summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-python/recipes-devtools/python/python3-urllib3/CVE-2020-26137.patch72
-rw-r--r--meta-python/recipes-devtools/python/python3-urllib3/CVE-2021-33503.patch67
-rw-r--r--meta-python/recipes-devtools/python/python3-urllib3_1.25.7.bb6
3 files changed, 143 insertions, 2 deletions
diff --git a/meta-python/recipes-devtools/python/python3-urllib3/CVE-2020-26137.patch b/meta-python/recipes-devtools/python/python3-urllib3/CVE-2020-26137.patch
new file mode 100644
index 0000000000..3cc8bcd02a
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-urllib3/CVE-2020-26137.patch
@@ -0,0 +1,72 @@
1From 1dd69c5c5982fae7c87a620d487c2ebf7a6b436b Mon Sep 17 00:00:00 2001
2From: Seth Michael Larson <sethmichaellarson@gmail.com>
3Date: Mon, 17 Feb 2020 15:34:48 -0600
4Subject: [PATCH] Raise ValueError if method contains control characters
5 (#1800)
6
7CVE: CVE-2020-26137
8Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b.patch]
9Signed-off-by: Nikhil R <nikhil.r@kpit.com>
10Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
11Comment: Removed one hunk in CHANGES.rst and refresh other to remove
12patch fuzz warnings
13
14---
15 src/urllib3/connection.py | 14 ++++++++++++++
16 test/with_dummyserver/test_connectionpool.py | 6 ++++++
17 2 files changed, 20 insertions(+)
18
19diff --git a/src/urllib3/connection.py b/src/urllib3/connection.py
20index 71e6790b1b..f7b1760938 100644
21--- a/src/urllib3/connection.py
22+++ b/src/urllib3/connection.py
23@@ -1,4 +1,5 @@
24 from __future__ import absolute_import
25+import re
26 import datetime
27 import logging
28 import os
29@@ -58,6 +59,8 @@ port_by_scheme = {"http": 80, "https": 443}
30 # (ie test_recent_date is failing) update it to ~6 months before the current date.
31 RECENT_DATE = datetime.date(2019, 1, 1)
32
33+_CONTAINS_CONTROL_CHAR_RE = re.compile(r"[^-!#$%&'*+.^_`|~0-9a-zA-Z]")
34+
35
36 class DummyConnection(object):
37 """Used to detect a failed ConnectionCls import."""
38@@ -184,6 +187,17 @@ class HTTPConnection(_HTTPConnection, object):
39 conn = self._new_conn()
40 self._prepare_conn(conn)
41
42+ def putrequest(self, method, url, *args, **kwargs):
43+ """Send a request to the server"""
44+ match = _CONTAINS_CONTROL_CHAR_RE.search(method)
45+ if match:
46+ raise ValueError(
47+ "Method cannot contain non-token characters %r (found at least %r)"
48+ % (method, match.group())
49+ )
50+
51+ return _HTTPConnection.putrequest(self, method, url, *args, **kwargs)
52+
53 def request_chunked(self, method, url, body=None, headers=None):
54 """
55 Alternative to the common request method, which sends the
56diff --git a/test/with_dummyserver/test_connectionpool.py b/test/with_dummyserver/test_connectionpool.py
57index 57f0dbd2f4..79cbd27185 100644
58--- a/test/with_dummyserver/test_connectionpool.py
59+++ b/test/with_dummyserver/test_connectionpool.py
60@@ -677,6 +677,12 @@ class TestConnectionPool(HTTPDummyServerTestCase):
61 with pytest.raises(MaxRetryError):
62 pool.request("GET", "/test", retries=2)
63
64+ @pytest.mark.parametrize("char", [" ", "\r", "\n", "\x00"])
65+ def test_invalid_method_not_allowed(self, char):
66+ with pytest.raises(ValueError):
67+ with HTTPConnectionPool(self.host, self.port) as pool:
68+ pool.request("GET" + char, "/")
69+
70 def test_percent_encode_invalid_target_chars(self):
71 with HTTPConnectionPool(self.host, self.port) as pool:
72 r = pool.request("GET", "/echo_params?q=\r&k=\n \n")
