diff --git a/CVE-2019-20907_tarfile-inf-loop.patch b/CVE-2019-20907_tarfile-inf-loop.patch index 79e62a2..eb9790f 100644 --- a/CVE-2019-20907_tarfile-inf-loop.patch +++ b/CVE-2019-20907_tarfile-inf-loop.patch @@ -41,16 +41,3 @@ Add a check for length = 0 in the _proc_pax function to avoid running into an in +++ b/Misc/NEWS.d/next/Library/2020-07-12-22-16-58.bpo-39017.x3Cg-9.rst @@ -0,0 +1 @@ +Avoid infinite loop when reading specially crafted TAR files using the tarfile module (CVE-2019-20907). ---- /dev/null -+++ b/Lib/test/recursion.tar.asc -@@ -0,0 +1,10 @@ -+YmNhbGxlcgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAAAAAAAMAAAAAAA -+AAAwAAAAAAAAADEAAAAAAAAAAAAAADAAAAAAAAAAAAAAADAwMjc1NQAgZwAAAAAAAAAAAAAAAAAA -+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMAAAAAAAAAAAAAAAAAAAAAAAAAAA -+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAAAAAAADAAAAAA -+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAw -+IFg9 diff --git a/python39.spec b/python39.spec index 0589b07..a69c741 100644 --- a/python39.spec +++ b/python39.spec @@ -102,6 +102,8 @@ Source10: pre_checkin.sh Source11: skipped_tests.py Source19: idle3.desktop Source20: idle3.appdata.xml +# For Patch 32 +Source32: recursion.tar Source99: python.keyring # The following files are not used in the build. # They are listed here to work around missing functionality in rpmbuild, @@ -140,6 +142,7 @@ Patch29: bpo-31046_ensurepip_honours_prefix.patch Patch31: bsc1167501-invalid-alignment.patch # PATCH-FIX-UPSTREAM CVE-2019-20907_tarfile-inf-loop.patch bsc#1174091 mcepl@suse.com # avoid possible infinite loop in specifically crafted tarball (CVE-2019-20907) +# REQUIRES SOURCE 32 Patch32: CVE-2019-20907_tarfile-inf-loop.patch BuildRequires: automake BuildRequires: fdupes @@ -397,7 +400,7 @@ other applications. %patch32 -p1 # For patch 32 -python3 -mbase64 -d Lib/test/recursion.tar.asc > Lib/test/recursion.tar +cp -v %{SOURCE32} Lib/test/recursion.tar # drop Autoconf version requirement sed -i 's/^AC_PREREQ/dnl AC_PREREQ/' configure.ac diff --git a/recursion.tar b/recursion.tar new file mode 100644 index 0000000..e1d2b90 Binary files /dev/null and b/recursion.tar differ