forked from pool/python310
Set link to python310.36641 via maintenance_release request
This commit is contained in:
97
CVE-2024-11168-validation-IPv6-addrs.patch
Normal file
97
CVE-2024-11168-validation-IPv6-addrs.patch
Normal file
@@ -0,0 +1,97 @@
|
||||
From 37bc08c699f48461be5e000b2da9212237a1ca0f Mon Sep 17 00:00:00 2001
|
||||
From: JohnJamesUtley <jjutley231@gmail.com>
|
||||
Date: Tue, 25 Apr 2023 16:01:03 -0400
|
||||
Subject: [PATCH 1/4] Adds checks to ensure that bracketed hosts found by
|
||||
urlsplit are of IPv6 or IPvFuture format
|
||||
|
||||
---
|
||||
Lib/test/test_urlparse.py | 26 ++++++++++
|
||||
Lib/urllib/parse.py | 16 +++++-
|
||||
Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst | 2
|
||||
3 files changed, 43 insertions(+), 1 deletion(-)
|
||||
create mode 100644 Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst
|
||||
|
||||
--- a/Lib/test/test_urlparse.py
|
||||
+++ b/Lib/test/test_urlparse.py
|
||||
@@ -1138,6 +1138,32 @@ class UrlParseTestCase(unittest.TestCase
|
||||
self.assertEqual(p2.scheme, 'tel')
|
||||
self.assertEqual(p2.path, '+31641044153')
|
||||
|
||||
+ def test_invalid_bracketed_hosts(self):
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[192.0.2.146]/Path?Query')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[important.com:8000]/Path?Query')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v123r.IP]/Path?Query')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v12ae]/Path?Query')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v.IP]/Path?Query')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v123.]/Path?Query')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v]/Path?Query')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@]v6a.ip[/Path')
|
||||
+
|
||||
+ def test_splitting_bracketed_hosts(self):
|
||||
+ p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query')
|
||||
+ self.assertEqual(p1.hostname, 'v6a.ip')
|
||||
+ self.assertEqual(p1.username, 'user')
|
||||
+ self.assertEqual(p1.path, '/path')
|
||||
+ p2 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7%test]/path?query')
|
||||
+ self.assertEqual(p2.hostname, '0439:23af:2309::fae7%test')
|
||||
+ self.assertEqual(p2.username, 'user')
|
||||
+ self.assertEqual(p2.path, '/path')
|
||||
+ p3 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146%test]/path?query')
|
||||
+ self.assertEqual(p3.hostname, '0439:23af:2309::fae7:1234:192.0.2.146%test')
|
||||
+ self.assertEqual(p3.username, 'user')
|
||||
+ self.assertEqual(p3.path, '/path')
|
||||
+
|
||||
def test_port_casting_failure_message(self):
|
||||
message = "Port could not be cast to integer value as 'oracle'"
|
||||
p1 = urllib.parse.urlparse('http://Server=sde; Service=sde:oracle')
|
||||
--- a/Lib/urllib/parse.py
|
||||
+++ b/Lib/urllib/parse.py
|
||||
@@ -36,6 +36,7 @@ import sys
|
||||
import types
|
||||
import collections
|
||||
import warnings
|
||||
+import ipaddress
|
||||
|
||||
__all__ = ["urlparse", "urlunparse", "urljoin", "urldefrag",
|
||||
"urlsplit", "urlunsplit", "urlencode", "parse_qs",
|
||||
@@ -441,6 +442,17 @@ def _checknetloc(netloc):
|
||||
raise ValueError("netloc '" + netloc + "' contains invalid " +
|
||||
"characters under NFKC normalization")
|
||||
|
||||
+# Valid bracketed hosts are defined in
|
||||
+# https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
|
||||
+def _check_bracketed_host(hostname):
|
||||
+ if hostname.startswith('v'):
|
||||
+ if not re.match(r"\Av[a-fA-F0-9]+\..+\Z", hostname):
|
||||
+ raise ValueError(f"IPvFuture address is invalid")
|
||||
+ else:
|
||||
+ ip = ipaddress.ip_address(hostname) # Throws Value Error if not IPv6 or IPv4
|
||||
+ if isinstance(ip, ipaddress.IPv4Address):
|
||||
+ raise ValueError(f"An IPv4 address cannot be in brackets")
|
||||
+
|
||||
def urlsplit(url, scheme='', allow_fragments=True):
|
||||
"""Parse a URL into 5 components:
|
||||
<scheme>://<netloc>/<path>?<query>#<fragment>
|
||||
@@ -487,12 +499,14 @@ def urlsplit(url, scheme='', allow_fragm
|
||||
break
|
||||
else:
|
||||
scheme, url = url[:i].lower(), url[i+1:]
|
||||
-
|
||||
if url[:2] == '//':
|
||||
netloc, url = _splitnetloc(url, 2)
|
||||
if (('[' in netloc and ']' not in netloc) or
|
||||
(']' in netloc and '[' not in netloc)):
|
||||
raise ValueError("Invalid IPv6 URL")
|
||||
+ if '[' in netloc and ']' in netloc:
|
||||
+ bracketed_host = netloc.partition('[')[2].partition(']')[0]
|
||||
+ _check_bracketed_host(bracketed_host)
|
||||
if allow_fragments and '#' in url:
|
||||
url, fragment = url.split('#', 1)
|
||||
if '?' in url:
|
||||
--- /dev/null
|
||||
+++ b/Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst
|
||||
@@ -0,0 +1,2 @@
|
||||
+Add checks to ensure that ``[`` bracketed ``]`` hosts found by
|
||||
+:func:`urllib.parse.urlsplit` are of IPv6 or IPvFuture format.
