Skip to content

Commit 0e22864

Browse files
amritakohliamritakohli
authored
Patched python CVE-2023-24329 (#6412)
1 parent 9f39ef6 commit 0e22864

File tree

6 files changed

+111
-28
lines changed

6 files changed

+111
-28
lines changed

‎SPECS/python3/CVE-2023-24329.patch‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
From 141aadcb6e6c1c8ecc850847049002fed4475030 Mon Sep 17 00:00:00 2001
2+
From: Ben Kallus <[email protected]>
3+
Date: Sat, 12 Nov 2022 15:43:33 -0500
4+
Subject: [PATCH 1/2] Modify upstream patch to work with CBL-Mariner for
5+
CVE-2023-24329. Modified by Amrita Kohli <[email protected]>
6+
7+
---
8+
Lib/test/test_urlparse.py | 18 ++++++++++++++++++
9+
Lib/urllib/parse.py | 2 +-
10+
2 files changed, 19 insertions(+), 1 deletion(-)
11+
12+
diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
13+
index 31943f3..f42ed9b 100644
14+
--- a/Lib/test/test_urlparse.py
15+
+++ b/Lib/test/test_urlparse.py
16+
@@ -665,6 +665,24 @@ class UrlParseTestCase(unittest.TestCase):
17+
with self.assertRaises(ValueError):
18+
p.port
19+
20+
+ def test_attributes_bad_scheme(self):
21+
+ """Check handling of invalid schemes."""
22+
+ for bytes in (False, True):
23+
+ for parse in (urllib.parse.urlsplit, urllib.parse.urlparse):
24+
+ for scheme in (".", "+", "-", "0", "http&", "६http"):
25+
+ with self.subTest(bytes=bytes, parse=parse, scheme=scheme):
26+
+ url = scheme + "://www.example.net"
27+
+ if bytes:
28+
+ if url.isascii():
29+
+ url = url.encode("ascii")
30+
+ else:
31+
+ continue
32+
+ p = parse(url)
33+
+ if bytes:
34+
+ self.assertEqual(p.scheme, b"")
35+
+ else:
36+
+ self.assertEqual(p.scheme, "")
37+
+
38+
def test_attributes_without_netloc(self):
39+
# This example is straight from RFC 3261. It looks like it
40+
# should allow the username, hostname, and port to be filled
41+
diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py
42+
index b7965fe..bd59852 100644
43+
--- a/Lib/urllib/parse.py
44+
+++ b/Lib/urllib/parse.py
45+
@@ -470,7 +470,7 @@ def urlsplit(url, scheme='', allow_fragments=True):
46+
clear_cache()
47+
netloc = query = fragment = ''
48+
i = url.find(':')
49+
- if i > 0:
50+
+ if i > 0 and url[0].isascii() and url[0].isalpha():
51+
for c in url[:i]:
52+
if c not in scheme_chars:
53+
break
54+
--
55+
2.34.1
56+
57+
58+
From de2b58d3b30095440a30fcb72d595b434b351532 Mon Sep 17 00:00:00 2001
59+
From: Ben Kallus <[email protected]>
60+
Date: Sat, 12 Nov 2022 15:46:31 -0500
61+
Subject: [PATCH 2/2] gh-99418: Prevent urllib.parse.urlparse from accepting
62+
schemes that don't begin with an alphabetical ASCII character.
63+
64+
---
65+
.../next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst | 2 ++
66+
1 file changed, 2 insertions(+)
67+
create mode 100644 Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst
68+
69+
diff --git a/Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst b/Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst
70+
new file mode 100644
71+
index 0000000..0a06e7c
72+
--- /dev/null
73+
+++ b/Misc/NEWS.d/next/Library/2022-11-12-15-45-51.gh-issue-99418.FxfAXS.rst
74+
@@ -0,0 +1,2 @@
75+
+Fix bug in :func:`urllib.parse.urlparse` that causes URL schemes that begin
76+
+with a digit, a plus sign, or a minus sign to be parsed incorrectly.
77+
--
78+
2.34.1

‎SPECS/python3/python3.spec‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
Summary: A high-level scripting language
1313
Name: python3
1414
Version: 3.9.14
15-
Release: 7%{?dist}
15+
Release: 8%{?dist}
1616
License: PSF
1717
Vendor: Microsoft Corporation
1818
Distribution: Mariner
@@ -26,8 +26,9 @@ Patch2: 0001-gh-95231-Disable-md5-crypt-modules-if-FIPS-is-enable.patch
2626
Patch3: CVE-2022-37454.patch
2727
Patch4: CVE-2022-45061.patch
2828
Patch5: CVE-2022-42919.patch
29+
Patch6: CVE-2023-24329.patch
2930
# Patch for setuptools, resolved in 65.5.1
30-
Patch1000: CVE-2022-40897.patch
31+
Patch1000: CVE-2022-40897.patch
3132

