Accepting request 717087 from devel:languages:python:Factory

OBS-URL: https://build.opensuse.org/request/show/717087
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python?expand=0&rev=139

CVE-2018-20852-cookie-domain-check.patch

@@ -0,0 +1,103 @@
+From def9e64d6aee945c19d9dab896fa91e915d96843 Mon Sep 17 00:00:00 2001
+From: Karthikeyan Singaravelan <tir.karthi@gmail.com>
+Date: Mon, 20 May 2019 00:33:52 +0530
+Subject: [PATCH] Prefix dot in domain for proper subdomain validation
+
+---
+ Lib/cookielib.py           | 13 +++++++++++--
+ Lib/test/test_cookielib.py | 30 ++++++++++++++++++++++++++++++
+ 2 files changed, 41 insertions(+), 2 deletions(-)
+
+diff --git a/Lib/cookielib.py b/Lib/cookielib.py
+index 2dd7c48728e0..0b471a42f296 100644
+--- a/Lib/cookielib.py
++++ b/Lib/cookielib.py
+@@ -1139,6 +1139,11 @@ def return_ok_domain(self, cookie, request):
+         req_host, erhn = eff_request_host(request)
+         domain = cookie.domain
+ 
++        if domain and not domain.startswith("."):
++            dotdomain = "." + domain
++        else:
++            dotdomain = domain
++
+         # strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't
+         if (cookie.version == 0 and
+             (self.strict_ns_domain & self.DomainStrictNonDomain) and
+@@ -1151,7 +1156,7 @@ def return_ok_domain(self, cookie, request):
+             _debug("   effective request-host name %s does not domain-match "
+                    "RFC 2965 cookie domain %s", erhn, domain)
+             return False
+-        if cookie.version == 0 and not ("."+erhn).endswith(domain):
++        if cookie.version == 0 and not ("."+erhn).endswith(dotdomain):
+             _debug("   request-host %s does not match Netscape cookie domain "
+                    "%s", req_host, domain)
+             return False
+@@ -1165,7 +1170,11 @@ def domain_return_ok(self, domain, request):
+             req_host = "."+req_host
+         if not erhn.startswith("."):
+             erhn = "."+erhn
+-        if not (req_host.endswith(domain) or erhn.endswith(domain)):
++        if domain and not domain.startswith("."):
++            dotdomain = "." + domain
++        else:
++            dotdomain = domain
++        if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)):
+             #_debug("   request domain %s does not match cookie domain %s",
+             #       req_host, domain)
+             return False
+diff --git a/Lib/test/test_cookielib.py b/Lib/test/test_cookielib.py
+index f2dd9727d137..7f7ff614d61d 100644
+--- a/Lib/test/test_cookielib.py
++++ b/Lib/test/test_cookielib.py
+@@ -368,6 +368,7 @@ def test_domain_return_ok(self):
+             ("http://foo.bar.com/", ".foo.bar.com", True),
+             ("http://foo.bar.com/", "foo.bar.com", True),
+             ("http://foo.bar.com/", ".bar.com", True),
++            ("http://foo.bar.com/", "bar.com", True),
+             ("http://foo.bar.com/", "com", True),
+             ("http://foo.com/", "rhubarb.foo.com", False),
+             ("http://foo.com/", ".foo.com", True),
+@@ -378,6 +379,8 @@ def test_domain_return_ok(self):
+             ("http://foo/", "foo", True),
+             ("http://foo/", "foo.local", True),
+             ("http://foo/", ".local", True),
++            ("http://barfoo.com", ".foo.com", False),
++            ("http://barfoo.com", "foo.com", False),
+             ]:
+             request = urllib2.Request(url)
+             r = pol.domain_return_ok(domain, request)
+@@ -938,6 +941,33 @@ def test_domain_block(self):
+         c.add_cookie_header(req)
+         self.assertFalse(req.has_header("Cookie"))
+ 
++        c.clear()
++
++        pol.set_blocked_domains([])
++        req = Request("http://acme.com/")
++        res = FakeResponse(headers, "http://acme.com/")
++        cookies = c.make_cookies(res, req)
++        c.extract_cookies(res, req)
++        self.assertEqual(len(c), 1)
++
++        req = Request("http://acme.com/")
++        c.add_cookie_header(req)
++        self.assertTrue(req.has_header("Cookie"))
++
++        req = Request("http://badacme.com/")
++        c.add_cookie_header(req)
++        self.assertFalse(pol.return_ok(cookies[0], req))
++        self.assertFalse(req.has_header("Cookie"))
++
++        p = pol.set_blocked_domains(["acme.com"])
++        req = Request("http://acme.com/")
++        c.add_cookie_header(req)
++        self.assertFalse(req.has_header("Cookie"))
++
++        req = Request("http://badacme.com/")
++        c.add_cookie_header(req)
++        self.assertFalse(req.has_header("Cookie"))
++
+     def test_secure(self):
+         from cookielib import CookieJar, DefaultCookiePolicy
+ 

