Hello community, here is the log from the commit of package python for openSUSE:Factory checked in at 2019-07-30 13:03:27 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python (Old) and /work/SRC/openSUSE:Factory/.python.new.4126 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python" Tue Jul 30 13:03:27 2019 rev:139 rq:717087 version:2.7.16 Changes: -------- --- /work/SRC/openSUSE:Factory/python/python-base.changes 2019-06-24 21:44:46.923718456 +0200 +++ /work/SRC/openSUSE:Factory/.python.new.4126/python-base.changes 2019-07-30 13:03:31.150412929 +0200 @@ -1,0 +2,14 @@ +Fri Jul 19 13:28:16 CEST 2019 - Matej Cepl <[email protected]> + +- boo#1141853 (CVE-2018-20852) add + CVE-2018-20852-cookie-domain-check.patch fixing + http.cookiejar.DefaultPolicy.domain_return_ok which did not + correctly validate the domain: it could be tricked into sending + cookies to the wrong server. + +------------------------------------------------------------------- +Fri Jul 19 11:19:42 UTC 2019 - Tomáš Chvátal <[email protected]> + +- Skip test_urllib2_localnet that randomly fails in OBS + +------------------------------------------------------------------- --- /work/SRC/openSUSE:Factory/python/python.changes 2019-06-24 21:44:47.191718606 +0200 +++ /work/SRC/openSUSE:Factory/.python.new.4126/python.changes 2019-07-30 13:03:31.278412903 +0200 @@ -1,0 +2,5 @@ +Fri Jul 19 11:19:42 UTC 2019 - Tomáš Chvátal <[email protected]> + +- Skip test_urllib2_localnet that randomly fails in OBS + +------------------------------------------------------------------- New: ---- CVE-2018-20852-cookie-domain-check.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-base.spec ++++++ --- /var/tmp/diff_new_pack.H68e9p/_old 2019-07-30 13:03:34.506412254 +0200 +++ /var/tmp/diff_new_pack.H68e9p/_new 2019-07-30 13:03:34.510412253 +0200 @@ -81,6 +81,9 @@ # PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 [email protected] # bpo#30458: Disallow control chars in http URLs. Patch53: CVE-2019-9947-no-ctrl-char-http.patch +# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 [email protected] +# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain +Patch54: CVE-2018-20852-cookie-domain-check.patch # COMMON-PATCH-END %define python_version %(echo %{tarversion} | head -c 3) BuildRequires: automake @@ -195,6 +198,7 @@ %patch51 -p1 %patch52 -p1 %patch53 -p1 +%patch54 -p1 # drop Autoconf version requirement sed -i 's/^version_required/dnl version_required/' configure.ac @@ -235,7 +239,8 @@ %ifnarch hppa # test_file(2k) fails in autobuild env - "stdin.seek(-1)" wrongly succeeds. probably an issue with autobuild's stdin # test_urllib2 relies on being able to resolve local address, which is notoriously impossible in autobuild -EXCLUDE="test_urllib2 test_file test_file2k" +# test_urllib2_localnet randomly fails out +EXCLUDE="test_urllib2 test_urllib2_localnet test_file test_file2k" # test_nis and test_threading are AWFULLY slow. EXCLUDE="$EXCLUDE test_nis test_threading" # test_gdb fails if gdb with (different) python support is part of the buildsystem ++++++ python-doc.spec ++++++ --- /var/tmp/diff_new_pack.H68e9p/_old 2019-07-30 13:03:34.522412250 +0200 +++ /var/tmp/diff_new_pack.H68e9p/_new 2019-07-30 13:03:34.526412249 +0200 @@ -81,6 +81,9 @@ # PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 [email protected] # bpo#30458: Disallow control chars in http URLs. Patch53: CVE-2019-9947-no-ctrl-char-http.patch +# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 [email protected] +# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain +Patch54: CVE-2018-20852-cookie-domain-check.patch # COMMON-PATCH-END Provides: pyth_doc Provides: pyth_ps @@ -141,6 +144,7 @@ %patch51 -p1 %patch52 -p1 %patch53 -p1 +%patch54 -p1 # drop Autoconf version requirement sed -i 's/^version_required/dnl version_required/' configure.ac ++++++ python.spec ++++++ --- /var/tmp/diff_new_pack.H68e9p/_old 2019-07-30 13:03:34.542412246 +0200 +++ /var/tmp/diff_new_pack.H68e9p/_new 2019-07-30 13:03:34.546412246 +0200 @@ -86,6 +86,9 @@ # PATCH-FIX-UPSTREAM CVE-2019-9947-no-ctrl-char-http.patch bsc#1130840 [email protected] # bpo#30458: Disallow control chars in http URLs. Patch53: CVE-2019-9947-no-ctrl-char-http.patch +# PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 [email protected] +# http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain +Patch54: CVE-2018-20852-cookie-domain-check.patch # COMMON-PATCH-END BuildRequires: automake BuildRequires: