self.DomainStrictNonDomain) and +@@ -1151,7 +1156,7 @@ def return_ok_domain(self, cookie, request): + _debug(" effective request-host name %s does not domain-match " + "RFC 2965 cookie domain %s", erhn, domain) + return False +- if cookie.version == 0 and not ("."+erhn).endswith(domain): ++ if cookie.version == 0 and not ("."+erhn).endswith(dotdomain): + _debug(" request-host %s does not match Netscape cookie domain " + "%s", req_host, domain) + return False +@@ -1165,7 +1170,11 @@ def domain_return_ok(self, domain, request): + req_host = "."+req_host + if not erhn.startswith("."): + erhn = "."+erhn +- if not (req_host.endswith(domain) or erhn.endswith(domain)): ++ if domain and not domain.startswith("."): ++ dotdomain = "." + domain ++ else: ++ dotdomain = domain ++ if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)): + #_debug(" request domain %s does not match cookie domain %s", + # req_host, domain) + return False +diff --git a/Lib/test/test_cookielib.py b/Lib/test/test_cookielib.py +index f2dd9727d137..7f7ff614d61d 100644 +--- a/Lib/test/test_cookielib.py ++++ b/Lib/test/test_cookielib.py +@@ -368,6 +368,7 @@ def test_domain_return_ok(self): + ("http://foo.bar.com/", ".foo.bar.com", True), + ("http://foo.bar.com/", "foo.bar.com", True), + ("http://foo.bar.com/", ".bar.com", True), ++ ("http://foo.bar.com/", "bar.com", True), + ("http://foo.bar.com/", "com", True), + ("http://foo.com/", "rhubarb.foo.com", False), + ("http://foo.com/", ".foo.com", True), +@@ -378,6 +379,8 @@ def test_domain_return_ok(self): + ("http://foo/", "foo", True), + ("http://foo/", "foo.local", True), + ("http://foo/", ".local", True), ++ ("http://barfoo.com", ".foo.com", False), ++ ("http://barfoo.com", "foo.com", False), + ]: + request = urllib2.Request(url) + r = pol.domain_return_ok(domain, request) +@@ -938,6 +941,33 @@ def test_domain_block(self): + c.add_cookie_header(req) + self.assertFalse(req.has_header("Cookie")) + ++ c.clear() ++ ++ pol.set_blocked_domains([]) ++ req = Request("http://acme.com/") ++ res = FakeResponse(headers, "http://acme.com/") ++ cookies = c.make_cookies(res, req) ++ c.extract_cookies(res, req) ++ self.assertEqual(len(c), 1) ++ ++ req = Request("http://acme.com/") ++ c.add_cookie_header(req) ++ self.assertTrue(req.has_header("Cookie")) ++ ++ req = Request("http://badacme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(pol.return_ok(cookies[0], req)) ++ self.assertFalse(req.has_header("Cookie")) ++ ++ p = pol.set_blocked_domains(["acme.com"]) ++ req = Request("http://acme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(req.has_header("Cookie")) ++ ++ req = Request("http://badacme.com/") ++ c.add_cookie_header(req) ++ self.assertFalse(req.has_header("Cookie")) ++ + def test_secure(self): + from cookielib import CookieJar, DefaultCookiePolicy + diff --git a/python-base.changes b/python-base.changes index f54ec95..abf088e 100644 --- a/python-base.changes +++ b/python-base.changes @@ -1,3 +1,12 @@ +------------------------------------------------------------------- +Fri Jul 19 13:28:16 CEST 2019 - Matej Cepl + +- boo#1141853 (CVE-2018-20852) add + CVE-2018-20852-cookie-domain-check.patch fixing + http.cookiejar.DefaultPolicy.domain_return_ok which did not + correctly validate the domain: it could be tricked into sending + cookies to the wrong server. + ------------------------------------------------------------------- Fri Jul 19 11:19:42 UTC 2019 - Tomáš Chvátal diff --git a/python-base.spec b/python-base.spec index 1d20c25..eb86062 100644 --- a/python-base.spec +++ b/python-base.spec @@ -81,6 +81,9 @@ Patch52: CVE-2019-9948-avoid_local-file.patch # PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 mcepl@suse.com # bpo#30458: Disallow control chars in http URLs. Patch53: CVE-2019-9947-no-ctrl-char-http.patch +# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com +# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain +Patch54: CVE-2018-20852-cookie-domain-check.patch # COMMON-PATCH-END %define python_version %(echo %{tarversion} | head -c 3) BuildRequires: automake @@ -195,6 +198,7 @@ other applications. %patch51 -p1 %patch52 -p1 %patch53 -p1 +%patch54 -p1 # drop Autoconf version requirement sed -i 's/^version_required/dnl version_required/' configure.ac diff --git a/python-doc.spec b/python-doc.spec index 0735385..f18c2f4 100644 --- a/python-doc.spec +++ b/python-doc.spec @@ -81,6 +81,9 @@ Patch52: CVE-2019-9948-avoid_local-file.patch # PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 mcepl@suse.com # bpo#30458: Disallow control chars in http URLs. Patch53: CVE-2019-9947-no-ctrl-char-http.patch +# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com +# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain +Patch54: CVE-2018-20852-cookie-domain-check.patch # COMMON-PATCH-END Provides: pyth_doc Provides: pyth_ps @@ -141,6 +144,7 @@ Python, and Macintosh Module Reference in PDF format. %patch51 -p1 %patch52 -p1 %patch53 -p1 +%patch54 -p1 # drop Autoconf version requirement sed -i 's/^version_required/dnl version_required/' configure.ac diff --git a/python.spec b/python.spec index 41b0344..f8372cc 100644 --- a/python.spec +++ b/python.spec @@ -86,6 +86,9 @@ Patch52: CVE-2019-9948-avoid_local-file.patch # PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 mcepl@suse.com # bpo#30458: Disallow control chars in http URLs. Patch53: CVE-2019-9947-no-ctrl-char-http.patch +# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com +# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain +Patch54: CVE-2018-20852-cookie-domain-check.patch # COMMON-PATCH-END BuildRequires: automake BuildRequires: db-devel @@ -247,6 +250,7 @@ that rely on earlier non-verification behavior. %patch51 -p1 %patch52 -p1 %patch53 -p1 +%patch54 -p1 # drop Autoconf version requirement sed -i 's/^version_required/dnl version_required/' configure.ac