diff options
author | Trevor Gamblin <trevor.gamblin@windriver.com> | 2021-07-22 16:43:29 -0400 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-08-06 09:59:14 +0100 |
commit | ad768575b136ace44690145c2ec2a0b9551b1d48 (patch) | |
tree | 846b0307649428615c15b63b6eea2b0918f793ee | |
parent | 14c5392fded42f17962e1cc07fcc0446881b4fa0 (diff) | |
download | poky-ad768575b136ace44690145c2ec2a0b9551b1d48.tar.gz |
python3-pip: fix CVE-2021-3572
Backport the body of a fix for CVE-2021-3572 since hardknott carries
20.0.2, and the delta between it and the latest 21.1.3 is more than just
bugfixes.
CVE: CVE-2021-3572
(From OE-Core rev: fb7a2af241795b82f121381cea6f4b56ce948ebf)
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r-- | meta/recipes-devtools/python/python3-pip/0001-Don-t-split-git-references-on-unicode-separators.patch | 40 | ||||
-rw-r--r-- | meta/recipes-devtools/python/python3-pip_20.0.2.bb | 4 |
2 files changed, 43 insertions, 1 deletions
diff --git a/meta/recipes-devtools/python/python3-pip/0001-Don-t-split-git-references-on-unicode-separators.patch b/meta/recipes-devtools/python/python3-pip/0001-Don-t-split-git-references-on-unicode-separators.patch new file mode 100644 index 0000000000..f85353668a --- /dev/null +++ b/meta/recipes-devtools/python/python3-pip/0001-Don-t-split-git-references-on-unicode-separators.patch | |||
@@ -0,0 +1,40 @@ | |||
1 | From 25c1b92b1add0b81afe2fc6f9e82f66738a2d800 Mon Sep 17 00:00:00 2001 | ||
2 | From: Trevor Gamblin <trevor.gamblin@windriver.com> | ||
3 | Date: Thu, 22 Jul 2021 09:57:53 -0400 | ||
4 | Subject: [PATCH] Don't split git references on unicode separators | ||
5 | |||
6 | Upstream-Status: Backport | ||
7 | (https://github.com/pypa/pip/commit/e46bdda9711392fec0c45c1175bae6db847cb30b) | ||
8 | |||
9 | CVE: CVE-2021-3572 | ||
10 | |||
11 | Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> | ||
12 | --- | ||
13 | src/pip/_internal/vcs/git.py | 10 ++++++++-- | ||
14 | 1 file changed, 8 insertions(+), 2 deletions(-) | ||
15 | |||
16 | diff --git a/src/pip/_internal/vcs/git.py b/src/pip/_internal/vcs/git.py | ||
17 | index 7483303a9..d706064e7 100644 | ||
18 | --- a/src/pip/_internal/vcs/git.py | ||
19 | +++ b/src/pip/_internal/vcs/git.py | ||
20 | @@ -137,9 +137,15 @@ class Git(VersionControl): | ||
21 | output = cls.run_command(['show-ref', rev], cwd=dest, | ||
22 | show_stdout=False, on_returncode='ignore') | ||
23 | refs = {} | ||
24 | - for line in output.strip().splitlines(): | ||
25 | + # NOTE: We do not use splitlines here since that would split on other | ||
26 | + # unicode separators, which can be maliciously used to install a | ||
27 | + # different revision. | ||
28 | + for line in output.strip().split("\n"): | ||
29 | + line = line.rstrip("\r") | ||
30 | + if not line: | ||
31 | + continue | ||
32 | try: | ||
33 | - sha, ref = line.split() | ||
34 | + sha, ref = line.split(" ", maxsplit=2) | ||
35 | except ValueError: | ||
36 | # Include the offending line to simplify troubleshooting if | ||
37 | # this error ever occurs. | ||
38 | -- | ||
39 | 2.31.1 | ||
40 | |||
diff --git a/meta/recipes-devtools/python/python3-pip_20.0.2.bb b/meta/recipes-devtools/python/python3-pip_20.0.2.bb index 99eeea2edf..9242d0e82e 100644 --- a/meta/recipes-devtools/python/python3-pip_20.0.2.bb +++ b/meta/recipes-devtools/python/python3-pip_20.0.2.bb | |||
@@ -6,7 +6,9 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=8ba06d529c955048e5ddd7c45459eb2e" | |||
6 | 6 | ||
7 | DEPENDS += "python3 python3-setuptools-native" | 7 | DEPENDS += "python3 python3-setuptools-native" |
8 | 8 | ||
9 | SRC_URI += "file://0001-change-shebang-to-python3.patch" | 9 | SRC_URI += "file://0001-change-shebang-to-python3.patch \ |
10 | file://0001-Don-t-split-git-references-on-unicode-separators.patch \ | ||
11 | " | ||
10 | 12 | ||
11 | SRC_URI[md5sum] = "7d42ba49b809604f0df3d55df1c3fd86" | 13 | SRC_URI[md5sum] = "7d42ba49b809604f0df3d55df1c3fd86" |
12 | SRC_URI[sha256sum] = "7db0c8ea4c7ea51c8049640e8e6e7fde949de672bfa4949920675563a5a6967f" | 14 | SRC_URI[sha256sum] = "7db0c8ea4c7ea51c8049640e8e6e7fde949de672bfa4949920675563a5a6967f" |