Compare commits
3 Commits
| Author | SHA256 | Date | |
|---|---|---|---|
350c926ec4
|
|||
|
79a850acd8
|
|||
|
6230bce579
|
105
CVE-2024-6923-follow-up-EOL-email-headers.patch
Normal file
105
CVE-2024-6923-follow-up-EOL-email-headers.patch
Normal file
@@ -0,0 +1,105 @@
|
||||
From 7ef18bbf2f92550e65547c0a55995c423e237944 Mon Sep 17 00:00:00 2001
|
||||
From: Seth Michael Larson <seth@python.org>
|
||||
Date: Fri, 23 Jan 2026 08:59:35 -0600
|
||||
Subject: [PATCH] gh-144125: email: verify headers are sound in BytesGenerator
|
||||
(cherry picked from commit 052e55e7d44718fe46cbba0ca995cb8fcc359413)
|
||||
|
||||
Co-authored-by: Seth Michael Larson <seth@python.org>
|
||||
Co-authored-by: Denis Ledoux <dle@odoo.com>
|
||||
Co-authored-by: Denis Ledoux <5822488+beledouxdenis@users.noreply.github.com>
|
||||
Co-authored-by: Petr Viktorin <302922+encukou@users.noreply.github.com>
|
||||
Co-authored-by: Bas Bloemsaat <1586868+basbloemsaat@users.noreply.github.com>
|
||||
---
|
||||
Lib/email/generator.py | 12 +++++++++++-
|
||||
Lib/test/test_email/test_generator.py | 4 +++-
|
||||
Lib/test/test_email/test_policy.py | 6 +++++-
|
||||
.../2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst | 4 ++++
|
||||
4 files changed, 23 insertions(+), 3 deletions(-)
|
||||
create mode 100644 Misc/NEWS.d/next/Security/2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst
|
||||
|
||||
diff --git a/Lib/email/generator.py b/Lib/email/generator.py
|
||||
index ce94f5c56fe34e..a03eb1fbbc9288 100644
|
||||
--- a/Lib/email/generator.py
|
||||
+++ b/Lib/email/generator.py
|
||||
@@ -22,6 +22,7 @@
|
||||
NLCRE = re.compile(r'\r\n|\r|\n')
|
||||
fcre = re.compile(r'^From ', re.MULTILINE)
|
||||
NEWLINE_WITHOUT_FWSP = re.compile(r'\r\n[^ \t]|\r[^ \n\t]|\n[^ \t]')
|
||||
+NEWLINE_WITHOUT_FWSP_BYTES = re.compile(br'\r\n[^ \t]|\r[^ \n\t]|\n[^ \t]')
|
||||
|
||||
|
||||
class Generator:
|
||||
@@ -429,7 +430,16 @@ def _write_headers(self, msg):