|
||||
@@ -1,3 +1,24 @@
|
||||
-------------------------------------------------------------------
|
||||
Thu Nov 14 07:06:20 UTC 2024 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Remove -IVendor/ from python-config boo#1231795
|
||||
- Apply sphinx-72.patch only conditionally for non-SLE-15 builds.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Nov 13 13:25:01 UTC 2024 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Add CVE-2024-11168-validation-IPv6-addrs.patch
|
||||
fixing bsc#1233307 (CVE-2024-11168,
|
||||
gh#python/cpython#103848): Improper validation of IPv6 and
|
||||
IPvFuture addresses.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Nov 4 21:49:20 UTC 2024 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Update sphinx-72.patch to include renaming :noindex: option to
|
||||
:no-index: in Sphinx 7.2 (bsc#1232750).
|
||||
- While renaming drop fix-sphinx-72.patch.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Nov 1 21:38:45 UTC 2024 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
|
||||
@@ -191,7 +191,7 @@ Patch19: gh-78214-marshal_stabilize_FLAG_REF.patch
|
||||
# * gh#python/cpython#104163
|
||||
# * gh#python/cpython#104221
|
||||
# * gh#python/cpython#107246
|
||||
Patch21: fix-sphinx-72.patch
|
||||
Patch21: sphinx-72.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2023-52425-libexpat-2.6.0-backport.patch gh#python/cpython#117187 mcepl@suse.com
|
||||
# Make the test suite work with libexpat < 2.6.0
|
||||
Patch22: CVE-2023-52425-libexpat-2.6.0-backport.patch
|
||||
@@ -207,6 +207,9 @@ Patch28: sphinx-802.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2024-9287-venv_path_unquoted.patch gh#python/cpython#124651 mcepl@suse.com
|
||||
# venv should properly quote path names provided when creating a venv
|
||||
Patch29: CVE-2024-9287-venv_path_unquoted.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2024-11168-validation-IPv6-addrs.patch bsc#1233307 mcepl@suse.com
|
||||
# improve validation of IPv6 and IPvFuture addresses in urlparse and urlsplit
|
||||
Patch30: CVE-2024-11168-validation-IPv6-addrs.patch
|
||||
BuildRequires: autoconf-archive
|
||||
BuildRequires: automake
|
||||
BuildRequires: fdupes
|
||||
@@ -481,12 +484,17 @@ other applications.
|
||||
%patch -p1 -P 17
|
||||
%patch -p1 -P 18
|
||||
%patch -p1 -P 19
|
||||
|
||||
%if ! 0%{?sle_version} || 0%{?sle_version} >= 160000
|
||||
%patch -p1 -P 21
|
||||
%endif
|
||||
|
||||
%patch -p1 -P 22
|
||||
%patch -p1 -P 24
|
||||
%patch -p1 -P 27
|
||||
%patch -p1 -P 28
|
||||
%patch -p1 -P 29
|
||||
%patch -p1 -P 30
|
||||
|
||||
# drop Autoconf version requirement
|
||||
sed -i 's/^AC_PREREQ/dnl AC_PREREQ/' configure.ac
|
||||
@@ -795,6 +803,9 @@ install -m 755 -D Tools/gdb/libpython.py %{buildroot}%{_datadir}/gdb/auto-load/%
|
||||
# install devel files to /config
|
||||
#cp Makefile Makefile.pre.in Makefile.pre $RPM_BUILD_ROOT%{sitedir}/config-%{python_abi}/
|
||||
|
||||
# Remove -IVendor/ from python-config boo#1231795
|
||||
sed -i 's/-IVendor\///' %{buildroot}%{_bindir}/python%{python_abi}-config
|
||||
|
||||
# RPM macros
|
||||
%if %{primary_interpreter}
|
||||
