From 867babeb6fcad2ac5497b4e36d622ff33c11908c Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Sun, 6 Nov 2016 10:27:08 -0800 Subject: python-2.7: Security fix CVE-2016-0772 Affects python < 2.7.12 (From OE-Core rev: dd1a22f4beeb4100388efdc072e7cff2025535a7) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- .../python/python/CVE-2016-0772.patch | 42 ++++++++++++++++++++++ meta/recipes-devtools/python/python_2.7.9.bb | 1 + 2 files changed, 43 insertions(+) create mode 100644 meta/recipes-devtools/python/python/CVE-2016-0772.patch diff --git a/meta/recipes-devtools/python/python/CVE-2016-0772.patch b/meta/recipes-devtools/python/python/CVE-2016-0772.patch new file mode 100644 index 0000000000..0580507954 --- /dev/null +++ b/meta/recipes-devtools/python/python/CVE-2016-0772.patch @@ -0,0 +1,42 @@ + +# HG changeset patch +# User Benjamin Peterson +# Date 1465676202 25200 +# Node ID b3ce713fb9beebfff9848cefa0acbd59acc68fe9 +# Parent 3017e41b0c99d24e88faf1de447f230e2f64d122 +raise an error when STARTTLS fails + +Upstream-status: Backport +CVE: CVE-2016-0772 +Signed-off-by: Armin Kuster + +Index: Python-2.7.9/Lib/smtplib.py +=================================================================== +--- Python-2.7.9.orig/Lib/smtplib.py ++++ Python-2.7.9/Lib/smtplib.py +@@ -656,6 +656,11 @@ class SMTP: + self.ehlo_resp = None + self.esmtp_features = {} + self.does_esmtp = 0 ++ else: ++ # RFC 3207: ++ # 501 Syntax error (no parameters allowed) ++ # 454 TLS not available due to temporary reason ++ raise SMTPResponseException(resp, reply) + return (resp, reply) + + def sendmail(self, from_addr, to_addrs, msg, mail_options=[], +Index: Python-2.7.9/Misc/NEWS +=================================================================== +--- Python-2.7.9.orig/Misc/NEWS ++++ Python-2.7.9/Misc/NEWS +@@ -5136,6 +5136,9 @@ Library + + - Issue #8140: Extend compileall to compile single files. Add -i option. + ++- Fix TLS stripping vulnerability in smptlib, CVE-2016-0772. Reported by Team ++ Oststrom ++ + - Issue #7356: ctypes.util: Make parsing of ldconfig output independent of the + locale. + diff --git a/meta/recipes-devtools/python/python_2.7.9.bb b/meta/recipes-devtools/python/python_2.7.9.bb index f7e2f272f4..53ec99181f 100644 --- a/meta/recipes-devtools/python/python_2.7.9.bb +++ b/meta/recipes-devtools/python/python_2.7.9.bb @@ -26,6 +26,7 @@ SRC_URI += "\ file://parallel-makeinst-create-bindir.patch \ file://use_sysroot_ncurses_instead_of_host.patch \ file://avoid_parallel_make_races_on_pgen.patch \ + file://CVE-2016-0772.patch \ " S = "${WORKDIR}/Python-${PV}" -- cgit v1.2.3-54-g00ecf