|
||||
# This is almost the same as the string version, except for handling
|
||||
# strings with 8bit bytes.
|
||||
for h, v in msg.raw_items():
|
||||
- self._fp.write(self.policy.fold_binary(h, v))
|
||||
+ folded = self.policy.fold_binary(h, v)
|
||||
+ if self.policy.verify_generated_headers:
|
||||
+ linesep = self.policy.linesep.encode()
|
||||
+ if not folded.endswith(linesep):
|
||||
+ raise HeaderWriteError(
|
||||
+ f'folded header does not end with {linesep!r}: {folded!r}')
|
||||
+ if NEWLINE_WITHOUT_FWSP_BYTES.search(folded.removesuffix(linesep)):
|
||||
+ raise HeaderWriteError(
|
||||
+ f'folded header contains newline: {folded!r}')
|
||||
+ self._fp.write(folded)
|
||||
# A blank line always separates headers from body
|
||||
self.write(self._NL)
|
||||
|
||||
diff --git a/Lib/test/test_email/test_generator.py b/Lib/test/test_email/test_generator.py
|
||||
index c75a842c33578e..3ca79edf6a65d9 100644
|
||||
--- a/Lib/test/test_email/test_generator.py
|
||||
+++ b/Lib/test/test_email/test_generator.py
|
||||
@@ -313,7 +313,7 @@ def test_flatten_unicode_linesep(self):
|
||||
self.assertEqual(s.getvalue(), self.typ(expected))
|
||||
|
||||
def test_verify_generated_headers(self):
|
||||
- """gh-121650: by default the generator prevents header injection"""
|
||||
+ # gh-121650: by default the generator prevents header injection
|
||||
class LiteralHeader(str):
|
||||
name = 'Header'
|
||||
def fold(self, **kwargs):
|
||||
@@ -334,6 +334,8 @@ def fold(self, **kwargs):
|
||||
|
||||
with self.assertRaises(email.errors.HeaderWriteError):
|
||||
message.as_string()
|
||||
+ with self.assertRaises(email.errors.HeaderWriteError):
|
||||
+ message.as_bytes()
|
||||
|
||||
|
||||
class TestBytesGenerator(TestGeneratorBase, TestEmailBase):
|
||||
diff --git a/Lib/test/test_email/test_policy.py b/Lib/test/test_email/test_policy.py
|
||||
index baa35fd68e49c5..71ec0febb0fd86 100644
|
||||
--- a/Lib/test/test_email/test_policy.py
|
||||
+++ b/Lib/test/test_email/test_policy.py
|
||||
@@ -296,7 +296,7 @@ def test_short_maxlen_error(self):
|
||||
policy.fold("Subject", subject)
|
||||
|
||||
def test_verify_generated_headers(self):
|
||||
- """Turning protection off allows header injection"""
|
||||
+ # Turning protection off allows header injection
|
||||
policy = email.policy.default.clone(verify_generated_headers=False)
|
||||
for text in (
|
||||
'Header: Value\r\nBad: Injection\r\n',
|
||||
@@ -319,6 +319,10 @@ def fold(self, **kwargs):
|
||||
message.as_string(),
|
||||
f"{text}\nBody",
|
||||
)
|
||||
+ self.assertEqual(
|
||||
+ message.as_bytes(),
|
||||
+ f"{text}\nBody".encode(),
|
||||
+ )
|
||||
|
||||
# XXX: Need subclassing tests.
|
||||
# For adding subclassed objects, make sure the usual rules apply (subclass
|
||||
diff --git a/Misc/NEWS.d/next/Security/2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst b/Misc/NEWS.d/next/Security/2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst
|
||||
new file mode 100644
|
||||
index 00000000000000..e6333e724972c5
|
||||
--- /dev/null
|
||||
+++ b/Misc/NEWS.d/next/Security/2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst
|
||||
@@ -0,0 +1,4 @@
|
||||
+:mod:`~email.generator.BytesGenerator` will now refuse to serialize (write) headers
|
||||
+that are unsafely folded or delimited; see
|
||||
+:attr:`~email.policy.Policy.verify_generated_headers`. (Contributed by Bas
|
||||
+Bloemsaat and Petr Viktorin in :gh:`121650`).
|
||||
108
CVE-2025-11468-email-hdr-fold-comment.patch
Normal file
108
CVE-2025-11468-email-hdr-fold-comment.patch
Normal file
@@ -0,0 +1,108 @@
|
||||
From 636f0b674ac4f4778b3ba32e950fdfc58a54b9e1 Mon Sep 17 00:00:00 2001
|
||||
From: Seth Michael Larson <seth@python.org>
|
||||
Date: Mon, 19 Jan 2026 06:38:22 -0600
|
||||
Subject: [PATCH] gh-143935: Email preserve parens when folding comments
|
||||
(GH-143936)
|
||||
|
||||
Fix a bug in the folding of comments when flattening an email message
|
||||
using a modern email policy. Comments consisting of a very long sequence of
|
||||
non-foldable characters could trigger a forced line wrap that omitted the
|
||||
required leading space on the continuation line, causing the remainder of
|
||||
the comment to be interpreted as a new header field. This enabled header
|
||||
injection with carefully crafted inputs.
|
||||
(cherry picked from commit 17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2)
|
||||
|
||||
Co-authored-by: Seth Michael Larson <seth@python.org>
|
||||
Co-authored-by: Denis Ledoux <dle@odoo.com>
|
||||
---
|
||||
Lib/email/_header_value_parser.py | 15 ++++++
|
||||
Lib/test/test_email/test__header_value_parser.py | 23 ++++++++++
|
||||
Misc/NEWS.d/next/Security/2026-01-16-14-40-31.gh-issue-143935.U2YtKl.rst | 6 ++
|
||||
3 files changed, 43 insertions(+), 1 deletion(-)
|
||||
create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-14-40-31.gh-issue-143935.U2YtKl.rst
|
||||
|
||||
Index: Python-3.13.11/Lib/email/_header_value_parser.py
|
||||
===================================================================
|
||||
--- Python-3.13.11.orig/Lib/email/_header_value_parser.py 2025-12-05 17:06:33.000000000 +0100
|
||||
+++ Python-3.13.11/Lib/email/_header_value_parser.py 2026-01-29 19:25:21.986346350 +0100
|
||||
@@ -101,6 +101,12 @@
|
||||
return str(value).replace('\\', '\\\\').replace('"', '\\"')
|
||||
|
||||
|
||||
+def make_parenthesis_pairs(value):
|
||||
+ """Escape parenthesis and backslash for use within a comment."""
|
||||
+ return str(value).replace('\\', '\\\\') \
|
||||
+ .replace('(', '\\(').replace(')', '\\)')
|
||||
+
|
||||
+
|
||||
def quote_string(value):
|
||||
escaped = make_quoted_pairs(value)
|
||||
return f'"{escaped}"'
|
||||
@@ -933,7 +939,7 @@
|
||||
return ' '
|
||||
|
||||
def startswith_fws(self):
|
||||
- return True
|
||||
+ return self and self[0] in WSP
|
||||
|
||||
|
||||
class ValueTerminal(Terminal):
|
||||
@@ -2924,6 +2930,13 @@
|
||||
[ValueTerminal(make_quoted_pairs(p), 'ptext')
|
||||
for p in newparts] +
|
||||
[ValueTerminal('"', 'ptext')])
|
||||
+ if part.token_type == 'comment':
|
||||
+ newparts = (
|
||||
+ [ValueTerminal('(', 'ptext')] +
|
||||
+ [ValueTerminal(make_parenthesis_pairs(p), 'ptext')
|
||||
+ if p.token_type == 'ptext' else p
|
||||
+ for p in newparts] +
|
||||
+ [ValueTerminal(')', 'ptext')])
|
||||
if not part.as_ew_allowed:
|
||||
wrap_as_ew_blocked += 1
|
||||
newparts.append(end_ew_not_allowed)
|
||||
Index: Python-3.13.11/Lib/test/test_email/test__header_value_parser.py
|
||||
===================================================================
|
||||
--- Python-3.13.11.orig/Lib/test/test_email/test__header_value_parser.py 2025-12-05 17:06:33.000000000 +0100
|
||||
+++ Python-3.13.11/Lib/test/test_email/test__header_value_parser.py 2026-01-29 19:25:21.986906275 +0100
|
||||
@@ -3219,6 +3219,29 @@
|
||||
with self.subTest(to=to):
|
||||
self._test(parser.get_address_list(to)[0], folded, policy=policy)
|
||||
|
||||
+ def test_address_list_with_long_unwrapable_comment(self):
|
||||
+ policy = self.policy.clone(max_line_length=40)
|
||||
+ cases = [
|
||||
+ # (to, folded)
|
||||
+ ('(loremipsumdolorsitametconsecteturadipi)<spy@example.org>',
|
||||
+ '(loremipsumdolorsitametconsecteturadipi)<spy@example.org>\n'),
|
||||
+ ('<spy@example.org>(loremipsumdolorsitametconsecteturadipi)',
|
||||
+ '<spy@example.org>(loremipsumdolorsitametconsecteturadipi)\n'),
|
||||
+ ('(loremipsum dolorsitametconsecteturadipi)<spy@example.org>',
|
||||
+ '(loremipsum dolorsitametconsecteturadipi)<spy@example.org>\n'),
|
||||
+ ('<spy@example.org>(loremipsum dolorsitametconsecteturadipi)',
|
||||
+ '<spy@example.org>(loremipsum\n dolorsitametconsecteturadipi)\n'),
|
||||
+ ('(Escaped \\( \\) chars \\\\ in comments stay escaped)<spy@example.org>',
|
||||
+ '(Escaped \\( \\) chars \\\\ in comments stay\n escaped)<spy@example.org>\n'),
|
||||
+ ('((loremipsum)(loremipsum)(loremipsum)(loremipsum))<spy@example.org>',
|
||||
+ '((loremipsum)(loremipsum)(loremipsum)(loremipsum))<spy@example.org>\n'),
|
||||
+ ('((loremipsum)(loremipsum)(loremipsum) (loremipsum))<spy@example.org>',
|
||||
+ '((loremipsum)(loremipsum)(loremipsum)\n (loremipsum))<spy@example.org>\n'),
|
||||
+ ]
|
||||
+ for (to, folded) in cases:
|
||||
+ with self.subTest(to=to):
|
||||
+ self._test(parser.get_address_list(to)[0], folded, policy=policy)
|
||||
+
|
||||
# XXX Need tests with comments on various sides of a unicode token,
|
||||
# and with unicode tokens in the comments. Spaces inside the quotes
|
||||
# currently don't do the right thing.
|
||||
Index: Python-3.13.11/Misc/NEWS.d/next/Security/2026-01-16-14-40-31.gh-issue-143935.U2YtKl.rst
|
||||
===================================================================
|
||||
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
|
||||
+++ Python-3.13.11/Misc/NEWS.d/next/Security/2026-01-16-14-40-31.gh-issue-143935.U2YtKl.rst 2026-01-29 19:25:21.987305397 +0100
|
||||
@@ -0,0 +1,6 @@
|
||||
+Fixed a bug in the folding of comments when flattening an email message
|
||||
+using a modern email policy. Comments consisting of a very long sequence of
|
||||
+non-foldable characters could trigger a forced line wrap that omitted the
|
||||
+required leading space on the continuation line, causing the remainder of
|
||||
+the comment to be interpreted as a new header field. This enabled header
|
||||
+injection with carefully crafted inputs.
|
||||
191
CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
Normal file
191
CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
Normal file
@@ -0,0 +1,191 @@
|
||||
From ef01008e47a7741808ab223087a458f33e4dd922 Mon Sep 17 00:00:00 2001
|
||||
From: Seth Michael Larson <seth@python.org>
|
||||
Date: Fri, 16 Jan 2026 10:54:09 -0600
|
||||
Subject: [PATCH 1/5] Add 'test.support' fixture for C0 control characters
|
||||
|
||||
---
|
||||
Doc/library/http.cookies.rst | 4
|
||||
Lib/http/cookies.py | 25 ++++
|
||||
Lib/test/support/__init__.py | 7 +
|
||||
Lib/test/test_http_cookies.py | 52 +++++++++-
|
||||
Misc/NEWS.d/next/Security/2026-01-16-11-13-15.gh-issue-143919.kchwZV.rst | 1
|
||||
5 files changed, 80 insertions(+), 9 deletions(-)
|
||||
|
||||
Index: Python-3.15.0a3/Doc/library/http.cookies.rst
|
||||
===================================================================
|
||||
--- Python-3.15.0a3.orig/Doc/library/http.cookies.rst 2025-12-16 13:26:12.000000000 +0100
|
||||
+++ Python-3.15.0a3/Doc/library/http.cookies.rst 2026-01-29 14:05:16.590570536 +0100
|
||||
@@ -294,9 +294,9 @@
|
||||
Set-Cookie: chips=ahoy
|
||||
Set-Cookie: vienna=finger
|
||||
>>> C = cookies.SimpleCookie()
|
||||
- >>> C.load('keebler="E=everybody; L=\\"Loves\\"; fudge=\\012;";')
|
||||
+ >>> C.load('keebler="E=everybody; L=\\"Loves\\"; fudge=;";')
|
||||
>>> print(C)
|
||||
- Set-Cookie: keebler="E=everybody; L=\"Loves\"; fudge=\012;"
|
||||
+ Set-Cookie: keebler="E=everybody; L=\"Loves\"; fudge=;"
|
||||
>>> C = cookies.SimpleCookie()
|
||||
>>> C["oreo"] = "doublestuff"
|
||||
>>> C["oreo"]["path"] = "/"
|
||||
Index: Python-3.15.0a3/Lib/http/cookies.py
|
||||
===================================================================
|
||||
--- Python-3.15.0a3.orig/Lib/http/cookies.py 2026-01-29 14:04:58.842924007 +0100
|
||||
+++ Python-3.15.0a3/Lib/http/cookies.py 2026-01-29 14:05:16.590357855 +0100
|
||||
@@ -87,9 +87,9 @@
|
||||
such trickeries do not confuse it.
