summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/python
diff options
context:
space:
mode:
authorLee Chee Yang <chee.yang.lee@intel.com>2020-07-03 17:32:04 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2020-07-07 23:15:10 +0100
commit17e594e8f97c9747c3774f491abc6b6b4ff2bb8a (patch)
tree54fdf7c0fdf41e4fc5d4f82a7edb52a2b1d096a1 /meta/recipes-devtools/python
parentbf175f82ceebd85377857554100cb23653490bde (diff)
downloadpoky-17e594e8f97c9747c3774f491abc6b6b4ff2bb8a.tar.gz
python3: fix CVE-2020-14422
(From OE-Core rev: 0400d217d0891ee553926c10d7caaabc8bebc22e) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/python')
-rw-r--r--meta/recipes-devtools/python/python3/CVE-2020-14422.patch77
-rw-r--r--meta/recipes-devtools/python/python3_3.8.2.bb1
2 files changed, 78 insertions, 0 deletions
diff --git a/meta/recipes-devtools/python/python3/CVE-2020-14422.patch b/meta/recipes-devtools/python/python3/CVE-2020-14422.patch
new file mode 100644
index 0000000000..6889e46da9
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2020-14422.patch
@@ -0,0 +1,77 @@
1From dc8ce8ead182de46584cc1ed8a8c51d48240cbd5 Mon Sep 17 00:00:00 2001
2From: "Miss Islington (bot)"
3 <31488909+miss-islington@users.noreply.github.com>
4Date: Mon, 29 Jun 2020 11:12:50 -0700
5Subject: [PATCH] bpo-41004: Resolve hash collisions for IPv4Interface and
6 IPv6Interface (GH-21033)
7
8The __hash__() methods of classes IPv4Interface and IPv6Interface had issue
9of generating constant hash values of 32 and 128 respectively causing hash collisions.
10The fix uses the hash() function to generate hash values for the objects
11instead of XOR operation
12(cherry picked from commit b30ee26e366bf509b7538d79bfec6c6d38d53f28)
13
14Co-authored-by: Ravi Teja P <rvteja92@gmail.com>
15
16Upstream-Status: Backport [https://github.com/python/cpython/commit/dc8ce8ead182de46584cc1ed8a8c51d48240cbd5]
17CVE: CVE-2020-14422
18Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
19---
20 Lib/ipaddress.py | 4 ++--
21 Lib/test/test_ipaddress.py | 12 ++++++++++++
22 .../2020-06-29-16-02-29.bpo-41004.ovF0KZ.rst | 1 +
23 3 files changed, 15 insertions(+), 2 deletions(-)
24 create mode 100644 Misc/NEWS.d/next/Security/2020-06-29-16-02-29.bpo-41004.ovF0KZ.rst
25
26diff --git a/Lib/ipaddress.py b/Lib/ipaddress.py
27index 873c7644081af..a3a04f7f4b309 100644
28--- a/Lib/ipaddress.py
29+++ b/Lib/ipaddress.py
30@@ -1370,7 +1370,7 @@ def __lt__(self, other):
31 return False
32
33 def __hash__(self):
34- return self._ip ^ self._prefixlen ^ int(self.network.network_address)
35+ return hash((self._ip, self._prefixlen, int(self.network.network_address)))
36
37 __reduce__ = _IPAddressBase.__reduce__
38
39@@ -2017,7 +2017,7 @@ def __lt__(self, other):
40 return False
41
42 def __hash__(self):
43- return self._ip ^ self._prefixlen ^ int(self.network.network_address)
44+ return hash((self._ip, self._prefixlen, int(self.network.network_address)))
45
46 __reduce__ = _IPAddressBase.__reduce__
47
48diff --git a/Lib/test/test_ipaddress.py b/Lib/test/test_ipaddress.py
49index de77111705b69..2eba740e5e7a4 100644
50--- a/Lib/test/test_ipaddress.py
51+++ b/Lib/test/test_ipaddress.py
52@@ -2053,6 +2053,18 @@ def testsixtofour(self):
53 sixtofouraddr.sixtofour)
54 self.assertFalse(bad_addr.sixtofour)
55
56+ # issue41004 Hash collisions in IPv4Interface and IPv6Interface
57+ def testV4HashIsNotConstant(self):
58+ ipv4_address1 = ipaddress.IPv4Interface("1.2.3.4")
59+ ipv4_address2 = ipaddress.IPv4Interface("2.3.4.5")
60+ self.assertNotEqual(ipv4_address1.__hash__(), ipv4_address2.__hash__())
61+
62+ # issue41004 Hash collisions in IPv4Interface and IPv6Interface
63+ def testV6HashIsNotConstant(self):
64+ ipv6_address1 = ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:1")
65+ ipv6_address2 = ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:2")
66+ self.assertNotEqual(ipv6_address1.__hash__(), ipv6_address2.__hash__())
67+
68
69 if __name__ == '__main__':
70 unittest.main()
71diff --git a/Misc/NEWS.d/next/Security/2020-06-29-16-02-29.bpo-41004.ovF0KZ.rst b/Misc/NEWS.d/next/Security/2020-06-29-16-02-29.bpo-41004.ovF0KZ.rst
72new file mode 100644
73index 0000000000000..1380b31fbe9f4
74--- /dev/null
75+++ b/Misc/NEWS.d/next/Security/2020-06-29-16-02-29.bpo-41004.ovF0KZ.rst
76@@ -0,0 +1 @@
77+The __hash__() methods of ipaddress.IPv4Interface and ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and 128 respectively. This resulted in always causing hash collisions. The fix uses hash() to generate hash values for the tuple of (address, mask length, network address).
diff --git a/meta/recipes-devtools/python/python3_3.8.2.bb b/meta/recipes-devtools/python/python3_3.8.2.bb
index a4a16fd495..99d9f6748f 100644
--- a/meta/recipes-devtools/python/python3_3.8.2.bb
+++ b/meta/recipes-devtools/python/python3_3.8.2.bb
@@ -33,6 +33,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
33 file://0001-python3-Do-not-hardcode-lib-for-distutils.patch \ 33 file://0001-python3-Do-not-hardcode-lib-for-distutils.patch \
34 file://0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch \ 34 file://0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch \
35 file://0001-bpo-39503-CVE-2020-8492-Fix-AbstractBasicAuthHandler.patch \ 35 file://0001-bpo-39503-CVE-2020-8492-Fix-AbstractBasicAuthHandler.patch \
36 file://CVE-2020-14422.patch \
36 " 37 "
37 38
38SRC_URI_append_class-native = " \ 39SRC_URI_append_class-native = " \