From 524793850103d788c4c868d9a1199a6a69e2c32e4fb28d3072de6d18778664ee Mon Sep 17 00:00:00 2001 From: Matej Cepl Date: Wed, 1 Mar 2023 21:31:34 +0000 Subject: [PATCH] - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python39?expand=0&rev=136 --- CVE-2023-24329-blank-URL-bypass.patch | 55 +++++++++++++++++++++++++++ python39.changes | 7 ++++ python39.spec | 5 +++ 3 files changed, 67 insertions(+) create mode 100644 CVE-2023-24329-blank-URL-bypass.patch diff --git a/CVE-2023-24329-blank-URL-bypass.patch b/CVE-2023-24329-blank-URL-bypass.patch new file mode 100644 index 0000000..036a859 --- /dev/null +++ b/CVE-2023-24329-blank-URL-bypass.patch @@ -0,0 +1,55 @@ +From a284d69de1d1a42714576d4a9562145a94e62127 Mon Sep 17 00:00:00 2001 +From: Ben Kallus +Date: Sat, 12 Nov 2022 15:43:33 -0500 +Subject: [PATCH 1/2] gh-99418: Prevent urllib.parse.urlparse from accepting + schemes that don't begin with an alphabetical ASCII character. + +--- + Lib/test/test_urlparse.py | 18 ++++++++++ + Lib/urllib/parse.py | 2 - + Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst | 2 + + 3 files changed, 21 insertions(+), 1 deletion(-) + +--- a/Lib/test/test_urlparse.py ++++ b/Lib/test/test_urlparse.py +@@ -665,6 +665,24 @@ class UrlParseTestCase(unittest.TestCase + with self.assertRaises(ValueError): + p.port + ++ def test_attributes_bad_scheme(self): ++ """Check handling of invalid schemes.""" ++ for bytes in (False, True): ++ for parse in (urllib.parse.urlsplit, urllib.parse.urlparse): ++ for scheme in (".", "+", "-", "0", "http&", "६http"): ++ with self.subTest(bytes=bytes, parse=parse, scheme=scheme): ++ url = scheme + "://www.example.net" ++ if bytes: ++ if url.isascii(): ++ url = url.encode("ascii") ++ else: ++ continue ++ p = parse(url) ++ if bytes: ++ self.assertEqual(p.scheme, b"") ++ else: ++ self.assertEqual(p.scheme, "") ++ + def test_attributes_without_netloc(self): + # This example is straight from RFC 3261. It looks like it + # should allow the username, hostname, and port to be filled +--- a/Lib/urllib/parse.py ++++ b/Lib/urllib/parse.py +@@ -470,7 +470,7 @@ def urlsplit(url, scheme='', allow_fragm + clear_cache() + netloc = query = fragment = '' + i = url.find(':') +- if i > 0: ++ if i > 0 and url[0].isascii() and url[0].isalpha(): + for c in url[:i]: + if c not in scheme_chars: + break +--- /dev/null ++++ b/Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst +@@ -0,0 +1,2 @@ ++Fix bug in :func:`urllib.parse.urlparse` that causes URL schemes that begin ++with a digit, a plus sign, or a minus sign to be parsed incorrectly. diff --git a/python39.changes b/python39.changes index 32d2729..a02b19b 100644 --- a/python39.changes +++ b/python39.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Wed Mar 1 14:43:31 UTC 2023 - Matej Cepl + +- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, + bsc#1208471) blocklists bypass via the urllib.parse component + when supplying a URL that starts with blank characters + ------------------------------------------------------------------- Tue Feb 21 11:34:49 UTC 2023 - Matej Cepl diff --git a/python39.spec b/python39.spec index 501460b..2df885b 100644 --- a/python39.spec +++ b/python39.spec @@ -161,6 +161,10 @@ Patch35: support-expat-CVE-2022-25236-patched.patch # PATCH-FIX-UPSTREAM 98437-sphinx.locale._-as-gettext-in-pyspecific.patch gh#python/cpython#98366 mcepl@suse.com # this patch makes things totally awesome Patch37: 98437-sphinx.locale._-as-gettext-in-pyspecific.patch +# PATCH-FIX-UPSTREAM CVE-2023-24329-blank-URL-bypass.patch bsc#1208471 mcepl@suse.com +# blocklist bypass via the urllib.parse component when supplying +# a URL that starts with blank characters +Patch38: CVE-2023-24329-blank-URL-bypass.patch BuildRequires: autoconf-archive BuildRequires: automake BuildRequires: fdupes @@ -424,6 +428,7 @@ other applications. %endif %patch35 -p1 %patch37 -p1 +%patch38 -p1 # drop Autoconf version requirement sed -i 's/^AC_PREREQ/dnl AC_PREREQ/' configure.ac