Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python for openSUSE:Factory checked in at 2022-09-10 20:16:38 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python (Old) and /work/SRC/openSUSE:Factory/.python.new.2083 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python" Sat Sep 10 20:16:38 2022 rev:172 rq:1001544 version:2.7.18 Changes: -------- --- /work/SRC/openSUSE:Factory/python/python-base.changes 2022-06-13 13:02:00.473073218 +0200 +++ /work/SRC/openSUSE:Factory/.python.new.2083/python-base.changes 2022-09-10 20:16:39.740731933 +0200 @@ -1,0 +2,7 @@ +Wed Sep 7 04:46:44 UTC 2022 - Steve Kowalik <[email protected]> + +- Add patch CVE-2021-28861-double-slash-path.patch: + * BaseHTTPServer: Fix an open redirection vulnerability in the HTTP server + when an URI path starts with //. (bsc#1202624, CVE-2021-28861) + +------------------------------------------------------------------- python-doc.changes: same change python.changes: same change New: ---- CVE-2021-28861-double-slash-path.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-base.spec ++++++ --- /var/tmp/diff_new_pack.hPDxQc/_old 2022-09-10 20:16:41.064735338 +0200 +++ /var/tmp/diff_new_pack.hPDxQc/_new 2022-09-10 20:16:41.072735358 +0200 @@ -130,6 +130,9 @@ # PATCH-FIX-UPSTREAM CVE-2015-20107-mailcap-unsafe-filenames.patch bsc#1198511 [email protected] # avoid the command injection in the mailcap module. Patch70: CVE-2015-20107-mailcap-unsafe-filenames.patch +# PATCH-FIX-UPSTREAM CVE-2021-28861 bsc#1202624 +# Coerce // to / in Lib/BaseHTTPServer.py +Patch71: CVE-2021-28861-double-slash-path.patch # COMMON-PATCH-END %define python_version %(echo %{tarversion} | head -c 3) BuildRequires: automake @@ -266,6 +269,7 @@ %patch68 -p1 %patch69 -p1 %patch70 -p1 +%patch71 -p1 # For patch 66 cp -v %{SOURCE66} Lib/test/recursion.tar ++++++ python-doc.spec ++++++ --- /var/tmp/diff_new_pack.hPDxQc/_old 2022-09-10 20:16:41.096735420 +0200 +++ /var/tmp/diff_new_pack.hPDxQc/_new 2022-09-10 20:16:41.100735430 +0200 @@ -129,6 +129,9 @@ # PATCH-FIX-UPSTREAM CVE-2015-20107-mailcap-unsafe-filenames.patch bsc#1198511 [email protected] # avoid the command injection in the mailcap module. Patch70: CVE-2015-20107-mailcap-unsafe-filenames.patch +# PATCH-FIX-UPSTREAM CVE-2021-28861 bsc#1202624 +# Coerce // to / in Lib/BaseHTTPServer.py +Patch71: CVE-2021-28861-double-slash-path.patch # COMMON-PATCH-END Provides: pyth_doc = %{version} Provides: pyth_ps = %{version} @@ -203,6 +206,7 @@ %patch68 -p1 %patch69 -p1 %patch70 -p1 +%patch71 -p1 # For patch 66 cp -v %{SOURCE66} Lib/test/recursion.tar ++++++ python.spec ++++++ --- /var/tmp/diff_new_pack.hPDxQc/_old 2022-09-10 20:16:41.128735502 +0200 +++ /var/tmp/diff_new_pack.hPDxQc/_new 2022-09-10 20:16:41.132735513 +0200 @@ -129,6 +129,9 @@ # PATCH-FIX-UPSTREAM CVE-2015-20107-mailcap-unsafe-filenames.patch bsc#1198511 [email protected] # avoid the command injection in the mailcap module. Patch70: CVE-2015-20107-mailcap-unsafe-filenames.patch +# PATCH-FIX-UPSTREAM CVE-2021-28861 bsc#1202624 +# Coerce // to / in Lib/BaseHTTPServer.py +Patch71: CVE-2021-28861-double-slash-path.patch # COMMON-PATCH-END BuildRequires: automake BuildRequires: db-devel @@ -319,6 +322,7 @@ %patch68 -p1 %patch69 -p1 %patch70 -p1 +%patch71 -p1 # For patch 66 cp -v %{SOURCE66} Lib/test/recursion.tar ++++++ CVE-2021-28861-double-slash-path.patch ++++++ Index: Python-2.7.18/Lib/BaseHTTPServer.py =================================================================== --- Python-2.7.18.orig/Lib/BaseHTTPServer.py +++ Python-2.7.18/Lib/BaseHTTPServer.py @@ -287,6 +287,14 @@ class BaseHTTPRequestHandler(SocketServe return False self.command, self.path, self.request_version = command, path, version + # CVE-2021-28861: The purpose of replacing '//' with '/' is to + # protect against open redirect attacks possibly triggered if the + # path starts with '//' because http clients treat //path as an + # absolute URI without scheme (similar to http://path) rather than + # a path. + if self.path.startswith('//'): + self.path = '/' + self.path.lstrip('/') # Reduce to a single / + # Examine the headers and look for a Connection directive self.headers = self.MessageClass(self.rfile, 0) Index: Python-2.7.18/Lib/test/test_httpservers.py =================================================================== --- Python-2.7.18.orig/Lib/test/test_httpservers.py +++ Python-2.7.18/Lib/test/test_httpservers.py @@ -417,6 +417,52 @@ class SimpleHTTPServerTestCase(BaseTestC self.assertEqual(response.getheader("Location"), self.tempdir_name + "/?hi=1") + def test_get_dir_redirect_location_domain_injection_bug(self): + """Ensure //evil.co/..%2f../../X does not put //evil.co/ in Location. + //netloc/ in a Location header is a redirect to a new host. + https://github.com/python/cpython/issues/87389 + This checks that a path resolving to a directory on our server cannot + resolve into a redirect to another server. + """ + os.mkdir(os.path.join(self.tempdir, 'existing_directory')) + url = '/python.org/..%2f..%2f..%2f..%2f..%2f../%0a%0d/../' + self.tempdir_name + '/existing_directory' + expected_location = url + '/' # /python.org.../ single slash single prefix, trailing slash + # Canonicalizes to /tmp/tempdir_name/existing_directory which does + # exist and is a dir, triggering the 301 redirect logic. + response = self.request(url) + self.check_status_and_reason(response, 301) + location = response.getheader('Location') + self.assertEqual(location, expected_location, msg='non-attack failed!') + + # //python.org... multi-slash prefix, no trailing slash + attack_url = '/' + url + response = self.request(attack_url) + self.check_status_and_reason(response, 301) + location = response.getheader('Location') + self.assertFalse(location.startswith('//'), msg=location) + self.assertEqual(location, expected_location, + msg='Expected Location header to start with a single / and ' + 'end with a / as this is a directory redirect.') + # ///python.org... triple-slash prefix, no trailing slash + attack3_url = '//' + url + response = self.request(attack3_url) + self.check_status_and_reason(response, 301) + self.assertEqual(response.getheader('Location'), expected_location) + + # If the second word in the http request (Request-URI for the http + # method) is a full URI, we don't worry about it, as that'll be parsed + # and reassembled as a full URI within BaseHTTPRequestHandler.send_head + # so no errant scheme-less //netloc//evil.co/ domain mixup can happen. + attack_scheme_netloc_2slash_url = 'https://pypi.org/' + url + expected_scheme_netloc_location = attack_scheme_netloc_2slash_url + '/' + response = self.request(attack_scheme_netloc_2slash_url) + self.check_status_and_reason(response, 301) + location = response.getheader('Location') + # We're just ensuring that the scheme and domain make it through, if + # there are or aren't multiple slashes at the start of the path that + # follows that isn't important in this Location: header. + self.assertTrue(location.startswith('https://pypi.org/'), msg=location) + cgi_file1 = """\ #!%s
