Hello community, here is the log from the commit of package python for openSUSE:Factory checked in at 2019-10-22 15:36:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python (Old) and /work/SRC/openSUSE:Factory/.python.new.2352 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python" Tue Oct 22 15:36:52 2019 rev:142 rq:736441 version:2.7.16 Changes: -------- --- /work/SRC/openSUSE:Factory/python/python-base.changes 2019-10-05 16:20:02.625478073 +0200 +++ /work/SRC/openSUSE:Factory/.python.new.2352/python-base.changes 2019-10-22 15:36:53.485133015 +0200 @@ -1,0 +2,7 @@ +Tue Oct 8 19:46:52 CEST 2019 - Matej Cepl <[email protected]> + +- Add CVE-2019-16935-xmlrpc-doc-server_title.patch fixing + bsc#1153238 (aka CVE-2019-16935) fixing a reflected XSS in + python/Lib/DocXMLRPCServer.py + +------------------------------------------------------------------- python.changes: same change New: ---- CVE-2019-16935-xmlrpc-doc-server_title.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-base.spec ++++++ --- /var/tmp/diff_new_pack.dll3ii/_old 2019-10-22 15:36:54.885134562 +0200 +++ /var/tmp/diff_new_pack.dll3ii/_new 2019-10-22 15:36:54.885134562 +0200 @@ -86,6 +86,9 @@ Patch54: CVE-2018-20852-cookie-domain-check.patch # PATCH-FIX-UPSTREAM https://github.com/python/cpython/pull/12341 Patch55: bpo36302-sort-module-sources.patch +# PATCH-FIX-UPSTREAM CVE-2019-16935-xmlrpc-doc-server_title.patch bsc#1153238 [email protected] +# XSS vulnerability in the documentation XML-RPC server in server_title field +Patch56: CVE-2019-16935-xmlrpc-doc-server_title.patch # COMMON-PATCH-END %define python_version %(echo %{tarversion} | head -c 3) BuildRequires: automake @@ -202,6 +205,7 @@ %patch53 -p1 %patch54 -p1 %patch55 -p1 +%patch56 -p1 # drop Autoconf version requirement sed -i 's/^version_required/dnl version_required/' configure.ac ++++++ python-doc.spec ++++++ --- /var/tmp/diff_new_pack.dll3ii/_old 2019-10-22 15:36:54.901134580 +0200 +++ /var/tmp/diff_new_pack.dll3ii/_new 2019-10-22 15:36:54.905134584 +0200 @@ -15,6 +15,7 @@ # Please submit bugfixes or comments via https://bugs.opensuse.org/ # + Name: python-doc Version: 2.7.16 Release: 0 @@ -85,6 +86,9 @@ Patch54: CVE-2018-20852-cookie-domain-check.patch # PATCH-FIX-UPSTREAM https://github.com/python/cpython/pull/12341 Patch55: bpo36302-sort-module-sources.patch +# PATCH-FIX-UPSTREAM CVE-2019-16935-xmlrpc-doc-server_title.patch bsc#1153238 [email protected] +# XSS vulnerability in the documentation XML-RPC server in server_title field +Patch56: CVE-2019-16935-xmlrpc-doc-server_title.patch # COMMON-PATCH-END Provides: pyth_doc Provides: pyth_ps @@ -147,6 +151,7 @@ %patch53 -p1 %patch54 -p1 %patch55 -p1 +%patch56 -p1 # drop Autoconf version requirement sed -i 's/^version_required/dnl version_required/' configure.ac ++++++ python.spec ++++++ --- /var/tmp/diff_new_pack.dll3ii/_old 2019-10-22 15:36:54.921134601 +0200 +++ /var/tmp/diff_new_pack.dll3ii/_new 2019-10-22 15:36:54.925134607 +0200 @@ -15,6 +15,7 @@ # Please submit bugfixes or comments via https://bugs.opensuse.org/ # + Name: python Version: 2.7.16 Release: 0 @@ -90,6 +91,9 @@ Patch54: CVE-2018-20852-cookie-domain-check.patch # PATCH-FIX-UPSTREAM https://github.com/python/cpython/pull/12341 Patch55: bpo36302-sort-module-sources.patch +# PATCH-FIX-UPSTREAM CVE-2019-16935-xmlrpc-doc-server_title.patch bsc#1153238 [email protected] +# XSS vulnerability in the documentation XML-RPC server in server_title field +Patch56: CVE-2019-16935-xmlrpc-doc-server_title.patch # COMMON-PATCH-END BuildRequires: automake BuildRequires: db-devel @@ -252,6 +256,7 @@ %patch53 -p1 %patch54 -p1 %patch55 -p1 +%patch56 -p1 # drop Autoconf version requirement sed -i 's/^version_required/dnl version_required/' configure.ac ++++++ CVE-2019-16935-xmlrpc-doc-server_title.patch ++++++ >From b41cde823d026f2adc21ef14b1c2e92b1006de06 Mon Sep 17 00:00:00 2001 From: Dong-hee Na <[email protected]> Date: Sat, 28 Sep 2019 10:17:25 +0900 Subject: [PATCH 1/3] [2.7] bpo-38243: Escape the server title of DocXMLRPCServer when rendering --- a/Lib/DocXMLRPCServer.py +++ b/Lib/DocXMLRPCServer.py @@ -20,6 +20,16 @@ from SimpleXMLRPCServer import (SimpleXM CGIXMLRPCRequestHandler, resolve_dotted_attribute) + +def _html_escape_quote(s): + s = s.replace("&", "&") # Must be done first! + s = s.replace("<", "<") + s = s.replace(">", ">") + s = s.replace('"', """) + s = s.replace('\'', "'") + return s + + class ServerHTMLDoc(pydoc.HTMLDoc): """Class used to generate pydoc HTML document for a server""" @@ -210,7 +220,8 @@ class XMLRPCDocGenerator: methods ) - return documenter.page(self.server_title, documentation) + title = _html_escape_quote(self.server_title) + return documenter.page(title, documentation) class DocXMLRPCRequestHandler(SimpleXMLRPCRequestHandler): """XML-RPC and documentation request handler class. --- a/Lib/test/test_docxmlrpc.py +++ b/Lib/test/test_docxmlrpc.py @@ -1,5 +1,6 @@ from DocXMLRPCServer import DocXMLRPCServer import httplib +import re import sys from test import test_support threading = test_support.import_module('threading') @@ -176,6 +177,25 @@ class DocXMLRPCHTTPGETServer(unittest.Te self.assertIn("""Try self.<strong>add</strong>, too.""", response.read()) + def test_server_title_escape(self): + """Test that the server title and documentation + are escaped for HTML. + """ + self.serv.set_server_title('test_title<script>') + self.serv.set_server_documentation('test_documentation<script>') + self.assertEqual('test_title<script>', self.serv.server_title) + self.assertEqual('test_documentation<script>', + self.serv.server_documentation) + + generated = self.serv.generate_html_documentation() + title = re.search(r'<title>(.+?)</title>', generated).group() + documentation = re.search(r'<p><tt>(.+?)</tt></p>', generated).group() + self.assertEqual('<title>Python: test_title<script></title>', + title) + self.assertEqual('<p><tt>test_documentation<script></tt></p>', + documentation) + + def test_main(): test_support.run_unittest(DocXMLRPCHTTPGETServer) --- /dev/null +++ b/Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst @@ -0,0 +1,3 @@ +Escape the server title of :class:`DocXMLRPCServer.DocXMLRPCServer` +when rendering the document page as HTML. +(Contributed by Dong-hee Na in :issue:`38243`.)
