diff --git a/CVE-2024-11168-validation-IPv6-addrs.patch b/CVE-2024-11168-validation-IPv6-addrs.patch new file mode 100644 index 0000000..7f1d4fb --- /dev/null +++ b/CVE-2024-11168-validation-IPv6-addrs.patch @@ -0,0 +1,97 @@ +From 37bc08c699f48461be5e000b2da9212237a1ca0f Mon Sep 17 00:00:00 2001 +From: JohnJamesUtley +Date: Tue, 25 Apr 2023 16:01:03 -0400 +Subject: [PATCH 1/4] Adds checks to ensure that bracketed hosts found by + urlsplit are of IPv6 or IPvFuture format + +--- + Lib/test/test_urlparse.py | 26 ++++++++++ + Lib/urllib/parse.py | 16 +++++- + Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst | 2 + 3 files changed, 43 insertions(+), 1 deletion(-) + create mode 100644 Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst + +--- a/Lib/test/test_urlparse.py ++++ b/Lib/test/test_urlparse.py +@@ -1138,6 +1138,32 @@ class UrlParseTestCase(unittest.TestCase + self.assertEqual(p2.scheme, 'tel') + self.assertEqual(p2.path, '+31641044153') + ++ def test_invalid_bracketed_hosts(self): ++ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[192.0.2.146]/Path?Query') ++ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[important.com:8000]/Path?Query') ++ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v123r.IP]/Path?Query') ++ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v12ae]/Path?Query') ++ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v.IP]/Path?Query') ++ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v123.]/Path?Query') ++ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v]/Path?Query') ++ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query') ++ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query') ++ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@]v6a.ip[/Path') ++ ++ def test_splitting_bracketed_hosts(self): ++ p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query') ++ self.assertEqual(p1.hostname, 'v6a.ip') ++ self.assertEqual(p1.username, 'user') ++ self.assertEqual(p1.path, '/path') ++ p2 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7%test]/path?query') ++ self.assertEqual(p2.hostname, '0439:23af:2309::fae7%test') ++ self.assertEqual(p2.username, 'user') ++ self.assertEqual(p2.path, '/path') ++ p3 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146%test]/path?query') ++ self.assertEqual(p3.hostname, '0439:23af:2309::fae7:1234:192.0.2.146%test') ++ self.assertEqual(p3.username, 'user') ++ self.assertEqual(p3.path, '/path') ++ + def test_port_casting_failure_message(self): + message = "Port could not be cast to integer value as 'oracle'" + p1 = urllib.parse.urlparse('http://Server=sde; Service=sde:oracle') +--- a/Lib/urllib/parse.py ++++ b/Lib/urllib/parse.py +@@ -36,6 +36,7 @@ import sys + import types + import collections + import warnings ++import ipaddress + + __all__ = ["urlparse", "urlunparse", "urljoin", "urldefrag", + "urlsplit", "urlunsplit", "urlencode", "parse_qs", +@@ -441,6 +442,17 @@ def _checknetloc(netloc): + raise ValueError("netloc '" + netloc + "' contains invalid " + + "characters under NFKC normalization") + ++# Valid bracketed hosts are defined in ++# https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/ ++def _check_bracketed_host(hostname): ++ if hostname.startswith('v'): ++ if not re.match(r"\Av[a-fA-F0-9]+\..