Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=0638fb4970c28c0026f116e65bbb988b11f02e5a
commit 0638fb4970c28c0026f116e65bbb988b11f02e5a Author: kikadf <[email protected]> Date: Thu Aug 28 09:03:55 2014 +0200 ipython-1.0.0-2arcturus1-x86_64 * Fix CVE-2014-3429 diff --git a/source/devel-extra/ipython/CVE-2014-3429.patch b/source/devel-extra/ipython/CVE-2014-3429.patch new file mode 100644 index 0000000..6dd56fc --- /dev/null +++ b/source/devel-extra/ipython/CVE-2014-3429.patch @@ -0,0 +1,65 @@ +Index: ipython-1.1.0/IPython/html/base/zmqhandlers.py +=================================================================== +--- ipython-1.1.0.orig/IPython/html/base/zmqhandlers.py 2014-08-07 16:03:13.331603969 +0200 ++++ ipython-1.1.0/IPython/html/base/zmqhandlers.py 2014-08-07 16:53:08.041133824 +0200 +@@ -21,6 +21,11 @@ + from tornado import web + from tornado import websocket + ++try: ++ from urllib.parse import urlparse # Py3 ++except ImportError: ++ from urlparse import urlparse # Py2 ++ + from zmq.utils import jsonapi + + from IPython.kernel.zmq.session import Session +@@ -35,6 +40,29 @@ + + class ZMQStreamHandler(websocket.WebSocketHandler): + ++ def same_origin(self): ++ """Check to see that origin and host match in the headers.""" ++ ++ # The difference between version 8 and 13 is that in 8 the ++ # client sends a "Sec-Websocket-Origin" header and in 13 it's ++ # simply "Origin". ++ if self.request.headers.get("Sec-WebSocket-Version") in ("7", "8"): ++ origin_header = self.request.headers.get("Sec-Websocket-Origin") ++ else: ++ origin_header = self.request.headers.get("Origin") ++ ++ host = self.request.headers.get("Host") ++ ++ # If no header is provided, assume we can't verify origin ++ if(origin_header is None or host is None): ++ return False ++ ++ parsed_origin = urlparse(origin_header) ++ origin = parsed_origin.netloc ++ ++ # Check to see that origin matches host directly, including ports ++ return origin == host ++ + def clear_cookie(self, *args, **kwargs): + """meaningless for websockets""" + pass +@@ -83,6 +111,11 @@ + class AuthenticatedZMQStreamHandler(ZMQStreamHandler, IPythonHandler): + + def open(self, kernel_id): ++ # Check to see that origin matches host directly, including ports ++ if not self.same_origin(): ++ self.log.warn("Cross Origin WebSocket Attempt.") ++ raise web.HTTPError(404) ++ + self.kernel_id = cast_unicode(kernel_id, 'ascii') + self.session = Session(config=self.config) + self.save_on_message = self.on_message +@@ -111,4 +144,4 @@ + if self.get_current_user() is None: + self.log.warn("Couldn't authenticate WebSocket connection") + raise web.HTTPError(403) +- self.on_message = self.save_on_message +\ No newline at end of file ++ self.on_message = self.save_on_message diff --git a/source/devel-extra/ipython/FrugalBuild b/source/devel-extra/ipython/FrugalBuild index 2f5ac78..112c6a3 100644 --- a/source/devel-extra/ipython/FrugalBuild +++ b/source/devel-extra/ipython/FrugalBuild @@ -3,7 +3,7 @@ pkgname=ipython pkgver=1.0.0 -pkgrel=1 +pkgrel=2arcturus1 pkgdesc="An enhanced Interactive Python shell." url="http://ipython.org/"; license="custom" @@ -12,3 +12,10 @@ groups=('devel-extra') archs=('i686' 'x86_64') Finclude pypi sha1sums=('a1b3033953e47027c9409e9c33c90c6a79ff640c') + +# FSA fix *** +source=(${source[@]} CVE-2014-3429.patch) +sha1sums=(${sha1sums[@]} '0d39c84a993746f1d249172cfb726a97fc5cad7f') +# *********** + + _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
