rpms/python-cryptography
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2023-23931

Browse Source 
Don't allow update_into to mutate immutable objects
Fix FTBFS due to failing test_load_invalid_ec_key_from_pem and test_decrypt_invalid_decrypt

resolves: rhbz#2172399
This commit is contained in:
Christian Heimes 2023-02-22 10:39:44 +01:00
parent 9701231b35
commit 420ce8ea21
2 changed files with 51 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
0006-CVE-2023-23931.patch Normal file
View File

@ -0,0 +1,42 @@
From 94a50a9731f35405f0357fa5f3b177d46a726ab3 Mon Sep 17 00:00:00 2001
From: Alex Gaynor <alex.gaynor@gmail.com>
Date: Tue, 31 Jan 2023 08:33:54 -0500
Subject: [PATCH] Don't allow update_into to mutate immutable objects
---
src/cryptography/hazmat/backends/openssl/ciphers.py | 2 +-
tests/hazmat/primitives/test_ciphers.py | 8 ++++++++
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/src/cryptography/hazmat/backends/openssl/ciphers.py b/src/cryptography/hazmat/backends/openssl/ciphers.py
index 286583f9325..075d68fb905 100644
--- a/src/cryptography/hazmat/backends/openssl/ciphers.py
+++ b/src/cryptography/hazmat/backends/openssl/ciphers.py
@@ -156,7 +156,7 @@ def update_into(self, data: bytes, buf: bytes) -> int:
data_processed = 0
total_out = 0
outlen = self._backend._ffi.new("int *")
- baseoutbuf = self._backend._ffi.from_buffer(buf)
+ baseoutbuf = self._backend._ffi.from_buffer(buf, require_writable=True)
baseinbuf = self._backend._ffi.from_buffer(data)
while data_processed != total_data_len:
diff --git a/tests/hazmat/primitives/test_ciphers.py b/tests/hazmat/primitives/test_ciphers.py
index 02127dd9cab..bf3b047dec2 100644
--- a/tests/hazmat/primitives/test_ciphers.py
+++ b/tests/hazmat/primitives/test_ciphers.py
@@ -318,6 +318,14 @@ def test_update_into_buffer_too_small(self, backend):
with pytest.raises(ValueError):
encryptor.update_into(b"testing", buf)
+ def test_update_into_immutable(self, backend):
+ key = b"\x00" * 16
+ c = ciphers.Cipher(AES(key), modes.ECB(), backend)
+ encryptor = c.encryptor()
+ buf = b"\x00" * 32
+ with pytest.raises((TypeError, BufferError)):
+ encryptor.update_into(b"testing", buf)
+
@pytest.mark.supported(
only_if=lambda backend: backend.cipher_supported(
AES(b"\x00" * 16), modes.GCM(b"\x00" * 12)

11
python-cryptography.spec
View File

@ -7,7 +7,7 @@
Name: python-%{srcname}
Version: 36.0.1
Release: 2%{?dist}
Release: 3%{?dist}
Summary: PyCA's cryptography library
License: ASL 2.0 or BSD
@ -22,6 +22,8 @@ Patch2: 0002-Disable-DSA-tests-in-FIPS-mode-6916.patch
Patch3: 0003-fixes-6927-handle-negative-return-values-from-openss.patch
Patch4: 0004-Disable-test_openssl_assert_error_on_stack-in-FIPS-m.patch
Patch5: 0005-Fixed-serialization-of-keyusage-ext-with-no-bits-693.patch
# https://github.com/pyca/cryptography/pull/8230
Patch6: 0006-CVE-2023-23931.patch
ExclusiveArch: %{rust_arches}
@ -113,9 +115,10 @@ export OPENSSL_ENABLE_SHA1_SIGNATURES=yes
# see rhbz#2042413 for memleak. It's unstable with openssl 3.0.1 and makes
# not much sense for downstream testing.
# see rhbz#2171661 for test_load_invalid_ec_key_from_pem: error:030000CD:digital envelope routines::keymgmt export failure
PYTHONPATH=${PWD}/vectors:%{buildroot}%{python3_sitearch} \
%{__python3} -m pytest \
-k "not (test_openssl_memleak)"
-k "not (test_openssl_memleak or test_load_ecdsa_no_named_curve or test_decrypt_invalid_decrypt)"
%endif
%files -n python%{python3_pkgversion}-%{srcname}
@ -125,6 +128,10 @@ PYTHONPATH=${PWD}/vectors:%{buildroot}%{python3_sitearch} \
%{python3_sitearch}/%{srcname}-%{version}-py*.egg-info
%changelog
* Wed Feb 22 2023 Christian Heimes <cheimes@redhat.com> - 36.0.1-3
- Fix CVE-2023-23931: Don't allow update_into to mutate immutable objects, resolves rhbz#2172399
- Fix FTBFS due to failing test_load_invalid_ec_key_from_pem and test_decrypt_invalid_decrypt
* Tue Apr 19 2022 Christian Heimes <cheimes@redhat.com> - 36.0.1-2
- Rebuild for gating, related: rhbz#2060787