+\Z", hostname): ++ raise ValueError(f"IPvFuture address is invalid") ++ else: ++ ip = ipaddress.ip_address(hostname) # Throws Value Error if not IPv6 or IPv4 ++ if isinstance(ip, ipaddress.IPv4Address): ++ raise ValueError(f"An IPv4 address cannot be in brackets") ++ + def urlsplit(url, scheme='', allow_fragments=True): + """Parse a URL into 5 components: + :///?# +@@ -487,12 +499,14 @@ def urlsplit(url, scheme='', allow_fragm + break + else: + scheme, url = url[:i].lower(), url[i+1:] +- + if url[:2] == '//': + netloc, url = _splitnetloc(url, 2) + if (('[' in netloc and ']' not in netloc) or + (']' in netloc and '[' not in netloc)): + raise ValueError("Invalid IPv6 URL") ++ if '[' in netloc and ']' in netloc: ++ bracketed_host = netloc.partition('[')[2].partition(']')[0] ++ _check_bracketed_host(bracketed_host) + if allow_fragments and '#' in url: + url, fragment = url.split('#', 1) + if '?' in url: +--- /dev/null ++++ b/Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst +@@ -0,0 +1,2 @@ ++Add checks to ensure that ``[`` bracketed ``]`` hosts found by ++:func:`urllib.parse.urlsplit` are of IPv6 or IPvFuture format. diff --git a/python310.changes b/python310.changes index 385f82c..41ecc0a 100644 --- a/python310.changes +++ b/python310.changes @@ -1,3 +1,24 @@ +------------------------------------------------------------------- +Thu Nov 14 07:06:20 UTC 2024 - Matej Cepl + +- Remove -IVendor/ from python-config boo#1231795 +- Apply sphinx-72.patch only conditionally for non-SLE-15 builds. + +------------------------------------------------------------------- +Wed Nov 13 13:25:01 UTC 2024 - Matej Cepl + +- Add CVE-2024-11168-validation-IPv6-addrs.patch + fixing bsc#1233307 (CVE-2024-11168, + gh#python/cpython#103848): Improper validation of IPv6 and + IPvFuture addresses. + +------------------------------------------------------------------- +Mon Nov 4 21:49:20 UTC 2024 - Matej Cepl + +- Update sphinx-72.patch to include renaming :noindex: option to + :no-index: in Sphinx 7.2 (bsc#1232750). +- While renaming drop fix-sphinx-72.patch. + ------------------------------------------------------------------- Fri Nov 1 21:38:45 UTC 2024 - Matej Cepl diff --git a/python310.spec b/python310.spec index fe74b4e..4ec7a9b 100644 --- a/python310.spec +++ b/python310.spec @@ -191,7 +191,7 @@ Patch19: gh-78214-marshal_stabilize_FLAG_REF.patch # * gh#python/cpython#104163 # * gh#python/cpython#104221 # * gh#python/cpython#107246 -Patch21: fix-sphinx-72.patch +Patch21: sphinx-72.patch # PATCH-FIX-UPSTREAM CVE-2023-52425-libexpat-2.6.0-backport.patch gh#python/cpython#117187 mcepl@suse.com # Make the test suite work with libexpat < 2.6.0 Patch22: CVE-2023-52425-libexpat-2.6.0-backport.patch @@ -207,6 +207,9 @@ Patch28: sphinx-802.patch # PATCH-FIX-UPSTREAM CVE-2024-9287-venv_path_unquoted.patch gh#python/cpython#124651 mcepl@suse.com # venv should properly quote path names provided when creating a venv Patch29: CVE-2024-9287-venv_path_unquoted.patch +# PATCH-FIX-UPSTREAM CVE-2024-11168-validation-IPv6-addrs.patch bsc#1233307 mcepl@suse.com +# improve validation of IPv6 and IPvFuture addresses in urlparse and urlsplit +Patch30: CVE-2024-11168-validation-IPv6-addrs.patch BuildRequires: autoconf-archive BuildRequires: automake BuildRequires: fdupes @@ -481,12 +484,17 @@ other applications. %patch -p1 -P 17 %patch -p1 -P 18 %patch -p1 -P 19 + +%if ! 