db-devel @@ -247,6 +250,7 @@ %patch51 -p1 %patch52 -p1 %patch53 -p1 +%patch54 -p1 # drop Autoconf version requirement sed -i 's/^version_required/dnl version_required/' configure.ac @@ -284,7 +288,7 @@ if test $(ulimit -v) = unlimited || test $(ulimit -v) -gt 10000000; then ulimit -v 10000000 || : fi -LIST="test_urllib test_ssl test_hashlib test_hmac test_urllib2_localnet test_unicodedata test_tarfile test_sqlite test_tcl test_dbm test_anydbm test_dumbdbm test_gdbm test_whichdb test_tk test_ttk_textonly test_bsddb test_bsddb3 test_readline" +LIST="test_urllib test_ssl test_hashlib test_hmac test_unicodedata test_tarfile test_sqlite test_tcl test_dbm test_anydbm test_dumbdbm test_gdbm test_whichdb test_tk test_ttk_textonly test_bsddb test_bsddb3 test_readline" make test TESTOPTS="$LIST" TESTPYTHONOPTS="-R" %endif ++++++ CVE-2018-20852-cookie-domain-check.patch ++++++ >From def9e64d6aee945c19d9dab896fa91e915d96843 Mon Sep 17 00:00:00 2001 From: Karthikeyan Singaravelan <[email protected]> Date: Mon, 20 May 2019 00:33:52 +0530 Subject: [PATCH] Prefix dot in domain for proper subdomain validation --- Lib/cookielib.py | 13 +++++++++++-- Lib/test/test_cookielib.py | 30 ++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 2 deletions(-) diff --git a/Lib/cookielib.py b/Lib/cookielib.py index 2dd7c48728e0..0b471a42f296 100644 --- a/Lib/cookielib.py +++ b/Lib/cookielib.py @@ -1139,6 +1139,11 @@ def return_ok_domain(self, cookie, request): req_host, erhn = eff_request_host(request) domain = cookie.domain + if domain and not domain.startswith("."): + dotdomain = "." + domain + else: + dotdomain = domain + # strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't if (cookie.version == 0 and (self.strict_ns_domain & self.DomainStrictNonDomain) and @@ -1151,7 +1156,7 @@ def return_ok_domain(self, cookie, request): _debug(" effective request-host name %s does not domain-match " "RFC 2965 cookie domain %s", erhn, domain) return False - if cookie.version == 0 and not ("."+erhn).endswith(domain): + if cookie.version == 0 and not ("."+erhn).endswith(dotdomain): _debug(" request-host %s does not match Netscape cookie domain " "%s", req_host, domain) return False @@ -1165,7 +1170,11 @@ def domain_return_ok(self, domain, request): req_host = "."+req_host if not erhn.startswith("."): erhn = "."+erhn - if not (req_host.endswith(domain) or erhn.endswith(domain)): + if domain and not domain.startswith("."): + dotdomain = "." + domain + else: + dotdomain = domain + if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)): #_debug(" request domain %s does not match cookie domain %s", # req_host, domain) return False diff --git a/Lib/test/test_cookielib.py b/Lib/test/test_cookielib.py index f2dd9727d137..7f7ff614d61d 100644 --- a/Lib/test/test_cookielib.py +++ b/Lib/test/test_cookielib.py @@ -368,6 +368,7 @@ def test_domain_return_ok(self): ("http://foo.bar.com/";, ".foo.bar.com", True), ("http://foo.bar.com/";, "foo.bar.com", True), ("http://foo.bar.com/";, ".bar.com", True), + ("http://foo.bar.com/";, "bar.com", True), ("http://foo.bar.com/";, "com", True), ("http://foo.com/";, "rhubarb.foo.com", False), ("http://foo.com/";, ".foo.com", True), @@ -378,6 +379,8 @@ def test_domain_return_ok(self): ("http://foo/";, "foo", True), ("http://foo/";, "foo.local", True), ("http://foo/";, ".local", True), + ("http://barfoo.com";, ".foo.com", False), + ("http://barfoo.com";, "foo.com", False), ]: request = urllib2.Request(url) r = pol.domain_return_ok(domain, request) @@ -938,6 +941,33 @@ def test_domain_block(self): c.add_cookie_header(req) self.assertFalse(req.has_header("Cookie")) + c.clear() + + pol.set_blocked_domains([]) + req = Request("http://acme.com/";) + res = FakeResponse(headers, "http://acme.com/";) + cookies = c.make_cookies(res, req) + c.extract_cookies(res, req) + self.assertEqual(len(c), 1) + + req = Request("http://acme.com/";) + c.add_cookie_header(req) + self.assertTrue(req.has_header("Cookie")) + + req = Request("http://badacme.com/";) + c.add_cookie_header(req) + self.assertFalse(pol.return_ok(cookies[0], req)) + self.assertFalse(req.has_header("Cookie")) + + p = pol.set_blocked_domains(["acme.com"]) + req = Request("http://acme.com/";) + c.add_cookie_header(req) + self.assertFalse(req.has_header("Cookie")) + + req = Request("http://badacme.com/";) + c.add_cookie_header(req) + self.assertFalse(req.has_header("Cookie")) + def test_secure(self): from cookielib import CookieJar, DefaultCookiePolicy
