diff --git a/00209-CVE-2016-5636-buffer-overflow-in-zipimport-module-fix.patch b/00209-CVE-2016-5636-buffer-overflow-in-zipimport-module-fix.patch deleted file mode 100644 index e2c8581..0000000 --- a/00209-CVE-2016-5636-buffer-overflow-in-zipimport-module-fix.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 531dfa4bcfe55d5cd1524425944b07c5b02bddf9 Mon Sep 17 00:00:00 2001 -From: Charalampos Stratakis -Date: Fri, 8 Jul 2016 17:16:41 +0200 -Subject: [PATCH] CVE-2016-5636 fix - ---- - Modules/zipimport.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/Modules/zipimport.c b/Modules/zipimport.c -index 06abb31..4d0d1de 100644 ---- a/Modules/zipimport.c -+++ b/Modules/zipimport.c -@@ -1076,6 +1076,10 @@ get_data(PyObject *archive, PyObject *toc_entry) - &date, &crc)) { - return NULL; - } -+ if (data_size < 0) { -+ PyErr_Format(ZipImportError, "negative data size"); -+ return NULL; -+ } - - fp = _Py_fopen_obj(archive, "rb"); - if (!fp) -@@ -1112,6 +1116,11 @@ get_data(PyObject *archive, PyObject *toc_entry) - } - file_offset += l; /* Start of file data */ - -+ if (data_size > LONG_MAX - 1) { -+ fclose(fp); -+ PyErr_NoMemory(); -+ return NULL; -+ } - bytes_size = compress == 0 ? data_size : data_size + 1; - if (bytes_size == 0) - bytes_size++; --- -2.7.4 - diff --git a/00209-fix-test-pyexpat-failure.patch b/00209-fix-test-pyexpat-failure.patch new file mode 100644 index 0000000..7b40280 --- /dev/null +++ b/00209-fix-test-pyexpat-failure.patch @@ -0,0 +1,17 @@ +diff -r 682a8e36dd18 Lib/test/test_pyexpat.py +--- a/Lib/test/test_pyexpat.py Tue Jul 05 17:08:52 2016 +0300 ++++ b/Lib/test/test_pyexpat.py Thu Jul 07 17:04:35 2016 +0800 +@@ -656,11 +656,9 @@ + # \xc2\x85 is UTF-8 encoded U+0085 (NEXT LINE) + xml = b"\r\n" + parser = expat.ParserCreate() +- try: ++ err_pattern = r'XML declaration not well-formed: line 1, column \d+' ++ with self.assertRaisesRegex(expat.ExpatError, err_pattern): + parser.Parse(xml, True) +- self.fail() +- except expat.ExpatError as e: +- self.assertEqual(str(e), 'XML declaration not well-formed: line 1, column 14') + + class ErrorMessageTest(unittest.TestCase): + def test_codes(self): diff --git a/00210-Raise-an-error-when-STARTTLS-fails.patch b/00210-Raise-an-error-when-STARTTLS-fails.patch deleted file mode 100644 index 9083e61..0000000 --- a/00210-Raise-an-error-when-STARTTLS-fails.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 761db274ca898f8a92348ed5979d3d3c1b0d634a Mon Sep 17 00:00:00 2001 -From: Tomas Orsava -Date: Fri, 17 Jun 2016 16:08:11 +0200 -Subject: [PATCH] Raise an error when STARTTLS fails - -CVE-2016-0772 python: smtplib StartTLS stripping attack -rhbz#1303647: https://bugzilla.redhat.com/show_bug.cgi?id=1303647 -rhbz#1346345: https://bugzilla.redhat.com/show_bug.cgi?id=1346345 - -Based on an upstream change by Benjamin Peterson -- in changeset 101887:d590114c2394 3.4 -- https://hg.python.org/cpython/rev/d590114c2394 ---- - Lib/smtplib.py | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/Lib/smtplib.py b/Lib/smtplib.py -index 4756973..dfbf5f9 100755 ---- a/Lib/smtplib.py -+++ b/Lib/smtplib.py -@@ -773,6 +773,11 @@ class SMTP: - self.ehlo_resp = None - self.esmtp_features = {} - self.does_esmtp = 0 -+ else: -+ # RFC 3207: -+ # 501 Syntax error (no parameters allowed) -+ # 454 TLS not available due to temporary reason -+ raise SMTPResponseException(resp, reply) - return (resp, reply) - - def sendmail(self, from_addr, to_addrs, msg, mail_options=[], --- -2.5.5 - diff --git a/00211-fix-test-pyexpat-failure.patch b/00211-fix-test-pyexpat-failure.patch deleted file mode 100644 index 7b40280..0000000 --- a/00211-fix-test-pyexpat-failure.