3233
BuildRequires: bzip2-devel
3334
BuildRequires: expat-devel >= 2.1.0
@@ -168,6 +169,7 @@ The test package contains all regression tests for Python as well as the modules
168169
%patch3 -p1
169170
%patch4 -p1
170171
%patch5 -p1
172+
%patch6 -p1
171173

172174
%build
173175
# Remove GCC specs and build environment linker scripts
@@ -321,6 +323,9 @@ rm -rf %{buildroot}%{_bindir}/__pycache__
321323
%{_libdir}/python%{majmin}/test/*
322324

323325
%changelog
326+
* Wed Oct 11 2023 Amrita Kohli <[email protected]> - 3.9.14-8
327+
- Patch for CVE-2023-24329
328+
324329
* Wed Sep 20 2023 Jon Slobodzian <[email protected]> - 3.9.14-7
325330
- Recompile with stack-protection fixed gcc version (CVE-2023-4039)
326331

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -237,10 +237,10 @@ ca-certificates-base-2.0.0-13.cm2.noarch.rpm
237237
ca-certificates-2.0.0-13.cm2.noarch.rpm
238238
dwz-0.14-2.cm2.aarch64.rpm
239239
unzip-6.0-20.cm2.aarch64.rpm
240-
python3-3.9.14-7.cm2.aarch64.rpm
241-
python3-devel-3.9.14-7.cm2.aarch64.rpm
242-
python3-libs-3.9.14-7.cm2.aarch64.rpm
243-
python3-setuptools-3.9.14-7.cm2.noarch.rpm
240+
python3-3.9.14-8.cm2.aarch64.rpm
241+
python3-devel-3.9.14-8.cm2.aarch64.rpm
242+
python3-libs-3.9.14-8.cm2.aarch64.rpm
243+
python3-setuptools-3.9.14-8.cm2.noarch.rpm
244244
python3-pygments-2.4.2-7.cm2.noarch.rpm
245245
which-2.21-8.cm2.aarch64.rpm
246246
libselinux-3.2-1.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -237,10 +237,10 @@ ca-certificates-base-2.0.0-13.cm2.noarch.rpm
237237
ca-certificates-2.0.0-13.cm2.noarch.rpm
238238
dwz-0.14-2.cm2.x86_64.rpm
239239
unzip-6.0-20.cm2.x86_64.rpm
240-
python3-3.9.14-7.cm2.x86_64.rpm
241-
python3-devel-3.9.14-7.cm2.x86_64.rpm
242-
python3-libs-3.9.14-7.cm2.x86_64.rpm
243-
python3-setuptools-3.9.14-7.cm2.noarch.rpm
240+
python3-3.9.14-8.cm2.x86_64.rpm
241+
python3-devel-3.9.14-8.cm2.x86_64.rpm
242+
python3-libs-3.9.14-8.cm2.x86_64.rpm
243+
python3-setuptools-3.9.14-8.cm2.noarch.rpm
244244
python3-pygments-2.4.2-7.cm2.noarch.rpm
245245
which-2.21-8.cm2.x86_64.rpm
246246
libselinux-3.2-1.cm2.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -508,28 +508,28 @@ procps-ng-devel-3.3.17-2.cm2.aarch64.rpm
508508
procps-ng-lang-3.3.17-2.cm2.aarch64.rpm
509509
pyproject-rpm-macros-1.0.0~rc1-4.cm2.noarch.rpm
510510
python-markupsafe-debuginfo-2.1.0-1.cm2.aarch64.rpm
511-
python3-3.9.14-7.cm2.aarch64.rpm
511+
python3-3.9.14-8.cm2.aarch64.rpm
512512
python3-audit-3.0.6-8.cm2.aarch64.rpm
513513
python3-cracklib-2.9.7-5.cm2.aarch64.rpm
514-
python3-curses-3.9.14-7.cm2.aarch64.rpm
514+
python3-curses-3.9.14-8.cm2.aarch64.rpm
515515
python3-Cython-0.29.33-1.cm2.aarch64.rpm
516-
python3-debuginfo-3.9.14-7.cm2.aarch64.rpm
517-
python3-devel-3.9.14-7.cm2.aarch64.rpm
516+
python3-debuginfo-3.9.14-8.cm2.aarch64.rpm
517+