python-base.changes

@@ -1,3 +1,17 @@
+-------------------------------------------------------------------
+Fri Jul 19 13:28:16 CEST 2019 - Matej Cepl <mcepl@suse.com>
+
+- boo#1141853 (CVE-2018-20852) add
+  CVE-2018-20852-cookie-domain-check.patch fixing
+  http.cookiejar.DefaultPolicy.domain_return_ok which did not
+  correctly validate the domain: it could be tricked into sending
+  cookies to the wrong server.
+
+-------------------------------------------------------------------
+Fri Jul 19 11:19:42 UTC 2019 - Tomáš Chvátal <tchvatal@suse.com>
+
+- Skip test_urllib2_localnet that randomly fails in OBS
+
 -------------------------------------------------------------------
 Wed May 29 08:58:16 UTC 2019 - Martin Liška <mliska@suse.cz>
 

python-base.spec

@@ -81,6 +81,9 @@ Patch52:        CVE-2019-9948-avoid_local-file.patch
 # PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 mcepl@suse.com
 # bpo#30458: Disallow control chars in http URLs.
 Patch53:        CVE-2019-9947-no-ctrl-char-http.patch
+# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com
+# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain
+Patch54:        CVE-2018-20852-cookie-domain-check.patch
 # COMMON-PATCH-END
 %define         python_version    %(echo %{tarversion} | head -c 3)
 BuildRequires:  automake
@@ -195,6 +198,7 @@ other applications.
 %patch51 -p1
 %patch52 -p1
 %patch53 -p1
+%patch54 -p1
 
 # drop Autoconf version requirement
 sed -i 's/^version_required/dnl version_required/' configure.ac
@@ -235,7 +239,8 @@ LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH \
 %ifnarch hppa
 # test_file(2k) fails in autobuild env - "stdin.seek(-1)" wrongly succeeds. probably an issue with autobuild's stdin
 # test_urllib2 relies on being able to resolve local address, which is notoriously impossible in autobuild
-EXCLUDE="test_urllib2 test_file test_file2k"
+# test_urllib2_localnet randomly fails out
+EXCLUDE="test_urllib2 test_urllib2_localnet test_file test_file2k"
 # test_nis and test_threading are AWFULLY slow.
 EXCLUDE="$EXCLUDE test_nis test_threading"
 # test_gdb fails if gdb with (different) python support is part of the buildsystem

python-doc.spec

@@ -81,6 +81,9 @@ Patch52:        CVE-2019-9948-avoid_local-file.patch
 # PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 mcepl@suse.com
 # bpo#30458: Disallow control chars in http URLs.
 Patch53:        CVE-2019-9947-no-ctrl-char-http.patch
+# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com
+# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain
+Patch54:        CVE-2018-20852-cookie-domain-check.patch
 # COMMON-PATCH-END
 Provides:       pyth_doc
 Provides:       pyth_ps
@@ -141,6 +144,7 @@ Python, and Macintosh Module Reference in PDF format.
 %patch51 -p1
 %patch52 -p1
 %patch53 -p1
+%patch54 -p1
 
 # drop Autoconf version requirement
 sed -i 's/^version_required/dnl version_required/' configure.ac

python.changes

@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Fri Jul 19 11:19:42 UTC 2019 - Tomáš Chvátal <tchvatal@suse.com>
+
+- Skip test_urllib2_localnet that randomly fails in OBS
+
 -------------------------------------------------------------------
 Wed May 29 08:58:16 UTC 2019 - Martin Liška <mliska@suse.cz>
 

python.spec

@@ -86,6 +86,9 @@ Patch52:        CVE-2019-9948-avoid_local-file.patch
 # PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 mcepl@suse.com
 # bpo#30458: Disallow control chars in http URLs.
 Patch53:        CVE-2019-9947-no-ctrl-char-http.patch
+# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com
+# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain
+Patch54:        CVE-2018-20852-cookie-domain-check.patch
 # COMMON-PATCH-END
 BuildRequires:  automake
 BuildRequires:  db-devel
@@ -247,6 +250,7 @@ that rely on earlier non-verification behavior.
 %patch51 -p1
 %patch52 -p1
 %patch53 -p1
+%patch54 -p1
 
 # drop Autoconf version requirement
 sed -i 's/^version_required/dnl version_required/' configure.ac
@@ -284,7 +288,7 @@ LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH \
 if test $(ulimit -v) = unlimited || test $(ulimit -v) -gt 10000000; then
   ulimit -v 10000000 || :
 fi
-LIST="test_urllib test_ssl test_hashlib test_hmac test_urllib2_localnet test_unicodedata test_tarfile test_sqlite test_tcl test_dbm test_anydbm test_dumbdbm test_gdbm test_whichdb test_tk test_ttk_textonly test_bsddb test_bsddb3 test_readline"
+LIST="test_urllib test_ssl test_hashlib test_hmac test_unicodedata test_tarfile test_sqlite test_tcl test_dbm test_anydbm test_dumbdbm test_gdbm test_whichdb test_tk test_ttk_textonly test_bsddb test_bsddb3 test_readline"
 make test TESTOPTS="$LIST" TESTPYTHONOPTS="-R"
 %endif