summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--meta/recipes-devtools/python/python3/CVE-2020-27619.patch71
-rw-r--r--meta/recipes-devtools/python/python3_3.8.5.bb1
2 files changed, 72 insertions, 0 deletions
diff --git a/meta/recipes-devtools/python/python3/CVE-2020-27619.patch b/meta/recipes-devtools/python/python3/CVE-2020-27619.patch
new file mode 100644
index 0000000000..5a225ab760
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2020-27619.patch
@@ -0,0 +1,71 @@
1From 6c6c256df3636ff6f6136820afaefa5a10a3ac33 Mon Sep 17 00:00:00 2001
2From: "Miss Skeleton (bot)" <31488909+miss-islington@users.noreply.github.com>
3Date: Tue, 6 Oct 2020 05:38:54 -0700
4Subject: [PATCH] bpo-41944: No longer call eval() on content received via HTTP
5 in the CJK codec tests (GH-22566) (GH-22577)
6
7(cherry picked from commit 2ef5caa58febc8968e670e39e3d37cf8eef3cab8)
8
9Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
10
11Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
12
13Upstream-Status: Backport [https://github.com/python/cpython/commit/6c6c256df3636ff6f6136820afaefa5a10a3ac33]
14CVE: CVE-2020-27619
15Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
16
17---
18 Lib/test/multibytecodec_support.py | 22 +++++++------------
19 .../2020-10-05-17-43-46.bpo-41944.rf1dYb.rst | 1 +
20 2 files changed, 9 insertions(+), 14 deletions(-)
21 create mode 100644 Misc/NEWS.d/next/Tests/2020-10-05-17-43-46.bpo-41944.rf1dYb.rst
22
23diff --git a/Lib/test/multibytecodec_support.py b/Lib/test/multibytecodec_support.py
24index cca8af67d6d1d..f76c0153f5ecf 100644
25--- a/Lib/test/multibytecodec_support.py
26+++ b/Lib/test/multibytecodec_support.py
27@@ -305,29 +305,23 @@ def test_mapping_file(self):
28 self._test_mapping_file_plain()
29
30 def _test_mapping_file_plain(self):
31- unichrs = lambda s: ''.join(map(chr, map(eval, s.split('+'))))
32+ def unichrs(s):
33+ return ''.join(chr(int(x, 16)) for x in s.split('+'))
34+
35 urt_wa = {}
36
37 with self.open_mapping_file() as f:
38 for line in f:
39 if not line:
40 break
41- data = line.split('#')[0].strip().split()
42+ data = line.split('#')[0].split()
43 if len(data) != 2:
44 continue
45
46- csetval = eval(data[0])
47- if csetval <= 0x7F:
48- csetch = bytes([csetval & 0xff])
49- elif csetval >= 0x1000000:
50- csetch = bytes([(csetval >> 24), ((csetval >> 16) & 0xff),
51- ((csetval >> 8) & 0xff), (csetval & 0xff)])
52- elif csetval >= 0x10000:
53- csetch = bytes([(csetval >> 16), ((csetval >> 8) & 0xff),
54- (csetval & 0xff)])
55- elif csetval >= 0x100:
56- csetch = bytes([(csetval >> 8), (csetval & 0xff)])
57- else:
58+ if data[0][:2] != '0x':
59+ self.fail(f"Invalid line: {line!r}")
60+ csetch = bytes.fromhex(data[0][2:])
61+ if len(csetch) == 1 and 0x80 <= csetch[0]:
62 continue
63
64 unich = unichrs(data[1])
65diff --git a/Misc/NEWS.d/next/Tests/2020-10-05-17-43-46.bpo-41944.rf1dYb.rst b/Misc/NEWS.d/next/Tests/2020-10-05-17-43-46.bpo-41944.rf1dYb.rst
66new file mode 100644
67index 0000000000000..4f9782f1c85af
68--- /dev/null
69+++ b/Misc/NEWS.d/next/Tests/2020-10-05-17-43-46.bpo-41944.rf1dYb.rst
70@@ -0,0 +1 @@
71+Tests for CJK codecs no longer call ``eval()`` on content received via HTTP.
diff --git a/meta/recipes-devtools/python/python3_3.8.5.bb b/meta/recipes-devtools/python/python3_3.8.5.bb
index 2a3c52a116..3720b364bb 100644
--- a/meta/recipes-devtools/python/python3_3.8.5.bb
+++ b/meta/recipes-devtools/python/python3_3.8.5.bb
@@ -32,6 +32,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
32 file://0001-configure.ac-fix-LIBPL.patch \ 32 file://0001-configure.ac-fix-LIBPL.patch \
33 file://0001-python3-Do-not-hardcode-lib-for-distutils.patch \ 33 file://0001-python3-Do-not-hardcode-lib-for-distutils.patch \
34 file://0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch \ 34 file://0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch \
35 file://CVE-2020-27619.patch \
35 " 36 "
36 37
37SRC_URI_append_class-native = " \ 38SRC_URI_append_class-native = " \