python3-devel-3.9.14-8.cm2.aarch64.rpm
518518
python3-gpg-1.16.0-2.cm2.aarch64.rpm
519519
python3-jinja2-3.0.3-2.cm2.noarch.rpm
520520
python3-libcap-ng-0.8.2-2.cm2.aarch64.rpm
521-
python3-libs-3.9.14-7.cm2.aarch64.rpm
521+
python3-libs-3.9.14-8.cm2.aarch64.rpm
522522
python3-libxml2-2.10.4-1.cm2.aarch64.rpm
523523
python3-lxml-4.9.1-1.cm2.aarch64.rpm
524524
python3-magic-5.40-2.cm2.noarch.rpm
525525
python3-markupsafe-2.1.0-1.cm2.aarch64.rpm
526526
python3-newt-0.52.21-5.cm2.aarch64.rpm
527-
python3-pip-3.9.14-7.cm2.noarch.rpm
527+
python3-pip-3.9.14-8.cm2.noarch.rpm
528528
python3-pygments-2.4.2-7.cm2.noarch.rpm
529529
python3-rpm-4.18.0-4.cm2.aarch64.rpm
530-
python3-setuptools-3.9.14-7.cm2.noarch.rpm
531-
python3-test-3.9.14-7.cm2.aarch64.rpm
532-
python3-tools-3.9.14-7.cm2.aarch64.rpm
530+
python3-setuptools-3.9.14-8.cm2.noarch.rpm
531+
python3-test-3.9.14-8.cm2.aarch64.rpm
532+
python3-tools-3.9.14-8.cm2.aarch64.rpm
533533
readline-8.1-1.cm2.aarch64.rpm
534534
readline-debuginfo-8.1-1.cm2.aarch64.rpm
535535
readline-devel-8.1-1.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -508,28 +508,28 @@ procps-ng-devel-3.3.17-2.cm2.x86_64.rpm
508508
procps-ng-lang-3.3.17-2.cm2.x86_64.rpm
509509
pyproject-rpm-macros-1.0.0~rc1-4.cm2.noarch.rpm
510510
python-markupsafe-debuginfo-2.1.0-1.cm2.x86_64.rpm
511-
python3-3.9.14-7.cm2.x86_64.rpm
511+
python3-3.9.14-8.cm2.x86_64.rpm
512512
python3-audit-3.0.6-8.cm2.x86_64.rpm
513513
python3-cracklib-2.9.7-5.cm2.x86_64.rpm
514-
python3-curses-3.9.14-7.cm2.x86_64.rpm
514+
python3-curses-3.9.14-8.cm2.x86_64.rpm
515515
python3-Cython-0.29.33-1.cm2.x86_64.rpm
516-
python3-debuginfo-3.9.14-7.cm2.x86_64.rpm
517-
python3-devel-3.9.14-7.cm2.x86_64.rpm
516+
python3-debuginfo-3.9.14-8.cm2.x86_64.rpm
517+
python3-devel-3.9.14-8.cm2.x86_64.rpm
518518
python3-gpg-1.16.0-2.cm2.x86_64.rpm
519519
python3-jinja2-3.0.3-2.cm2.noarch.rpm
520520
python3-libcap-ng-0.8.2-2.cm2.x86_64.rpm
521-
python3-libs-3.9.14-7.cm2.x86_64.rpm
521+
python3-libs-3.9.14-8.cm2.x86_64.rpm
522522
python3-libxml2-2.10.4-1.cm2.x86_64.rpm
523523
python3-lxml-4.9.1-1.cm2.x86_64.rpm
524524
python3-magic-5.40-2.cm2.noarch.rpm
525525
python3-markupsafe-2.1.0-1.cm2.x86_64.rpm
526526
python3-newt-0.52.21-5.cm2.x86_64.rpm
527-
python3-pip-3.9.14-7.cm2.noarch.rpm
527+
python3-pip-3.9.14-8.cm2.noarch.rpm
528528
python3-pygments-2.4.2-7.cm2.noarch.rpm
529529
python3-rpm-4.18.0-4.cm2.x86_64.rpm
530-
python3-setuptools-3.9.14-7.cm2.noarch.rpm
531-
python3-test-3.9.14-7.cm2.x86_64.rpm
532-
python3-tools-3.9.14-7.cm2.x86_64.rpm
530+
python3-setuptools-3.9.14-8.cm2.noarch.rpm
531+
python3-test-3.9.14-8.cm2.x86_64.rpm
532+
python3-tools-3.9.14-8.cm2.x86_64.rpm
533533
readline-8.1-1.cm2.x86_64.rpm
534534
readline-debuginfo-8.1-1.cm2.x86_64.rpm
535535
readline-devel-8.1-1.cm2.x86_64.rpm

0 commit comments

Comments
 (0)