-
Notifications
You must be signed in to change notification settings - Fork 567
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
5bc0e1c
commit ec10c43
Showing
6 changed files
with
82 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| From 753e79fd29bd6242575330d702caa95bc0a9f569 Mon Sep 17 00:00:00 2001 | ||
| From: Kanishk Bansal <[email protected]> | ||
| Date: Thu, 6 Feb 2025 18:45:06 +0000 | ||
| Subject: [PATCH] Address CVE-2025-0938 | ||
|
|
||
| --- | ||
| Lib/urllib/parse.py | 20 ++++++++++++++++++-- | ||
| 1 file changed, 18 insertions(+), 2 deletions(-) | ||
|
|
||
| diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py | ||
| index 2eb3448..dc0b71f 100644 | ||
| --- a/Lib/urllib/parse.py | ||
| +++ b/Lib/urllib/parse.py | ||
| @@ -443,6 +443,23 @@ def _checknetloc(netloc): | ||
| raise ValueError("netloc '" + netloc + "' contains invalid " + | ||
| "characters under NFKC normalization") | ||
|
|
||
| +def _check_bracketed_netloc(netloc): | ||
| + # Note that this function must mirror the splitting | ||
| + # done in NetlocResultMixins._hostinfo(). | ||
| + hostname_and_port = netloc.rpartition('@')[2] | ||
| + before_bracket, have_open_br, bracketed = hostname_and_port.partition('[') | ||
| + if have_open_br: | ||
| + # No data is allowed before a bracket. | ||
| + if before_bracket: | ||
| + raise ValueError("Invalid IPv6 URL") | ||
| + hostname, _, port = bracketed.partition(']') | ||
| + # No data is allowed after the bracket but before the port delimiter. | ||
| + if port and not port.startswith(":"): | ||
| + raise ValueError("Invalid IPv6 URL") | ||
| + else: | ||
| + hostname, _, port = hostname_and_port.partition(':') | ||
| + _check_bracketed_host(hostname) | ||
| + | ||
| # Valid bracketed hosts are defined in | ||
| # https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/ | ||
| def _check_bracketed_host(hostname): | ||
| @@ -506,8 +523,7 @@ def urlsplit(url, scheme='', allow_fragments=True): | ||
| (']' in netloc and '[' not in netloc)): | ||
| raise ValueError("Invalid IPv6 URL") | ||
| if '[' in netloc and ']' in netloc: | ||
| - bracketed_host = netloc.partition('[')[2].partition(']')[0] | ||
| - _check_bracketed_host(bracketed_host) | ||
| + _check_bracketed_netloc(netloc) | ||
| if allow_fragments and '#' in url: | ||
| url, fragment = url.split('#', 1) | ||
| if '?' in url: | ||
| -- | ||
| 2.43.0 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -12,7 +12,7 @@ | |
| Summary: A high-level scripting language | ||
| Name: python3 | ||
| Version: 3.9.19 | ||
| Release: 8%{?dist} | ||
| Release: 9%{?dist} | ||
| License: PSF | ||
| Vendor: Microsoft Corporation | ||
| Distribution: Mariner | ||
|
|
@@ -29,6 +29,7 @@ Patch5: CVE-2024-8088.patch | |
| Patch6: CVE-2024-4032.patch | ||
| Patch7: CVE-2024-11168.patch | ||
| Patch8: CVE-2024-6923.patch | ||
| Patch9: CVE-2025-0938.patch | ||
| # Patch for setuptools, resolved in 65.5.1 | ||
| Patch1000: CVE-2022-40897.patch | ||
| Patch1001: CVE-2024-6345.patch | ||
|
|
@@ -175,6 +176,7 @@ The test package contains all regression tests for Python as well as the modules | |
| %patch6 -p1 | ||
| %patch7 -p1 | ||
| %patch8 -p1 | ||
| %patch9 -p1 | ||
|
|
||
| %build | ||
| # Remove GCC specs and build environment linker scripts | ||
|
|
@@ -330,6 +332,9 @@ rm -rf %{buildroot}%{_bindir}/__pycache__ | |
| %{_libdir}/python%{majmin}/test/* | ||
|
|
||
| %changelog | ||
| * Thu Feb 06 2025 Kanishk Bansal <[email protected]> - 3.9.19-9 | ||
| - Patch CVE-2025-0938 | ||
|
|
||
| * Thu Nov 28 2024 Kanishk Bansal <[email protected]> - 3.9.19-8 | ||
| - Address CVE-2024-6923 | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters