From 30183000e946d8296e374299675588e8e3a65908 Mon Sep 17 00:00:00 2001 From: eabdullin Date: Tue, 5 Nov 2024 00:44:52 +0000 Subject: [PATCH] import UBI python3.11-urllib3-1.26.12-4.el8_10 --- SOURCES/CVE-2024-37891.patch | 66 +++++++++++++++++++++++ SOURCES/fix_test_ssltransport_py311.patch | 31 +++++++++++ SPECS/python3.11-urllib3.spec | 22 +++++++- 3 files changed, 118 insertions(+), 1 deletion(-) create mode 100644 SOURCES/CVE-2024-37891.patch create mode 100644 SOURCES/fix_test_ssltransport_py311.patch diff --git a/SOURCES/CVE-2024-37891.patch b/SOURCES/CVE-2024-37891.patch new file mode 100644 index 0000000..d6b4fa3 --- /dev/null +++ b/SOURCES/CVE-2024-37891.patch @@ -0,0 +1,66 @@ +From b2a4f7903eff44b8151ab5001198dddc7c429c72 Mon Sep 17 00:00:00 2001 +From: Quentin Pradet +Date: Wed, 25 Sep 2024 12:58:55 +0200 +Subject: [PATCH] Merge pull request from GHSA-34jh-p97f-mpxf + +* [1.26] Strip Proxy-Authorization header on redirects + +* Set release date +--- + src/urllib3/util/retry.py | 4 +++- + test/test_retry.py | 6 +++++- + test/test_retry_deprecated.py | 6 +++++- + 3 files changed, 13 insertions(+), 3 deletions(-) + +diff --git a/src/urllib3/util/retry.py b/src/urllib3/util/retry.py +index f727602..4a6eb0d 100644 +--- a/src/urllib3/util/retry.py ++++ b/src/urllib3/util/retry.py +@@ -235,7 +235,9 @@ class Retry(object): + RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503]) + + #: Default headers to be used for ``remove_headers_on_redirect`` +- DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Cookie", "Authorization"]) ++ DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset( ++ ["Cookie", "Authorization", "Proxy-Authorization"] ++ ) + + #: Maximum backoff time. + DEFAULT_BACKOFF_MAX = 120 +diff --git a/test/test_retry.py b/test/test_retry.py +index d7c216b..b23c7d1 100644 +--- a/test/test_retry.py ++++ b/test/test_retry.py +@@ -293,7 +293,11 @@ class TestRetry(object): + def test_retry_default_remove_headers_on_redirect(self): + retry = Retry() + +- assert retry.remove_headers_on_redirect == {"authorization", "cookie"} ++ assert retry.remove_headers_on_redirect == { ++ "authorization", ++ "proxy-authorization", ++ "cookie", ++ } + + def test_retry_set_remove_headers_on_redirect(self): + retry = Retry(remove_headers_on_redirect=["X-API-Secret"]) +diff --git a/test/test_retry_deprecated.py b/test/test_retry_deprecated.py +index d7905cd..0d22b0a 100644 +--- a/test/test_retry_deprecated.py ++++ b/test/test_retry_deprecated.py +@@ -295,7 +295,11 @@ class TestRetry(object): + def test_retry_default_remove_headers_on_redirect(self): + retry = Retry() + +- assert retry.remove_headers_on_redirect == {"authorization", "cookie"} ++ assert retry.remove_headers_on_redirect == { ++ "authorization", ++ "proxy-authorization", ++ "cookie", ++ } + + def test_retry_set_remove_headers_on_redirect(self): + retry = Retry(remove_headers_on_redirect=["X-API-Secret"]) +-- +2.46.0 + diff --git a/SOURCES/fix_test_ssltransport_py311.patch b/SOURCES/fix_test_ssltransport_py311.patch new file mode 100644 index 0000000..82d7cbf --- /dev/null +++ b/SOURCES/fix_test_ssltransport_py311.patch @@ -0,0 +1,31 @@ +From 00c3895e43305e8fd8394ef74d6466f90afcedb6 Mon Sep 17 00:00:00 2001 +From: Thomas Grainger +Date: Mon, 24 Apr 2023 19:10:26 +0100 +Subject: [PATCH] Fix test_ssl_object_attributes + +Co-authored-by: Seth Michael Larson +--- + test/test_ssltransport.py | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/test/test_ssltransport.py b/test/test_ssltransport.py +index f548e06..fd363a2 100644 +--- a/test/test_ssltransport.py ++++ b/test/test_ssltransport.py +@@ -202,8 +202,11 @@ class SingleTLSLayerTestCase(SocketDummyServerTestCase): + assert ssock.selected_npn_protocol() is None + + shared_ciphers = ssock.shared_ciphers() +- assert type(shared_ciphers) == list +- assert len(shared_ciphers) > 0 ++ # SSLContext.shared_ciphers() changed behavior completely in a patch version. ++ # See: https://github.com/python/cpython/issues/96931 ++ assert shared_ciphers is None or ( ++ type(shared_ciphers) is list and len(shared_ciphers) > 0 ++ ) + + assert ssock.compression() is None + +-- +2.46.2 + diff --git a/SPECS/python3.11-urllib3.spec b/SPECS/python3.11-urllib3.spec index fddcb34..8d74f13 100644 --- a/SPECS/python3.11-urllib3.spec +++ b/SPECS/python3.11-urllib3.spec @@ -8,7 +8,7 @@ Name: python%{python3_pkgversion}-%{srcname} Version: 1.26.12 -Release: 2%{?dist} +Release: 4%{?dist} Summary: Python HTTP library with thread-safe connection pooling and file post License: MIT @@ -26,6 +26,18 @@ BuildArch: noarch # Upstream fix: https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb Patch1: CVE-2023-43804.patch +# CVE-2024-37891 +# Proxy-authorization request header is not stripped during cross-origin redirects. +# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-37891 +# Upstream fix: https://github.com/urllib3/urllib3/commit/40b6d1605814dd1db0a46e202d6e56f2e4c9a468 +Patch2: CVE-2024-37891.patch + +# The implementation of ssl.SSLSocket.shared_ciphers has been fixed +# in Python 3.11.3 and that requires a fix for the testsuite. +# Upstream fix: https://github.com/urllib3/urllib3/commit/25cca389496b86ee809c21e5b641aeaa74809263 +# CPython change: https://github.com/python/cpython/issues/96931 +Patch3: fix_test_ssltransport_py311.patch + BuildRequires: python%{python3_pkgversion}-devel BuildRequires: python%{python3_pkgversion}-rpm-macros BuildRequires: python%{python3_pkgversion}-setuptools @@ -120,6 +132,14 @@ ln -s %{python3_sitelib}/__pycache__/six.cpython-%{python3_version_nodots}.pyc \ %changelog +* Tue Oct 01 2024 Lumír Balhar - 1.26.12-4 +- Fix test_ssltransport for changes in ssl.SSLSocket in Python 3.11.3 +Related: RHEL-59995 + +* Wed Sep 25 2024 Lumír Balhar - 1.26.12-3 +- Security fix for CVE-2024-37891 +Resolves: RHEL-59995 + * Fri Oct 13 2023 Lumír Balhar - 1.26.12-2 - Security fix for CVE-2023-43804 Resolves: RHEL-11996