mkdir -p %{buildroot}%{_rpmconfigdir}/macros.d/
|
||||
|
||||
@@ -1,76 +1,77 @@
|
||||
---
|
||||
Doc/c-api/bytearray.rst | 2
|
||||
Doc/c-api/bytes.rst | 2
|
||||
Doc/c-api/capsule.rst | 2
|
||||
Doc/c-api/complex.rst | 2
|
||||
Doc/c-api/concrete.rst | 6 -
|
||||
Doc/c-api/dict.rst | 4
|
||||
Doc/c-api/exceptions.rst | 6 -
|
||||
Doc/c-api/file.rst | 2
|
||||
Doc/c-api/float.rst | 2
|
||||
Doc/c-api/function.rst | 2
|
||||
Doc/c-api/import.rst | 4
|
||||
Doc/c-api/init.rst | 14 +--
|
||||
Doc/c-api/intro.rst | 8 -
|
||||
Doc/c-api/list.rst | 6 -
|
||||
Doc/c-api/long.rst | 4
|
||||
Doc/c-api/mapping.rst | 2
|
||||
Doc/c-api/memoryview.rst | 2
|
||||
Doc/c-api/method.rst | 4
|
||||
Doc/c-api/module.rst | 2
|
||||
Doc/c-api/none.rst | 2
|
||||
Doc/c-api/number.rst | 12 +-
|
||||
Doc/c-api/object.rst | 12 +-
|
||||
Doc/c-api/sequence.rst | 4
|
||||
Doc/c-api/set.rst | 6 -
|
||||
Doc/c-api/structures.rst | 4
|
||||
Doc/c-api/tuple.rst | 2
|
||||
Doc/c-api/type.rst | 2
|
||||
Doc/c-api/typeobj.rst | 4
|
||||
Doc/conf.py | 5 +
|
||||
Doc/extending/newtypes.rst | 2
|
||||
Doc/library/_thread.rst | 2
|
||||
Doc/library/binascii.rst | 6 -
|
||||
Doc/library/cmath.rst | 2
|
||||
Doc/library/copy.rst | 2
|
||||
Doc/library/copyreg.rst | 4
|
||||
Doc/library/dis.rst | 2
|
||||
Doc/library/exceptions.rst | 10 +-
|
||||
Doc/library/fnmatch.rst | 4
|
||||
Doc/library/functions.rst | 10 +-
|
||||
Doc/library/http.client.rst | 2
|
||||
Doc/library/imp.rst | 2
|
||||
Doc/library/internet.rst | 2
|
||||
Doc/library/locale.rst | 4
|
||||
Doc/library/marshal.rst | 4
|
||||
Doc/library/os.path.rst | 2
|
||||
Doc/library/os.rst | 4
|
||||
Doc/library/pdb.rst | 4
|
||||
Doc/library/posix.rst | 2
|
||||
Doc/library/pprint.rst | 4
|
||||
Doc/library/pwd.rst | 2
|
||||
Doc/library/pyexpat.rst | 2
|
||||
Doc/library/runpy.rst | 4
|
||||
Doc/library/shelve.rst | 6 -
|
||||
Doc/library/site.rst | 6 -
|
||||
Doc/library/socket.rst | 4
|
||||
Doc/library/stdtypes.rst | 146 ++++++++++++++++----------------
|
||||
Doc/library/sys.rst | 2
|
||||
Doc/library/traceback.rst | 2
|
||||
Doc/library/types.rst | 2
|
||||
Doc/reference/compound_stmts.rst | 90 +++++++++----------
|
||||
Doc/reference/datamodel.rst | 154 +++++++++++++++++-----------------
|
||||
Doc/reference/executionmodel.rst | 2
|
||||
Doc/reference/expressions.rst | 134 ++++++++++++++---------------
|
||||
Doc/reference/simple_stmts.rst | 74 ++++++++--------
|
||||
Doc/reference/toplevel_components.rst | 10 +-
|
||||
Doc/tools/extensions/pyspecific.py | 25 +++++
|
||||
Doc/tutorial/classes.rst | 2
|
||||
Doc/tutorial/controlflow.rst | 2
|
||||
Doc/tutorial/inputoutput.rst | 6 -
|
||||
Doc/tutorial/modules.rst | 4
|
||||
Doc/tutorial/stdlib.rst | 2
|
||||
71 files changed, 457 insertions(+), 427 deletions(-)
|
||||
Doc/c-api/bytearray.rst | 2
|
||||
Doc/c-api/bytes.rst | 2
|
||||
Doc/c-api/capsule.rst | 2
|
||||
Doc/c-api/complex.rst | 2
|
||||
Doc/c-api/concrete.rst | 6 -
|
||||
Doc/c-api/dict.rst | 4
|
||||
Doc/c-api/exceptions.rst | 6 -
|
||||
Doc/c-api/file.rst | 2
|
||||
Doc/c-api/float.rst | 2
|
||||
Doc/c-api/function.rst | 2
|
||||
Doc/c-api/import.rst | 4
|
||||