diff --git a/meta-python/recipes-devtools/python/python3-urllib3/CVE-2021-33503.patch b/meta-python/recipes-devtools/python/python3-urllib3/CVE-2021-33503.patch
new file mode 100644
index 0000000000..838add9555
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-urllib3/CVE-2021-33503.patch
@@ -0,0 +1,67 @@
1From 2d4a3fee6de2fa45eb82169361918f759269b4ec Mon Sep 17 00:00:00 2001
2From: Seth Michael Larson <sethmichaellarson@gmail.com>
3Date: Wed, 26 May 2021 10:43:12 -0500
4Subject: [PATCH] Improve performance of sub-authority splitting in URL
5
6CVE: CVE-2021-33503
7Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ec.patch]
8Signed-off-by: Nikhil R <nikhil.r@kpit.com>
9Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
10Comment: Refresh hunks to remove patch fuzz warnings
11
12---
13 src/urllib3/util/url.py | 8 +++++---
14 test/test_util.py | 10 ++++++++++
15 2 files changed, 15 insertions(+), 3 deletions(-)
16
17diff --git a/src/urllib3/util/url.py b/src/urllib3/util/url.py
18index 6ff238fe3c..81a03da9e3 100644
19--- a/src/urllib3/util/url.py
20+++ b/src/urllib3/util/url.py
21@@ -63,12 +63,12 @@ IPV6_ADDRZ_RE = re.compile("^" + IPV6_ADDRZ_PAT + "$")
22 BRACELESS_IPV6_ADDRZ_RE = re.compile("^" + IPV6_ADDRZ_PAT[2:-2] + "$")
23 ZONE_ID_RE = re.compile("(" + ZONE_ID_PAT + r")\]$")
24
25-SUBAUTHORITY_PAT = (u"^(?:(.*)@)?(%s|%s|%s)(?::([0-9]{0,5}))?$") % (
26+_HOST_PORT_PAT = ("^(%s|%s|%s)(?::([0-9]{0,5}))?$") % (
27 REG_NAME_PAT,
28 IPV4_PAT,
29 IPV6_ADDRZ_PAT,
30 )
31-SUBAUTHORITY_RE = re.compile(SUBAUTHORITY_PAT, re.UNICODE | re.DOTALL)
32+_HOST_PORT_RE = re.compile(_HOST_PORT_PAT, re.UNICODE | re.DOTALL)
33
34 UNRESERVED_CHARS = set(
35 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-~"
36@@ -368,7 +368,9 @@ def parse_url(url):
37 scheme = scheme.lower()
38
39 if authority:
40- auth, host, port = SUBAUTHORITY_RE.match(authority).groups()
41+ auth, _, host_port = authority.rpartition("@")
42+ auth = auth or None
43+ host, port = _HOST_PORT_RE.match(host_port).groups()
44 if auth and normalize_uri:
45 auth = _encode_invalid_chars(auth, USERINFO_CHARS)
46 if port == "":
47diff --git a/test/test_util.py b/test/test_util.py
48index a5b68a084b..88409e2d6c 100644
49--- a/test/test_util.py
50+++ b/test/test_util.py
51@@ -425,6 +425,16 @@ class TestUtil(object):
52 query="%0D%0ASET%20test%20failure12%0D%0A:8080/test/?test=a",
53 ),
54 ),
55+ # Tons of '@' causing backtracking
56+ ("https://" + ("@" * 10000) + "[", False),
57+ (
58+ "https://user:" + ("@" * 10000) + "example.com",
59+ Url(
60+ scheme="https",
61+ auth="user:" + ("%40" * 9999),
62+ host="example.com",
63+ ),
64+ ),
65 ]
66
67 @pytest.mark.parametrize("url, expected_url", url_vulnerabilities)
diff --git a/meta-python/recipes-devtools/python/python3-urllib3_1.25.7.bb b/meta-python/recipes-devtools/python/python3-urllib3_1.25.7.bb
index 8d987a1f30..73399d9439 100644
--- a/meta-python/recipes-devtools/python/python3-urllib3_1.25.7.bb
+++ b/meta-python/recipes-devtools/python/python3-urllib3_1.25.7.bb
@@ -8,8 +8,10 @@ SRC_URI[sha256sum] = "f3c5fd51747d450d4dcf6f923c81f78f811aab8205fda64b0aba34a4e4
8 8
9inherit pypi setuptools3 9inherit pypi setuptools3
10 10
11SRC_URI += "file://CVE-2020-7212.patch" 11SRC_URI += "file://CVE-2020-7212.patch \
12 12 file://CVE-2020-26137.patch \
13 file://CVE-2021-33503.patch \
14 "
13RDEPENDS_${PN} += "\ 15RDEPENDS_${PN} += "\
14 ${PYTHON_PN}-certifi \ 16 ${PYTHON_PN}-certifi \
15 ${PYTHON_PN}-cryptography \ 17 ${PYTHON_PN}-cryptography \
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-06-19 20:40:08 +0000