|
||||
|
||||
>>> C = cookies.SimpleCookie()
|
||||
- >>> C.load('keebler="E=everybody; L=\\"Loves\\"; fudge=\\012;";')
|
||||
+ >>> C.load('keebler="E=everybody; L=\\"Loves\\"; fudge=;";')
|
||||
>>> print(C)
|
||||
- Set-Cookie: keebler="E=everybody; L=\"Loves\"; fudge=\012;"
|
||||
+ Set-Cookie: keebler="E=everybody; L=\"Loves\"; fudge=;"
|
||||
|
||||
Each element of the Cookie also supports all of the RFC 2109
|
||||
Cookie attributes. Here's an example which sets the Path
|
||||
@@ -170,6 +170,15 @@
|
||||
})
|
||||
|
||||
_is_legal_key = re.compile('[%s]+' % re.escape(_LegalChars)).fullmatch
|
||||
+_control_character_re = re.compile(r'[\x00-\x1F\x7F]')
|
||||
+
|
||||
+
|
||||
+def _has_control_character(*val):
|
||||
+ """Detects control characters within a value.
|
||||
+ Supports any type, as header values can be any type.
|
||||
+ """
|
||||
+ return any(_control_character_re.search(str(v)) for v in val)
|
||||
+
|
||||
|
||||
def _quote(str):
|
||||
r"""Quote a string for use in a cookie header.
|
||||
@@ -294,12 +303,16 @@
|
||||
K = K.lower()
|
||||
if not K in self._reserved:
|
||||
raise CookieError("Invalid attribute %r" % (K,))
|
||||
+ if _has_control_character(K, V):
|
||||
+ raise CookieError(f"Control characters are not allowed in cookies {K!r} {V!r}")
|
||||
dict.__setitem__(self, K, V)
|
||||
|
||||
def setdefault(self, key, val=None):
|
||||
key = key.lower()
|
||||
if key not in self._reserved:
|
||||
raise CookieError("Invalid attribute %r" % (key,))
|
||||
+ if _has_control_character(key, val):
|
||||
+ raise CookieError("Control characters are not allowed in cookies %r %r" % (key, val,))
|
||||
return dict.setdefault(self, key, val)
|
||||
|
||||
def __eq__(self, morsel):
|
||||
@@ -335,6 +348,9 @@
|
||||
raise CookieError('Attempt to set a reserved key %r' % (key,))
|
||||
if not _is_legal_key(key):
|
||||
raise CookieError('Illegal key %r' % (key,))
|
||||
+ if _has_control_character(key, val, coded_val):
|
||||
+ raise CookieError(
|
||||
+ "Control characters are not allowed in cookies %r %r %r" % (key, val, coded_val,))
