From 2adb3d6734b9ea6050b9e6c39ddf58da8c18e2ad Mon Sep 17 00:00:00 2001 From: Gyorgy Sarvari Date: Tue, 6 Jan 2026 08:33:29 +0100 Subject: python3-mpmath: patch CVE-2021-29063 Details: https://nvd.nist.gov/vuln/detail/CVE-2021-29063 Pick the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari --- .../python/python3-mpmath/CVE-2021-29063.patch | 51 ++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-mpmath/CVE-2021-29063.patch (limited to 'meta-python/recipes-devtools/python/python3-mpmath/CVE-2021-29063.patch') diff --git a/meta-python/recipes-devtools/python/python3-mpmath/CVE-2021-29063.patch b/meta-python/recipes-devtools/python/python3-mpmath/CVE-2021-29063.patch new file mode 100644 index 0000000000..3674a32ea1 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-mpmath/CVE-2021-29063.patch @@ -0,0 +1,51 @@ +From 2e196ba7e41a46b8cafa5971e559ca55171414dc Mon Sep 17 00:00:00 2001 +From: Vinzent Steinberg +Date: Wed, 10 Feb 2021 16:45:04 +0100 +Subject: [PATCH] Fix ReDOS vulnerability + +Fixes #548, with the workaround suggested by @yetingli. + +CVE: CVE-2021-29063 +Upstream-Status: Backport [https://github.com/mpmath/mpmath/commit/46d44c3c8f3244017fe1eb102d564eb4ab8ef750] +Signed-off-by: Gyorgy Sarvari +--- + mpmath/ctx_mp.py | 4 ++-- + mpmath/tests/test_convert.py | 10 ++++++++++ + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/mpmath/ctx_mp.py b/mpmath/ctx_mp.py +index 39fc941..93594dd 100644 +--- a/mpmath/ctx_mp.py ++++ b/mpmath/ctx_mp.py +@@ -42,8 +42,8 @@ + + new = object.__new__ + +-get_complex = re.compile(r'^\(?(?P[\+\-]?\d*\.?\d*(e[\+\-]?\d+)?)??' +- r'(?P[\+\-]?\d*\.?\d*(e[\+\-]?\d+)?j)?\)?$') ++get_complex = re.compile(r'^\(?(?P[\+\-]?\d*(\.\d*)?(e[\+\-]?\d+)?)??' ++ r'(?P[\+\-]?\d*(\.\d*)?(e[\+\-]?\d+)?j)?\)?$') + + if BACKEND == 'sage': + from sage.libs.mpmath.ext_main import Context as BaseMPContext +diff --git a/mpmath/tests/test_convert.py b/mpmath/tests/test_convert.py +index 3e2f555..cf1a91d 100644 +--- a/mpmath/tests/test_convert.py ++++ b/mpmath/tests/test_convert.py +@@ -194,6 +194,16 @@ def test_mpmathify(): + assert mpmathify('(1.2e-10 - 3.4e5j)') == mpc('1.2e-10', '-3.4e5') + assert mpmathify('1j') == mpc(1j) + ++def test_issue548(): ++ try: ++ # This expression is invalid, but may trigger the ReDOS vulnerability ++ # in the regular expression. ++ mpmathify('(' + '1' * 5000 + '!j') ++ except: ++ return ++ # The expression is invalid and should raise an exception. ++ assert False ++ + def test_compatibility(): + try: + import numpy as np -- cgit v1.2.3-54-g00ecf