Doc/c-api/init.rst | 14 +--
|
||||
Doc/c-api/intro.rst | 8 -
|
||||
Doc/c-api/list.rst | 6 -
|
||||
Doc/c-api/long.rst | 4
|
||||
Doc/c-api/mapping.rst | 2
|
||||
Doc/c-api/memoryview.rst | 2
|
||||
Doc/c-api/method.rst | 4
|
||||
Doc/c-api/module.rst | 2
|
||||
Doc/c-api/none.rst | 2
|
||||
Doc/c-api/number.rst | 12 +-
|
||||
Doc/c-api/object.rst | 12 +-
|
||||
Doc/c-api/sequence.rst | 4
|
||||
Doc/c-api/set.rst | 6 -
|
||||
Doc/c-api/structures.rst | 4
|
||||
Doc/c-api/tuple.rst | 2
|
||||
Doc/c-api/type.rst | 2
|
||||
Doc/c-api/typeobj.rst | 4
|
||||
Doc/conf.py | 5 +
|
||||
Doc/extending/newtypes.rst | 2
|
||||
Doc/library/_thread.rst | 2
|
||||
Doc/library/binascii.rst | 6 -
|
||||
Doc/library/cmath.rst | 2
|
||||
Doc/library/copy.rst | 2
|
||||
Doc/library/copyreg.rst | 4
|
||||
Doc/library/dis.rst | 2
|
||||
Doc/library/email.compat32-message.rst | 1
|
||||
Doc/library/exceptions.rst | 10 +-
|
||||
Doc/library/fnmatch.rst | 4
|
||||
Doc/library/functions.rst | 10 +-
|
||||
Doc/library/http.client.rst | 2
|
||||
Doc/library/imp.rst | 2
|
||||
Doc/library/internet.rst | 2
|
||||
Doc/library/locale.rst | 4
|
||||
Doc/library/marshal.rst | 4
|
||||
Doc/library/os.path.rst | 2
|
||||
Doc/library/os.rst | 4
|
||||
Doc/library/pdb.rst | 4
|
||||
Doc/library/posix.rst | 2
|
||||
Doc/library/pprint.rst | 4
|
||||
Doc/library/pwd.rst | 2
|
||||
Doc/library/pyexpat.rst | 2
|
||||
Doc/library/runpy.rst | 4
|
||||
Doc/library/shelve.rst | 6 -
|
||||
Doc/library/site.rst | 6 -
|
||||
Doc/library/socket.rst | 4
|
||||
Doc/library/stdtypes.rst | 146 +++++++++++++++----------------
|
||||
Doc/library/sys.rst | 2
|
||||
Doc/library/traceback.rst | 2
|
||||
Doc/library/types.rst | 2
|
||||
Doc/reference/compound_stmts.rst | 90 +++++++++----------
|
||||
Doc/reference/datamodel.rst | 154 ++++++++++++++++-----------------
|
||||
Doc/reference/executionmodel.rst | 2
|
||||
Doc/reference/expressions.rst | 134 ++++++++++++++--------------
|
||||
Doc/reference/simple_stmts.rst | 74 +++++++--------
|
||||
Doc/reference/toplevel_components.rst | 10 +-
|
||||
Doc/tools/extensions/pyspecific.py | 25 +++++
|
||||
Doc/tutorial/classes.rst | 2
|
||||
Doc/tutorial/controlflow.rst | 2
|
||||
Doc/tutorial/inputoutput.rst | 6 -
|
||||
Doc/tutorial/modules.rst | 4
|
||||
Doc/tutorial/stdlib.rst | 2
|
||||
72 files changed, 458 insertions(+), 427 deletions(-)
|
||||
|
||||
--- a/Doc/c-api/bytearray.rst
|
||||
+++ b/Doc/c-api/bytearray.rst
|
||||
@@ -727,6 +728,16 @@
|
||||
|
||||
Pushes a slice object on the stack. *argc* must be 2 or 3. If it is 2,
|
||||
``slice(TOS1, TOS)`` is pushed; if it is 3, ``slice(TOS2, TOS1, TOS)`` is
|
||||
--- a/Doc/library/email.compat32-message.rst
|
||||
+++ b/Doc/library/email.compat32-message.rst
|
||||
@@ -7,6 +7,7 @@
|
||||
:synopsis: The base class representing email messages in a fashion
|
||||
backward compatible with Python 3.2
|
||||
:noindex:
|
||||
+ :no-index:
|
||||
|
||||
|
||||
The :class:`Message` class is very similar to the
|
||||
--- a/Doc/library/exceptions.rst
|
||||
+++ b/Doc/library/exceptions.rst
|
||||
@@ -4,8 +4,8 @@ Built-in Exceptions
|
||||
Reference in New Issue
Block a user