0%{?sle_version} || 0%{?sle_version} >= 160000 %patch -p1 -P 21 +%endif + %patch -p1 -P 22 %patch -p1 -P 24 %patch -p1 -P 27 %patch -p1 -P 28 %patch -p1 -P 29 +%patch -p1 -P 30 # drop Autoconf version requirement sed -i 's/^AC_PREREQ/dnl AC_PREREQ/' configure.ac @@ -795,6 +803,9 @@ install -m 755 -D Tools/gdb/libpython.py %{buildroot}%{_datadir}/gdb/auto-load/% # install devel files to /config #cp Makefile Makefile.pre.in Makefile.pre $RPM_BUILD_ROOT%{sitedir}/config-%{python_abi}/ +# Remove -IVendor/ from python-config boo#1231795 +sed -i 's/-IVendor\///' %{buildroot}%{_bindir}/python%{python_abi}-config + # RPM macros %if %{primary_interpreter} mkdir -p %{buildroot}%{_rpmconfigdir}/macros.d/ diff --git a/fix-sphinx-72.patch b/sphinx-72.patch similarity index 95% rename from fix-sphinx-72.patch rename to sphinx-72.patch index 68701fe..39de7e1 100644 --- a/fix-sphinx-72.patch +++ b/sphinx-72.patch @@ -1,76 +1,77 @@ --- - Doc/c-api/bytearray.rst | 2 - Doc/c-api/bytes.rst | 2 - Doc/c-api/capsule.rst | 2 - Doc/c-api/complex.rst | 2 - Doc/c-api/concrete.rst | 6 - - Doc/c-api/dict.rst | 4 - Doc/c-api/exceptions.rst | 6 - - Doc/c-api/file.rst | 2 - Doc/c-api/float.rst | 2 - Doc/c-api/function.rst | 2 - Doc/c-api/import.rst | 4 - Doc/c-api/init.rst | 14 +-- - Doc/c-api/intro.rst | 8 - - Doc/c-api/list.rst | 6 - - Doc/c-api/long.rst | 4 - Doc/c-api/mapping.rst | 2 - Doc/c-api/memoryview.rst | 2 - Doc/c-api/method.rst | 4 - Doc/c-api/module.rst | 2 - Doc/c-api/none.rst | 2 - Doc/c-api/number.rst | 12 +- - Doc/c-api/object.rst | 12 +- - Doc/c-api/sequence.rst | 4 - Doc/c-api/set.rst | 6 - - Doc/c-api/structures.rst | 4 - Doc/c-api/tuple.rst | 2 - Doc/c-api/type.rst | 2 - Doc/c-api/typeobj.rst | 4 - Doc/conf.py | 5 + - Doc/extending/newtypes.rst | 2 - Doc/library/_thread.rst | 2 - Doc/library/binascii.rst | 6 - - Doc/library/cmath.rst | 2 - Doc/library/copy.rst | 2 - Doc/library/copyreg.rst | 4 - Doc/library/dis.rst | 2 - Doc/library/exceptions.rst | 10 +- - Doc/library/fnmatch.rst | 4 - Doc/library/functions.rst | 10 +- - Doc/library/http.client.rst | 2 - Doc/library/imp.rst | 2 - Doc/library/internet.rst | 2 - Doc/library/locale.rst | 4 - Doc/library/marshal.rst | 4 - Doc/library/os.path.rst | 2 - Doc/library/os.rst | 4 - Doc/library/pdb.rst | 4 - Doc/library/posix.rst | 2 - Doc/library/pprint.rst | 4 - Doc/library/pwd.rst | 2 - Doc/library/pyexpat.rst | 2 - Doc/library/runpy.rst | 4 - Doc/library/shelve.rst | 6 - - Doc/library/site.rst | 6 - - Doc/library/socket.rst | 4 - Doc/library/stdtypes.rst | 146 ++++++++++++++++---------------- - Doc/library/sys.rst | 2 - Doc/library/traceback.rst | 2 - Doc/library/types.rst | 2 - Doc/reference/compound_stmts.rst | 90 +++++++++---------- - Doc/reference/datamodel.rst | 154 +++++++++++++++++----------------- - Doc/reference/executionmodel.rst | 2 - Doc/reference/expressions.rst | 134 ++++++++++++++--------------- - Doc/reference/simple_stmts.rst | 74 ++++++++-------- - Doc/reference/toplevel_components.rst | 10 +- - Doc/tools/extensions/pyspecific.py | 25 +++++ - Doc/tutorial/classes.rst | 2 - Doc/tutorial/controlflow.rst | 2 - Doc/tutorial/inputoutput.rst | 6 - - Doc/tutorial/modules.rst | 4 - Doc/tutorial/stdlib.rst | 2 - 71 files changed, 457 insertions(+), 427 deletions(-) + Doc/c-api/bytearray.rst | 2 + Doc/c-api/bytes.rst | 2 + Doc/c-api/capsule.rst | 2 + Doc/c-api/complex.rst | 2 + Doc/c-api/concrete.rst | 6 - + Doc/c-api/dict.rst | 4 + Doc/c-api/exceptions.rst | 6 - + Doc/c-api/file.rst | 2 + Doc/c-api/float.rst | 2 + Doc/c-api/function.rst | 2 + Doc/c-api/import.rst | 4 + Doc/c-api/init.rst | 14 +-- + Doc/c-api/intro.rst | 8 - + Doc/c-api/list.rst | 6 - + Doc/c-api/long.rst | 4 + Doc/c-api/mapping.rst | 2 + Doc/c-api/memoryview.rst | 2 + Doc/c-api/method.rst | 4 + Doc/c-api/module.rst | 2 + Doc/c-api/none.rst | 2 + Doc/c-api/number.rst | 12 +- + Doc/c-api/object.rst | 12 +- + Doc/c-api/sequence.rst | 4 + Doc/c-api/set.rst | 6 - + Doc/c-api/structures.rst | 4 + Doc/c-api/tuple.rst | 2 + Doc/c-api/type.rst | 2 + Doc/c-api/typeobj.rst | 4 + Doc/conf.py | 5 + + Doc/extending/newtypes.rst | 2 + Doc/library/_thread.rst | 2 + Doc/library/binascii.rst | 6 - + Doc/library/cmath.rst | 2 + Doc/library/copy.rst | 2 + Doc/library/copyreg.rst | 4 + Doc/library/dis.rst | 2 + Doc/library/email.compat32-message.rst | 1 + Doc/library/exceptions.rst | 10 +- + Doc/library/fnmatch.rst | 4 + Doc/library/functions.rst | 10 +- + Doc/library/http.client.rst | 2 + Doc/library/imp.rst | 2 + Doc/library/internet.rst | 2 + Doc/library/locale.rst | 4 + Doc/library/marshal.rst | 4 + Doc/library/os.path.rst | 2 + Doc/library/os.rst | 4 + Doc/library/pdb.rst | 4 + Doc/library/posix.rst | 2 + Doc/library/pprint.rst | 4 + Doc/library/pwd.rst | 2 + Doc/library/pyexpat.rst | 2 + Doc/library/runpy.rst | 4 + Doc/library/shelve.rst | 6 - + Doc/library/site.rst | 6 - + Doc/library/socket.rst | 4 + Doc/library/stdtypes.rst | 146 +++++++++++++++---------------- + Doc/library/sys.rst | 2 + Doc/library/traceback.rst | 2 + Doc/library/types.rst | 2 + Doc/reference/compound_stmts.rst | 90 +++++++++---------- + Doc/reference/datamodel.rst | 154 ++++++++++++++++----------------- + Doc/reference/executionmodel.rst | 2 + Doc/reference/expressions.rst | 134 ++++++++++++++-------------- + Doc/reference/simple_stmts.rst | 74 +++++++-------- + Doc/reference/toplevel_components.rst | 10 +- + Doc/tools/extensions/pyspecific.py | 25 +++++ + Doc/tutorial/classes.rst | 2 + Doc/tutorial/controlflow.rst | 2 + Doc/tutorial/inputoutput.rst | 6 - + Doc/tutorial/modules.rst | 4 + Doc/tutorial/stdlib.rst | 2 + 72 files changed, 458 insertions(+), 427 deletions(-) --- a/Doc/c-api/bytearray.rst +++ b/Doc/c-api/bytearray.rst @@ -727,6 +728,16 @@ Pushes a slice object on the stack. *argc* must be 2 or 3. If it is 2, ``slice(TOS1, TOS)`` is pushed; if it is 3, ``slice(TOS2, TOS1, TOS)`` is +--- a/Doc/library/email.compat32-message.rst ++++ b/Doc/library/email.compat32-message.rst +@@ -7,6 +7,7 @@ + :synopsis: The base class representing email messages in a fashion + backward compatible with Python 3.2 + :noindex: ++ :no-index: + + + The :class:`Message` class is very similar to the --- a/Doc/library/exceptions.rst +++ b/Doc/library/exceptions.rst @@ -4,8 +4,8 @@ Built-in Exceptions