diff --git a/9760.patch b/9760.patch new file mode 100644 index 0000000..fb7e379 --- /dev/null +++ b/9760.patch @@ -0,0 +1,111 @@ +From 960c01adce491de00ef7a8d02a32fea31b15a1dc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= +Date: Fri, 2 Apr 2021 02:39:11 +0200 +Subject: [PATCH] Update urllib3 to 1.26.4 to fix CVE-2021-28363 + +--- + news/CVE-2021-28363.vendor.rst | 1 + + src/pip/_vendor/urllib3/_version.py | 2 +- + src/pip/_vendor/urllib3/connection.py | 8 ++++++-- + src/pip/_vendor/urllib3/exceptions.py | 12 +++++++++++- + src/pip/_vendor/urllib3/util/retry.py | 1 + + src/pip/_vendor/vendor.txt | 2 +- + 6 files changed, 21 insertions(+), 5 deletions(-) + create mode 100644 news/CVE-2021-28363.vendor.rst + +diff --git a/news/CVE-2021-28363.vendor.rst b/news/CVE-2021-28363.vendor.rst +new file mode 100644 +index 00000000000..29700ab7469 +--- /dev/null ++++ b/news/CVE-2021-28363.vendor.rst +@@ -0,0 +1 @@ ++Update urllib3 to 1.26.4 to fix CVE-2021-28363 +diff --git a/src/pip/_vendor/urllib3/_version.py b/src/pip/_vendor/urllib3/_version.py +index 2dba29e3fbe..97c983300b0 100644 +--- a/src/pip/_vendor/urllib3/_version.py ++++ b/src/pip/_vendor/urllib3/_version.py +@@ -1,2 +1,2 @@ + # This file is protected via CODEOWNERS +-__version__ = "1.26.2" ++__version__ = "1.26.4" +diff --git a/src/pip/_vendor/urllib3/connection.py b/src/pip/_vendor/urllib3/connection.py +index 660d679c361..45580b7e1ea 100644 +--- a/src/pip/_vendor/urllib3/connection.py ++++ b/src/pip/_vendor/urllib3/connection.py +@@ -67,7 +67,7 @@ class BrokenPipeError(Exception): + + # When it comes time to update this value as a part of regular maintenance + # (ie test_recent_date is failing) update it to ~6 months before the current date. +-RECENT_DATE = datetime.date(2019, 1, 1) ++RECENT_DATE = datetime.date(2020, 7, 1) + + _CONTAINS_CONTROL_CHAR_RE = re.compile(r"[^-!#$%&'*+.^_`|~0-9a-zA-Z]") + +@@ -215,7 +215,7 @@ def putrequest(self, method, url, *args, **kwargs): + + def putheader(self, header, *values): + """""" +- if SKIP_HEADER not in values: ++ if not any(isinstance(v, str) and v == SKIP_HEADER for v in values): + _HTTPConnection.putheader(self, header, *values) + elif six.ensure_str(header.lower()) not in SKIPPABLE_HEADERS: + raise ValueError( +@@ -490,6 +490,10 @@ def _connect_tls_proxy(self, hostname, conn): + self.ca_cert_dir, + self.ca_cert_data, + ) ++ # By default urllib3's SSLContext disables `check_hostname` and uses ++ # a custom check. For proxies we're good with relying on the default ++ # verification. ++ ssl_context.check_hostname = True + + # If no cert was provided, use only the default options for server + # certificate validation +diff --git a/src/pip/_vendor/urllib3/exceptions.py b/src/pip/_vendor/urllib3/exceptions.py +index d69958d5dfc..cba6f3f560f 100644 +--- a/src/pip/_vendor/urllib3/exceptions.py ++++ b/src/pip/_vendor/urllib3/exceptions.py +@@ -289,7 +289,17 @@ class ProxySchemeUnknown(AssertionError, URLSchemeUnknown): + # TODO(t-8ch): Stop inheriting from AssertionError in v2.0. + + def __init__(self, scheme): +- message = "Not supported proxy scheme %s" % scheme ++ # 'localhost' is here because our URL parser parses ++ # localhost:8080 -> scheme=localhost, remove if we fix this. ++ if scheme == "localhost": ++ scheme = None ++ if scheme is None: ++ message = "Proxy URL had no scheme, should start with http:// or https://" ++ else: ++ message = ( ++ "Proxy URL had unsupported scheme %s, should use http:// or https://" ++ % scheme ++ ) + super(ProxySchemeUnknown, self).__init__(message) + + +diff --git a/src/pip/_vendor/urllib3/util/retry.py b/src/pip/_vendor/urllib3/util/retry.py +index ee51f922f84..d25a41b42ea 100644 +--- a/src/pip/_vendor/urllib3/util/retry.py ++++ b/src/pip/_vendor/urllib3/util/retry.py +@@ -253,6 +253,7 @@ def __init__( + "Using 'method_whitelist' with Retry is deprecated and " + "will be removed in v2.0. Use 'allowed_methods' instead", + DeprecationWarning, ++ stacklevel=2, + ) + allowed_methods = method_whitelist + if allowed_methods is _Default: +diff --git a/src/pip/_vendor/vendor.txt b/src/pip/_vendor/vendor.txt +index 51a5508479e..868baba6f01 100644 +--- a/src/pip/_vendor/vendor.txt ++++ b/src/pip/_vendor/vendor.txt +@@ -13,7 +13,7 @@ requests==2.25.1 + certifi==2020.12.05 + chardet==4.0.0 + idna==2.10 +- urllib3==1.26.2 ++ urllib3==1.26.4 + resolvelib==0.5.4 + retrying==1.3.3 + setuptools==44.0.0 diff --git a/don-t-split-git-references-on-unicode-separators.patch b/don-t-split-git-references-on-unicode-separators.patch new file mode 100644 index 0000000..031c418 --- /dev/null +++ b/don-t-split-git-references-on-unicode-separators.patch @@ -0,0 +1,33 @@ +From ca24e4bfa60cec8341ccf40000a41bc9592713df Mon Sep 17 00:00:00 2001 +From: Karolina Surma +Date: Mon, 17 May 2021 11:34:30 +0200 +Subject: [PATCH] Don't split git references on unicode separators + +--- + src/pip/_internal/vcs/git.py | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) +diff --git a/src/pip/_internal/vcs/git.py b/src/pip/_internal/vcs/git.py +index cc22cd7..308e857 100644 +--- a/src/pip/_internal/vcs/git.py ++++ b/src/pip/_internal/vcs/git.py +@@ -147,9 +147,15 @@ class Git(VersionControl): + on_returncode='ignore', + ) + refs = {} +- for line in output.strip().splitlines(): ++ # NOTE: We do not use splitlines here since that would split on other ++ # unicode separators, which can be maliciously used to install a ++ # different revision. ++ for line in output.strip().split("\n"): ++ line = line.rstrip("\r") ++ if not line: ++ continue + try: +- sha, ref = line.split() ++ sha, ref = line.split(" ", maxsplit=2) + except ValueError: + # Include the offending line to simplify troubleshooting if + # this error ever occurs. +-- +2.31.1 + diff --git a/python-pip.spec b/python-pip.spec index c783bb2..5ecd7cc 100644 --- a/python-pip.spec +++ b/python-pip.spec @@ -22,7 +22,7 @@ Name: python-%{srcname} Version: %{base_version}%{?prerel:~%{prerel}} -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for installing and managing Python packages # We bundle a lot of libraries with pip, which itself is under MIT license. @@ -93,6 +93,17 @@ Patch5: nowarn-pip._internal.main.patch # Upstream issue: https://github.com/pypa/packaging/issues/368 Patch6: no-version-warning.patch +# Update vendored urrlib3 to 1.26.4 to fix CVE-2021-28363 +# Security patch backported from pip 21.1 +Patch7: https://github.com/pypa/pip/pull/9760.patch + +# Don't split git references on unicode separators, +# which could be maliciously used to install a different revision on the +# repository. +# Security patch backported from pip 21.1.1 +# Upstream PR: https://github.com/pypa/pip/pull/9827 +Patch8: don-t-split-git-references-on-unicode-separators.patch + # Downstream only patch # Users might have local installations of pip from using # `pip install --user --upgrade pip` on older/newer versions. @@ -149,7 +160,7 @@ Provides: bundled(python%{1}dist(retrying)) = 1.3.3 Provides: bundled(python%{1}dist(setuptools)) = 44 Provides: bundled(python%{1}dist(six)) = 1.15 Provides: bundled(python%{1}dist(toml)) = 0.10.2 -Provides: bundled(python%{1}dist(urllib3)) = 1.26.2 +Provides: bundled(python%{1}dist(urllib3)) = 1.26.4 Provides: bundled(python%{1}dist(webencodings)) = 0.5.1 } @@ -396,6 +407,9 @@ pytest_k='not completion and %{python_wheeldir}/%{python_wheelname} %changelog +* Mon May 17 2021 Karolina Surma - 21.0.1-4 +- Backport security fixes from pip 21.1.1 + * Fri Apr 16 2021 Mohan Boddu - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 @@ -419,9 +433,6 @@ Resolves: rhbz#1922592 - New resolver - Fixes: rhbz#1893470 -* Fri Dec 04 2020 Miro Hrončok - 20.2.4-2 -- Disable tests and documentation in Fedora ELN (and RHEL) - * Mon Oct 19 2020 Lumír Balhar - 20.2.4-1 - Update to 20.2.4 (#1889112) @@ -535,7 +546,7 @@ Resolves: rhbz#1922592 - Create python-pip-wheel package with the wheel * Tue Jul 31 2018 Miro Hrončok - 18.0-2 -- Remove redundant "Unicode"" from License +- Remove redundant "Unicode" from License * Mon Jul 23 2018 Marcel Plch - 18.0-7 - Update to 18.0 @@ -752,7 +763,7 @@ Resolves: rhbz#1406922 * Fri Jan 1 2010 Peter Halliday - 0.6.1.4 - fix dependency issue * Fri Dec 18 2009 Peter Halliday - 0.6.1-2 -- fix spec file +- fix spec file * Thu Dec 17 2009 Peter Halliday - 0.6.1-1 - upgrade to 0.6.1 of pip * Mon Aug 31 2009 Peter Halliday - 0.4-1