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff -r 682a8e36dd18 Lib/test/test_pyexpat.py ---- a/Lib/test/test_pyexpat.py Tue Jul 05 17:08:52 2016 +0300 -+++ b/Lib/test/test_pyexpat.py Thu Jul 07 17:04:35 2016 +0800 -@@ -656,11 +656,9 @@ - # \xc2\x85 is UTF-8 encoded U+0085 (NEXT LINE) - xml = b"\r\n" - parser = expat.ParserCreate() -- try: -+ err_pattern = r'XML declaration not well-formed: line 1, column \d+' -+ with self.assertRaisesRegex(expat.ExpatError, err_pattern): - parser.Parse(xml, True) -- self.fail() -- except expat.ExpatError as e: -- self.assertEqual(str(e), 'XML declaration not well-formed: line 1, column 14') - - class ErrorMessageTest(unittest.TestCase): - def test_codes(self): diff --git a/00237-Raise-an-error-when-STARTTLS-fails.patch b/00237-Raise-an-error-when-STARTTLS-fails.patch new file mode 100644 index 0000000..9083e61 --- /dev/null +++ b/00237-Raise-an-error-when-STARTTLS-fails.patch @@ -0,0 +1,35 @@ +From 761db274ca898f8a92348ed5979d3d3c1b0d634a Mon Sep 17 00:00:00 2001 +From: Tomas Orsava +Date: Fri, 17 Jun 2016 16:08:11 +0200 +Subject: [PATCH] Raise an error when STARTTLS fails + +CVE-2016-0772 python: smtplib StartTLS stripping attack +rhbz#1303647: https://bugzilla.redhat.com/show_bug.cgi?id=1303647 +rhbz#1346345: https://bugzilla.redhat.com/show_bug.cgi?id=1346345 + +Based on an upstream change by Benjamin Peterson +- in changeset 101887:d590114c2394 3.4 +- https://hg.python.org/cpython/rev/d590114c2394 +--- + Lib/smtplib.py | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/Lib/smtplib.py b/Lib/smtplib.py +index 4756973..dfbf5f9 100755 +--- a/Lib/smtplib.py ++++ b/Lib/smtplib.py +@@ -773,6 +773,11 @@ class SMTP: + self.ehlo_resp = None + self.esmtp_features = {} + self.does_esmtp = 0 ++ else: ++ # RFC 3207: ++ # 501 Syntax error (no parameters allowed) ++ # 454 TLS not available due to temporary reason ++ raise SMTPResponseException(resp, reply) + return (resp, reply) + + def sendmail(self, from_addr, to_addrs, msg, mail_options=[], +-- +2.5.5 + diff --git a/00241-CVE-2016-5636-buffer-overflow-in-zipimport-module-fix.patch b/00241-CVE-2016-5636-buffer-overflow-in-zipimport-module-fix.patch new file mode 100644 index 0000000..e2c8581 --- /dev/null +++ b/00241-CVE-2016-5636-buffer-overflow-in-zipimport-module-fix.patch @@ -0,0 +1,39 @@ +From 531dfa4bcfe55d5cd1524425944b07c5b02bddf9 Mon Sep 17 00:00:00 2001 +From: Charalampos Stratakis +Date: Fri, 8 Jul 2016 17:16:41 +0200 +Subject: [PATCH] CVE-2016-5636 fix + +--- + Modules/zipimport.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/Modules/zipimport.c b/Modules/zipimport.c +index 06abb31..4d0d1de 100644 +--- a/Modules/zipimport.c ++++ b/Modules/zipimport.c +@@ -1076,6 +1076,10 @@ get_data(PyObject *archive, PyObject *toc_entry) + &date, &crc)) { + return NULL; + } ++ if (data_size < 0) { ++ PyErr_Format(ZipImportError, "negative data size"); ++ return NULL; ++ } + + fp = _Py_fopen_obj(archive, "rb"); + if (!fp) +@@ -1112,6 +1116,11 @@ get_data(PyObject *archive, PyObject *toc_entry) + } + file_offset += l; /* Start of file data */ + ++ if (data_size > LONG_MAX - 1) { ++ fclose(fp); ++ PyErr_NoMemory(); ++ return NULL; ++ } + bytes_size = compress == 0 ? data_size : data_size + 1; + if (bytes_size == 0) + bytes_size++; +-- +2.7.4 + diff --git a/00242-CVE-2016-1000110-httpoxy.patch b/00242-CVE-2016-1000110-httpoxy.patch new file mode 100644 index 0000000..7c17b31 --- /dev/null +++ b/00242-CVE-2016-1000110-httpoxy.patch @@ -0,0 +1,100 @@ + +# HG changeset patch +# User Senthil Kumaran +# Date 1469947146 25200 +# Node ID a0ac52ed8f7918222603b584ec8fc93d9b7bc0a5 +# Parent 4cb94e561e2db9865fb4d752f2bceefca4c6819a# Parent 3c19023c9fec5a615c25598468b44fade89049ce +[merge from 3.4] - Prevent HTTPoxy attack (CVE-2016-1000110) + +Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which +indicates that the script is in CGI mode. + +Issue #27568 Reported and patch contributed by Rémi Rampin. + +diff --git a/Doc/howto/urllib2.rst b/Doc/howto/urllib2.rst +--- a/Doc/howto/urllib2.rst ++++ b/Doc/howto/urllib2.rst +@@ -538,6 +538,11 @@ setting up a `Basic Authentication`_ han + through a proxy. However, this can be enabled by extending urllib.request as + shown in the recipe [#]_. + ++.. note:: ++ ++ ``HTTP_PROXY`` will be ignored if a variable ``REQUEST_METHOD`` is set; see ++ the documentation on :func:`~urllib.request.getproxies`. ++ + + Sockets and Layers + ================== +diff --git a/Doc/library/urllib.request.rst b/Doc/library/urllib.request.rst +--- a/Doc/library/urllib.request.rst ++++ b/Doc/library/urllib.request.rst +@@ -166,6 +166,16 @@ The :mod:`urllib.request` module defines the following functions: + cannot find it, looks for proxy information from Mac OSX System + Configuration for Mac OS X and Windows Systems Registry for Windows. + ++ .. note:: ++ ++ If the environment variable ``REQUEST_METHOD`` is set, which usually ++ indicates your script is running in a CGI environment, the environment ++ variable ``HTTP_PROXY`` (uppercase ``_PROXY``) will be ignored. This is ++ because that variable can be injected by a client using the "Proxy:" HTTP ++ header. If you need to use an HTTP proxy in a CGI environment, either use ++ ``ProxyHandler`` explicitly, or make sure the variable name is in ++ lowercase (or at least the ``_proxy`` suffix). ++ + + The following classes are provided: + +@@ -275,6 +285,12 @@ The following classes are provided: + + To disable autodetected proxy pass an empty dictionary. + ++ .. note:: ++ ++ ``HTTP_PROXY`` will be ignored if a variable ``REQUEST_METHOD`` is set; ++ see the documentation on :func:`~urllib.request.getproxies`. ++ ++ + + .. class:: HTTPPasswordMgr() + +diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py +--- a/Lib/test/test_urllib.py ++++ b/Lib/test/test_urllib.py +@@ -225,6 +225,18 @@ class ProxyTests(unittest.TestCase): + self.env.set('NO_PROXY', 'localhost, anotherdomain.com, newdomain.com') + self.assertTrue(urllib.request.proxy_bypass_environment('anotherdomain.com')) + ++ def test_proxy_cgi_ignore(self): ++ try: ++ self.env.set('HTTP_PROXY', 'http://somewhere:3128') ++ proxies = urllib.request.getproxies_environment() ++ self.assertEqual('http://somewhere:3128', proxies['http']) ++ self.env.set('REQUEST_METHOD', 'GET') ++ proxies = urllib.request.getproxies_environment() ++ self.assertNotIn('http', proxies) ++ finally: ++ self.env.unset('REQUEST_METHOD') ++ self.env.unset('HTTP_PROXY') ++ + class urlopen_HttpTests(unittest.TestCase, FakeHTTPMixin, FakeFTPMixin): + """Test urlopen() opening a fake http connection.""" + +diff --git a/Lib/urllib/request.py b/Lib/urllib/request.py +--- a/Lib/urllib/request.py ++++ b/Lib/urllib/request.py +@@ -2394,6 +2394,12 @@ def getproxies_environment(): + name = name.lower() + if value and name[-6:] == '_proxy': + proxies[name[:-6]] = value ++ # CVE-2016-1000110 - If we are running as CGI script, forget HTTP_PROXY ++ # (non-all-lowercase) as it may be set from the web server by a "Proxy:" ++ # header from the client ++ # If "proxy" is lowercase, it will still be used thanks to the next block ++ if 'REQUEST_METHOD' in os.environ: ++ proxies.pop('http', None) + return proxies + + def proxy_bypass_environment(host): + diff --git a/00242-fix-mips64-triplet.patch b/00242-fix-mips64-triplet.patch deleted file mode 100644 index 91bf6af..0000000 --- a/00242-fix-mips64-triplet.patch +++ /dev/null @@ -1,42 +0,0 @@ -diff -urp Python-3.5.0/configure p/configure ---- Python-3.5.0/configure 2016-02-25 16:12:12.615184011 +0000 -+++ p/configure 2016-02-25 16:13:01.293412517 +0000 -@@ -5133,7 +5133,7 @@ cat >> conftest.c <> conftest.c <> conftest.c <> conftest.c <> conftest.c <> conftest.c <> conftest.c <> conftest.c < - 3.5.1-15 +- Fix for CVE-2016-1000110 HTTPoxy attack +- SPEC file cleanup + * Mon Aug 01 2016 Michal Toman - 3.5.1-14 - Build properly on MIPS