|
||||
|
||||
# It's a good key, so save it.
|
||||
self._key = key
|
||||
@@ -488,7 +504,10 @@
|
||||
result = []
|
||||
items = sorted(self.items())
|
||||
for key, value in items:
|
||||
- result.append(value.output(attrs, header))
|
||||
+ value_output = value.output(attrs, header)
|
||||
+ if _has_control_character(value_output):
|
||||
+ raise CookieError("Control characters are not allowed in cookies")
|
||||
+ result.append(value_output)
|
||||
return sep.join(result)
|
||||
|
||||
__str__ = output
|
||||
Index: Python-3.15.0a3/Lib/test/support/__init__.py
|
||||
===================================================================
|
||||
--- Python-3.15.0a3.orig/Lib/test/support/__init__.py 2026-01-29 14:04:59.594499984 +0100
|
||||
+++ Python-3.15.0a3/Lib/test/support/__init__.py 2026-01-29 14:05:16.588221721 +0100
|
||||
@@ -3272,3 +3272,10 @@
|
||||
return _linked_to_musl
|
||||
_linked_to_musl = tuple(map(int, version.split('.')))
|
||||
return _linked_to_musl
|
||||
+
|
||||
+
|
||||
+def control_characters_c0() -> list[str]:
|
||||
+ """Returns a list of C0 control characters as strings.
|
||||
+ C0 control characters defined as the byte range 0x00-0x1F, and 0x7F.
|
||||
+ """
|
||||
+ return [chr(c) for c in range(0x00, 0x20)] + ["\x7F"]
|
||||
Index: Python-3.15.0a3/Lib/test/test_http_cookies.py
|
||||
===================================================================
|
||||
--- Python-3.15.0a3.orig/Lib/test/test_http_cookies.py 2026-01-29 14:05:00.455994675 +0100
|
||||
+++ Python-3.15.0a3/Lib/test/test_http_cookies.py 2026-01-29 14:05:16.590146527 +0100
|
||||
@@ -17,10 +17,10 @@
|
||||
'repr': "<SimpleCookie: chips='ahoy' vienna='finger'>",
|
||||
'output': 'Set-Cookie: chips=ahoy\nSet-Cookie: vienna=finger'},
|
||||
|
||||
- {'data': 'keebler="E=mc2; L=\\"Loves\\"; fudge=\\012;"',
|
||||
- 'dict': {'keebler' : 'E=mc2; L="Loves"; fudge=\012;'},
|
||||
- 'repr': '''<SimpleCookie: keebler='E=mc2; L="Loves"; fudge=\\n;'>''',
|
||||
- 'output': 'Set-Cookie: keebler="E=mc2; L=\\"Loves\\"; fudge=\\012;"'},
|
||||
+ {'data': 'keebler="E=mc2; L=\\"Loves\\"; fudge=;"',
|
||||
+ 'dict': {'keebler' : 'E=mc2; L="Loves"; fudge=;'},
|
||||
+ 'repr': '''<SimpleCookie: keebler='E=mc2; L="Loves"; fudge=;'>''',
|
||||
+ 'output': 'Set-Cookie: keebler="E=mc2; L=\\"Loves\\"; fudge=;"'},
|
||||
|
||||
# Check illegal cookies that have an '=' char in an unquoted value
|
||||
{'data': 'keebler=E=mc2',
|
||||
@@ -594,6 +594,50 @@
|
||||
r'Set-Cookie: key=coded_val; '
|
||||
r'expires=\w+, \d+ \w+ \d+ \d+:\d+:\d+ \w+')
|
||||
|
||||
+ def test_control_characters(self):
|
||||
+ for c0 in support.control_characters_c0():
|
||||
+ morsel = cookies.Morsel()
|
||||
+
|
||||
+ # .__setitem__()
|
||||
+ with self.assertRaises(cookies.CookieError):
|
||||
+ morsel[c0] = "val"
|
||||
+ with self.assertRaises(cookies.CookieError):
|
||||
+ morsel["path"] = c0
|
||||
+
|
||||
+ # .setdefault()
|
||||
+ with self.assertRaises(cookies.CookieError):
|
||||
+ morsel.setdefault("path", c0)
|
||||
+ with self.assertRaises(cookies.CookieError):
|
||||
+ morsel.setdefault(c0, "val")
|
||||
+
|
||||
+ # .set()
|
||||
+ with self.assertRaises(cookies.CookieError):
|
||||
+ morsel.set(c0, "val", "coded-value")
|
||||
+ with self.assertRaises(cookies.CookieError):
|
||||
+ morsel.set("path", c0, "coded-value")
|
||||
+ with self.assertRaises(cookies.CookieError):
|
||||
+ morsel.set("path", "val", c0)
|
||||
+
|
||||
+ def test_control_characters_output(self):
|
||||
+ # Tests that even if the internals of Morsel are modified
|
||||
+ # that a call to .output() has control character safeguards.
|
||||
+ for c0 in support.control_characters_c0():
|
||||
+ morsel = cookies.Morsel()
|
||||
+ morsel.set("key", "value", "coded-value")
|
||||
+ morsel._key = c0 # Override private variable.
|
||||
+ cookie = cookies.SimpleCookie()
|
||||
+ cookie["cookie"] = morsel
|
||||
+ with self.assertRaises(cookies.CookieError):
|
||||
+ cookie.output()
|
||||
+
|
||||
+ morsel = cookies.Morsel()
|
||||
+ morsel.set("key", "value", "coded-value")
|
||||
+ morsel._coded_value = c0 # Override private variable.
|
||||
+ cookie = cookies.SimpleCookie()
|
||||
+ cookie["cookie"] = morsel
|
||||
+ with self.assertRaises(cookies.CookieError):
|
||||
+ cookie.output()
|
||||
+
|
||||
|
||||
def load_tests(loader, tests, pattern):
|
||||
tests.addTest(doctest.DocTestSuite(cookies))
|
||||
Index: Python-3.15.0a3/Misc/NEWS.d/next/Security/2026-01-16-11-13-15.gh-issue-143919.kchwZV.rst
|
||||
===================================================================
|
||||
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
|
||||
+++ Python-3.15.0a3/Misc/NEWS.d/next/Security/2026-01-16-11-13-15.gh-issue-143919.kchwZV.rst 2026-01-29 14:05:16.589009315 +0100
|
||||
@@ -0,0 +1 @@
|
||||
+Reject control characters in :class:`http.cookies.Morsel` fields and values.
|
||||
@@ -1,3 +1,16 @@
|
||||
-------------------------------------------------------------------
|
||||
Tue Jan 27 16:31:12 UTC 2026 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Add CVE-2024-6923-follow-up-EOL-email-headers.patch which is
|
||||
a follow-up to the previous fix of CVE-2024-6923 further
|
||||
encoding EOL possibly hidden in email headers (bsc#1257181).
|
||||
- Add CVE-2025-11468-email-hdr-fold-comment.patch preserving
|
||||
parens when folding comments in email headers (bsc#1257029,
|
||||
CVE-2025-11468).
|
||||
- Add CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch, which
|
||||
rejects control characters in http cookies (bsc#1257031,
|
||||
CVE-2026-0672).
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Dec 11 21:36:09 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
|
||||
@@ -238,6 +238,17 @@ Patch45: gh139257-Support-docutils-0.22.patch
|
||||
# PATCH-FIX-UPSTREAM pass-test_write_read_limited_history.patch bsc#[0-9]+ mcepl@suse.com
|
||||
# Fix readline history truncation when length is reduced
|
||||
Patch48: pass-test_write_read_limited_history.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2024-6923-follow-up-EOL-email-headers.patch bsc#1257181 mcepl@suse.com
|
||||
# Encode newlines in headers when using ByteGenerator
|
||||
# patch from gh#python/cpython#144125
|
||||
Patch49: CVE-2024-6923-follow-up-EOL-email-headers.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2025-11468-email-hdr-fold-comment.patch bsc#1257029 mcepl@suse.com
|
||||
# Email preserve parens when folding comments
|
||||
Patch50: CVE-2025-11468-email-hdr-fold-comment.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch bsc#1257031 mcepl@suse.com
|
||||
# Reject control characters in http cookies
|
||||
Patch51: CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
|
||||
#### END OF PATCHES
|
||||
BuildRequires: autoconf-archive
|
||||
BuildRequires: automake
|
||||
BuildRequires: fdupes
|
||||
|
||||
Reference in New Issue
Block a user