From bb43f032d1d29e0fa97feec4f3b2de7e8aeff48f Mon Sep 17 00:00:00 2001
From: Miro Hrončok <miro@hroncok.cz>
Date: Sep 21 2018 20:10:06 +0000
Subject: [PATCH 1/2] Add a workaround for broken %undefine __brp_python_bytecompile


See https://bugzilla.redhat.com/show_bug.cgi?id=1597664

---

diff --git a/python2.spec b/python2.spec
index 3274d34..5bb64ef 100644
--- a/python2.spec
+++ b/python2.spec
@@ -70,6 +70,10 @@
 # available in /usr/bin when Python is built. Also, the bytecompilation fails
 # on files that test invalid syntax.
 %undefine __brp_python_bytecompile
+# The above is broken now
+# https://bugzilla.redhat.com/show_bug.cgi?id=1597664
+# This is an older non-standard way to disable the brp script, as a workaround
+%undefine py_auto_byte_compile
 
 # We need to get a newer configure generated out of configure.in for the following
 # patches:

From 03772991a15a029fa00bd700d069951185e23218 Mon Sep 17 00:00:00 2001
From: Miro Hrončok <miro@hroncok.cz>
Date: Sep 21 2018 20:10:06 +0000
Subject: [PATCH 2/2] Security fix for CVE-2018-1000802 (#1631662)


---

diff --git a/00309-shutil-spawn-subprocess.patch b/00309-shutil-spawn-subprocess.patch
new file mode 100644
index 0000000..adc56c4
--- /dev/null
+++ b/00309-shutil-spawn-subprocess.patch
@@ -0,0 +1,61 @@
+From add531a1e55b0a739b0f42582f1c9747e5649ace Mon Sep 17 00:00:00 2001
+From: Benjamin Peterson <benjamin@python.org>
+Date: Tue, 28 Aug 2018 22:12:56 -0700
+Subject: [PATCH] closes bpo-34540: Convert shutil._call_external_zip to use
+ subprocess rather than distutils.spawn.
+
+---
+ Lib/shutil.py                                    | 16 ++++++++++------
+ .../2018-08-28-22-11-54.bpo-34540.gfQ0TM.rst     |  3 +++
+ 2 files changed, 13 insertions(+), 6 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2018-08-28-22-11-54.bpo-34540.gfQ0TM.rst
+
+diff --git a/Lib/shutil.py b/Lib/shutil.py
+index 3462f7c5e91c..0ab1a06f5260 100644
+--- a/Lib/shutil.py
++++ b/Lib/shutil.py
+@@ -413,17 +413,21 @@ def _set_uid_gid(tarinfo):
+ 
+     return archive_name
+ 
+-def _call_external_zip(base_dir, zip_filename, verbose=False, dry_run=False):
++def _call_external_zip(base_dir, zip_filename, verbose, dry_run, logger):
+     # XXX see if we want to keep an external call here
+     if verbose:
+         zipoptions = "-r"
+     else:
+         zipoptions = "-rq"
+-    from distutils.errors import DistutilsExecError
+-    from distutils.spawn import spawn
++    cmd = ["zip", zipoptions, zip_filename, base_dir]
++    if logger is not None:
++        logger.info(' '.join(cmd))
++    if dry_run:
++        return
++    import subprocess
+     try:
+-        spawn(["zip", zipoptions, zip_filename, base_dir], dry_run=dry_run)
+-    except DistutilsExecError:
++        subprocess.check_call(cmd)
++    except subprocess.CalledProcessError:
+         # XXX really should distinguish between "couldn't find
+         # external 'zip' command" and "zip failed".
+         raise ExecError, \
+@@ -458,7 +462,7 @@ def _make_zipfile(base_name, base_dir, verbose=0, dry_run=0, logger=None):
+         zipfile = None
+ 
+     if zipfile is None:
+-        _call_external_zip(base_dir, zip_filename, verbose, dry_run)
++        _call_external_zip(base_dir, zip_filename, verbose, dry_run, logger)
+     else:
+         if logger is not None:
+             logger.info("creating '%s' and adding '%s' to it",
+diff --git a/Misc/NEWS.d/next/Security/2018-08-28-22-11-54.bpo-34540.gfQ0TM.rst b/Misc/NEWS.d/next/Security/2018-08-28-22-11-54.bpo-34540.gfQ0TM.rst
+new file mode 100644
+index 000000000000..4f686962a87b
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2018-08-28-22-11-54.bpo-34540.gfQ0TM.rst
+@@ -0,0 +1,3 @@
++When ``shutil.make_archive`` falls back to the external ``zip`` problem, it
++uses :mod:`subprocess` to invoke it rather than :mod:`distutils.spawn`. This
++closes a possible shell injection vector.
diff --git a/python2.spec b/python2.spec
index 5bb64ef..a095325 100644
--- a/python2.spec
+++ b/python2.spec
@@ -112,7 +112,7 @@ Summary: An interpreted, interactive, object-oriented programming language
 Name: %{python}
 # Remember to also rebase python2-docs when changing this:
 Version: 2.7.15
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python
 Group: Development/Languages
 Requires: %{python}-libs%{?_isa} = %{version}-%{release}
@@ -738,6 +738,13 @@ Patch288: 00288-ambiguous-python-version-rpmbuild-warn.patch
 # (we handle it it in Setup.dist, see Patch0)
 Patch289: 00289-disable-nis-detection.patch
 
+# 00309 #
+# CVE-2018-1000802
+# shutil._call_external_zip to use subprocess instead of distutils.spawn
+# rhbz#1631662
+# Fixed upstream https://bugs.python.org/issue34540
+Patch309: 00309-shutil-spawn-subprocess.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python2" and "python3" in Fedora, EL, etc.,
@@ -1053,6 +1060,7 @@ mv Modules/cryptmodule.c Modules/_cryptmodule.c
 %endif
 %patch288 -p1
 %patch289 -p1
+%patch309 -p1
 
 
 %if 0%{?_module_build}
@@ -1956,6 +1964,9 @@ CheckPython \
 # ======================================================
 
 %changelog
+* Fri Sep 21 2018 Miro Hrončok <mhroncok@redhat.com> - 2.7.15-3
+- Security fix for CVE-2018-1000802 (#1631662)
+
 * Tue May 15 2018 Charalampos Stratakis <cstratak@redhat.com> - 2.7.15-2
 - Fix loading of the gdb python plugin (rhbz#1578001)