diff --git a/SOURCES/CVE-2023-43804.patch b/SOURCES/CVE-2023-43804.patch new file mode 100644 index 0000000..c553ab6 --- /dev/null +++ b/SOURCES/CVE-2023-43804.patch @@ -0,0 +1,39 @@ +From 24603488c43a7cbaffcff7e69a72ad9bb4604acf Mon Sep 17 00:00:00 2001 +From: Lumir Balhar +Date: Thu, 12 Oct 2023 14:08:31 +0200 +Subject: [PATCH] CVE-2023-43804 + +--- + src/urllib3/util/retry.py | 2 +- + test/test_retry.py | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/urllib3/util/retry.py b/src/urllib3/util/retry.py +index 02429ee..c4a687c 100644 +--- a/src/urllib3/util/retry.py ++++ b/src/urllib3/util/retry.py +@@ -151,7 +151,7 @@ class Retry(object): + + RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503]) + +- DEFAULT_REDIRECT_HEADERS_BLACKLIST = frozenset(['Authorization']) ++ DEFAULT_REDIRECT_HEADERS_BLACKLIST = frozenset(['Cookie', 'Authorization']) + + #: Maximum backoff time. + BACKOFF_MAX = 120 +diff --git a/test/test_retry.py b/test/test_retry.py +index 7546c43..b6d52bf 100644 +--- a/test/test_retry.py ++++ b/test/test_retry.py +@@ -253,7 +253,7 @@ class TestRetry(object): + def test_retry_default_remove_headers_on_redirect(self): + retry = Retry() + +- assert list(retry.remove_headers_on_redirect) == ['authorization'] ++ assert retry.remove_headers_on_redirect == {'authorization', 'cookie'} + + def test_retry_set_remove_headers_on_redirect(self): + retry = Retry(remove_headers_on_redirect=['x-api-secret']) +-- +2.41.0 + diff --git a/SOURCES/CVE-2023-45803.patch b/SOURCES/CVE-2023-45803.patch new file mode 100644 index 0000000..d17514b --- /dev/null +++ b/SOURCES/CVE-2023-45803.patch @@ -0,0 +1,94 @@ +From 6f6011442b255b6c135c294500cf4d404f594d8a Mon Sep 17 00:00:00 2001 +From: Lumir Balhar +Date: Tue, 12 Dec 2023 10:21:34 +0100 +Subject: [PATCH] Security fix for CVE-2023-45803 + +--- + src/urllib3/_collections.py | 18 ++++++++++++++++++ + src/urllib3/connectionpool.py | 5 +++++ + src/urllib3/poolmanager.py | 7 +++++-- + 3 files changed, 28 insertions(+), 2 deletions(-) + +diff --git a/src/urllib3/_collections.py b/src/urllib3/_collections.py +index 34f2381..86fc900 100644 +--- a/src/urllib3/_collections.py ++++ b/src/urllib3/_collections.py +@@ -260,6 +260,24 @@ class HTTPHeaderDict(MutableMapping): + else: + return vals[1:] + ++ def _prepare_for_method_change(self): ++ """ ++ Remove content-specific header fields before changing the request ++ method to GET or HEAD according to RFC 9110, Section 15.4. ++ """ ++ content_specific_headers = [ ++ "Content-Encoding", ++ "Content-Language", ++ "Content-Location", ++ "Content-Type", ++ "Content-Length", ++ "Digest", ++ "Last-Modified", ++ ] ++ for header in content_specific_headers: ++ self.discard(header) ++ return self ++ + # Backwards compatibility for httplib + getheaders = getlist + getallmatchingheaders = getlist +diff --git a/src/urllib3/connectionpool.py b/src/urllib3/connectionpool.py +index f7a8f19..ad6303c 100644 +--- a/src/urllib3/connectionpool.py ++++ b/src/urllib3/connectionpool.py +@@ -32,6 +32,7 @@ from .connection import ( + HTTPConnection, HTTPSConnection, VerifiedHTTPSConnection, + HTTPException, BaseSSLError, + ) ++from ._collections import HTTPHeaderDict + from .request import RequestMethods + from .response import HTTPResponse + +@@ -679,7 +680,11 @@ class HTTPConnectionPool(ConnectionPool, RequestMethods): + redirect_location = redirect and response.get_redirect_location() + if redirect_location: + if response.status == 303: ++ # Change the method according to RFC 9110, Section 15.4.4. + method = 'GET' ++ # And lose the body not to transfer anything sensitive. ++ body = None ++ headers = HTTPHeaderDict(headers)._prepare_for_method_change() + + try: + retries = retries.increment(method, url, response=response, _pool=self) +diff --git a/src/urllib3/poolmanager.py b/src/urllib3/poolmanager.py +index 32bd973..37557f9 100644 +--- a/src/urllib3/poolmanager.py ++++ b/src/urllib3/poolmanager.py +@@ -3,7 +3,7 @@ import collections + import functools + import logging + +-from ._collections import RecentlyUsedContainer ++from ._collections import HTTPHeaderDict, RecentlyUsedContainer + from .connectionpool import HTTPConnectionPool, HTTPSConnectionPool + from .connectionpool import port_by_scheme + from .exceptions import LocationValueError, MaxRetryError, ProxySchemeUnknown +@@ -330,9 +330,12 @@ class PoolManager(RequestMethods): + # Support relative URLs for redirecting. + redirect_location = urljoin(url, redirect_location) + +- # RFC 7231, Section 6.4.4 + if response.status == 303: ++ # Change the method according to RFC 9110, Section 15.4.4. + method = 'GET' ++ # And lose the body not to transfer anything sensitive. ++ kw["body"] = None ++ kw["headers"] = HTTPHeaderDict(kw["headers"])._prepare_for_method_change() + + retries = kw.get('retries') + if not isinstance(retries, Retry): +-- +2.43.0 + diff --git a/SPECS/python-urllib3.spec b/SPECS/python-urllib3.spec index 3d1d787..14f0843 100644 --- a/SPECS/python-urllib3.spec +++ b/SPECS/python-urllib3.spec @@ -2,7 +2,7 @@ Name: python-%{srcname} Version: 1.24.2 -Release: 5%{?dist} +Release: 7%{?dist} Summary: Python HTTP library with thread-safe connection pooling and file post License: MIT @@ -32,6 +32,22 @@ Patch2: Enable_TLS_1.3_post-handshake_authentication.patch # Resolved upstream: https://github.com/urllib3/urllib3/pull/1800 Patch3: CVE-2020-26137.patch +# CVE-2023-43804 +# Added the `Cookie` header to the list of headers to strip from +# requests when redirecting to a different host. As before, different headers +# can be set via `Retry.remove_headers_on_redirect`. +# Tests backported only partially as we don't use the whole part of +# testing with dummyserver. +# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=2242493 +# Upstream fix: https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb +Patch4: CVE-2023-43804.patch + +# CVE-2023-45803 +# Remove HTTP request body when request method is changed. +# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-45803 +# Upstream fix: https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9 +Patch5: CVE-2023-45803.patch + %description Python HTTP module with connection pooling and file POST abilities. @@ -61,6 +77,8 @@ Python3 HTTP module with connection pooling and file POST abilities. %patch1 -p1 %patch2 -p1 %patch3 -p1 +%patch4 -p1 +%patch5 -p1 # Make sure that the RECENT_DATE value doesn't get too far behind what the current date is. # RECENT_DATE must not be older that 2 years from the build time, or else test_recent_date @@ -136,6 +154,14 @@ popd %changelog +* Tue Dec 12 2023 Lumír Balhar - 1.24.2-7 +- Security fix for CVE-2023-45803 +Resolves: RHEL-16872 + +* Thu Oct 12 2023 Lumír Balhar - 1.24.2-6 +- Security fix for CVE-2023-43804 +Resolves: RHEL-11992 + * Mon Nov 09 2020 Charalampos Stratakis - 1.24.2-5 - Security fix for CVE-2020-26137 Resolves: rhbz#1883889