Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-configobj for
openSUSE:Factory checked in at 2023-09-06 18:55:53
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-configobj (Old)
and /work/SRC/openSUSE:Factory/.python-configobj.new.1766 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-configobj"
Wed Sep 6 18:55:53 2023 rev:23 rq:1108906 version:5.0.8
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-configobj/python-configobj.changes
2023-07-06 18:28:03.102916935 +0200
+++
/work/SRC/openSUSE:Factory/.python-configobj.new.1766/python-configobj.changes
2023-09-06 18:56:43.172406560 +0200
@@ -7,0 +8,5 @@
+Tue Jul 4 10:51:42 UTC 2023 - Markéta Machová <mmach...@suse.com>
+
+- Add CVE-2023-26112.patch (bsc#1210070)
+
+-------------------------------------------------------------------
New:
----
CVE-2023-26112.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-configobj.spec ++++++
--- /var/tmp/diff_new_pack.5ePrEk/_old 2023-09-06 18:56:44.312447200 +0200
+++ /var/tmp/diff_new_pack.5ePrEk/_new 2023-09-06 18:56:44.316447343 +0200
@@ -26,9 +26,11 @@
Group: Development/Languages/Python
URL: https://github.com/DiffSK/configobj
Source:
https://files.pythonhosted.org/packages/source/c/configobj/configobj-%{version}.tar.gz
+# PATCH-FIX-UPSTREAM https://github.com/DiffSK/configobj/pull/236 Address
CVE-2023-26112 ReDoS
+Patch0: CVE-2023-26112.patch
# PATCH-FIX-UPSTREAM remove_six.patch gh#DiffSK/configobj#239 mc...@suse.com
# We don't need six anymore
-Patch0: remove_six.patch
+Patch1: remove_six.patch
BuildRequires: %{python_module pip}
BuildRequires: %{python_module wheel}
BuildRequires: fdupes
++++++ CVE-2023-26112.patch ++++++
>From a82ea8fb0338f2bd46cf627c4b763094448e6bd7 Mon Sep 17 00:00:00 2001
From: cdcadman <mythi...@gmail.com>
Date: Wed, 17 May 2023 03:57:08 -0700
Subject: [PATCH] Address CVE-2023-26112 ReDoS
---
src/configobj/validate.py | 2 +-
src/tests/test_validate_errors.py | 10 +++++++++-
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/validate.py b/validate.py
index 9267a3f..98d879f 100644
--- a/src/configobj/validate.py
+++ b/src/configobj/validate.py
@@ -541,7 +541,7 @@ class Validator(object):
"""
# this regex does the initial parsing of the checks
- _func_re = re.compile(r'(.+?)\((.*)\)', re.DOTALL)
+ _func_re = re.compile(r'([^\(\)]+?)\((.*)\)', re.DOTALL)
# this regex takes apart keyword arguments
_key_arg = re.compile(r'^([a-zA-Z_][a-zA-Z0-9_]*)\s*=\s*(.*)$', re.DOTALL)
