From c1b349d462d9734a5839ed0bf3f6e0e88d7592c6 Mon Sep 17 00:00:00 2001 From: eabdullin Date: Tue, 11 Mar 2025 08:02:54 +0000 Subject: [PATCH] import CS python3.11-urllib3-1.26.12-5.el9 --- SOURCES/CVE-2023-45803.patch | 94 +++++++++++++++++++++++ SOURCES/CVE-2024-37891.patch | 66 ++++++++++++++++ SOURCES/fix_test_ssltransport_py311.patch | 31 ++++++++ SPECS/python3.11-urllib3.spec | 32 +++++++- 4 files changed, 222 insertions(+), 1 deletion(-) create mode 100644 SOURCES/CVE-2023-45803.patch create mode 100644 SOURCES/CVE-2024-37891.patch create mode 100644 SOURCES/fix_test_ssltransport_py311.patch diff --git a/SOURCES/CVE-2023-45803.patch b/SOURCES/CVE-2023-45803.patch new file mode 100644 index 0000000..7189bdc --- /dev/null +++ b/SOURCES/CVE-2023-45803.patch @@ -0,0 +1,94 @@ +From af0e3db21fcdeaaaa5b0eb58856c776c079a01ec Mon Sep 17 00:00:00 2001 +From: Lumir Balhar +Date: Tue, 12 Dec 2023 11:06:20 +0100 +Subject: [PATCH] Security fix for CVE-2023-45803 + +--- + src/urllib3/_collections.py | 18 ++++++++++++++++++ + src/urllib3/connectionpool.py | 5 +++++ + src/urllib3/poolmanager.py | 7 +++++-- + 3 files changed, 28 insertions(+), 2 deletions(-) + +diff --git a/src/urllib3/_collections.py b/src/urllib3/_collections.py +index da9857e..bceb845 100644 +--- a/src/urllib3/_collections.py ++++ b/src/urllib3/_collections.py +@@ -268,6 +268,24 @@ class HTTPHeaderDict(MutableMapping): + else: + return vals[1:] + ++ def _prepare_for_method_change(self): ++ """ ++ Remove content-specific header fields before changing the request ++ method to GET or HEAD according to RFC 9110, Section 15.4. ++ """ ++ content_specific_headers = [ ++ "Content-Encoding", ++ "Content-Language", ++ "Content-Location", ++ "Content-Type", ++ "Content-Length", ++ "Digest", ++ "Last-Modified", ++ ] ++ for header in content_specific_headers: ++ self.discard(header) ++ return self ++ + # Backwards compatibility for httplib + getheaders = getlist + getallmatchingheaders = getlist +diff --git a/src/urllib3/connectionpool.py b/src/urllib3/connectionpool.py +index 96339e9..5d2e3be 100644 +--- a/src/urllib3/connectionpool.py ++++ b/src/urllib3/connectionpool.py +@@ -36,6 +36,7 @@ from .exceptions import ( + ) + from .packages import six + from .packages.six.moves import queue ++from ._collections import HTTPHeaderDict + from .request import RequestMethods + from .response import HTTPResponse + from .util.connection import is_connection_dropped +@@ -832,7 +833,11 @@ class HTTPConnectionPool(ConnectionPool, RequestMethods): + redirect_location = redirect and response.get_redirect_location() + if redirect_location: + if response.status == 303: ++ # Change the method according to RFC 9110, Section 15.4.4. + method = "GET" ++ # And lose the body not to transfer anything sensitive. ++ body = None ++ headers = HTTPHeaderDict(headers)._prepare_for_method_change() + + try: + retries = retries.increment(method, url, response=response, _pool=self) +diff --git a/src/urllib3/poolmanager.py b/src/urllib3/poolmanager.py +index ca4ec34..5f4afe1 100644 +--- a/src/urllib3/poolmanager.py ++++ b/src/urllib3/poolmanager.py +@@ -4,7 +4,7 @@ import collections + import functools + import logging + +-from ._collections import RecentlyUsedContainer ++from ._collections import HTTPHeaderDict, RecentlyUsedContainer + from .connectionpool import HTTPConnectionPool, HTTPSConnectionPool, port_by_scheme + from .exceptions import ( + LocationValueError, +@@ -382,9 +382,12 @@ class PoolManager(RequestMethods): + # Support relative URLs for redirecting. + redirect_location = urljoin(url, redirect_location) + +- # RFC 7231, Section 6.4.4 + if response.status == 303: ++ # Change the method according to RFC 9110, Section 15.4.4. + method = "GET" ++ # And lose the body not to transfer anything sensitive. ++ kw["body"] = None ++ kw["headers"] = HTTPHeaderDict(kw["headers"])._prepare_for_method_change() + + retries = kw.get("retries") + if not isinstance(retries, Retry): +-- +2.47.0 + diff --git a/SOURCES/CVE-2024-37891.patch b/SOURCES/CVE-2024-37891.patch new file mode 100644 index 0000000..d6b4fa3 --- /dev/null +++ b/SOURCES/CVE-2024-37891.patch @@ -0,0 +1,66 @@ +From b2a4f7903eff44b8151ab5001198dddc7c429c72 Mon Sep 17 00:00:00 2001 +From: Quentin Pradet +Date: Wed, 25 Sep 2024 12:58:55 +0200 +Subject: [PATCH] Merge pull request from GHSA-34jh-p97f-mpxf + +* [1.26] Strip Proxy-Authorization header on redirects + +* Set release date +--- + src/urllib3/util/retry.py | 4 +++- + test/test_retry.py | 6 +++++- + test/test_retry_deprecated.py | 6 +++++- + 3 files changed, 13 insertions(+), 3 deletions(-) + +diff --git a/src/urllib3/util/retry.py b/src/urllib3/util/retry.py +index f727602..4a6eb0d 100644 +--- a/src/urllib3/util/retry.py ++++ b/src/urllib3/util/retry.py +@@ -235,7 +235,9 @@ class Retry(object): + RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503]) + + #: Default headers to be used for ``remove_headers_on_redirect`` +- DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Cookie", "Authorization"]) ++ DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset( ++ ["Cookie", "Authorization", "Proxy-Authorization"] ++ ) + + #: Maximum backoff time. + DEFAULT_BACKOFF_MAX = 120 +diff --git a/test/test_retry.py b/test/test_retry.py +index d7c216b..b23c7d1 100644 +--- a/test/test_retry.py ++++ b/test/test_retry.py +@@ -293,7 +293,11 @@ class TestRetry(object): + def test_retry_default_remove_headers_on_redirect(self): + retry = Retry() + +- assert retry.remove_headers_on_redirect == {"authorization", "cookie"} ++ assert retry.remove_headers_on_redirect == { ++ "authorization", ++ "proxy-authorization", ++ "cookie", ++ } + + def test_retry_set_remove_headers_on_redirect(self): + retry = Retry(remove_headers_on_redirect=["X-API-Secret"]) +diff --git a/test/test_retry_deprecated.py b/test/test_retry_deprecated.py +index d7905cd..0d22b0a 100644 +--- a/test/test_retry_deprecated.py ++++ b/test/test_retry_deprecated.py +@@ -295,7 +295,11 @@ class TestRetry(object): + def test_retry_default_remove_headers_on_redirect(self): + retry = Retry() + +- assert retry.remove_headers_on_redirect == {"authorization", "cookie"} ++ assert retry.remove_headers_on_redirect == { ++ "authorization", ++ "proxy-authorization", ++ "cookie", ++ } + + def test_retry_set_remove_headers_on_redirect(self): + retry = Retry(remove_headers_on_redirect=["X-API-Secret"]) +-- +2.46.0 + diff --git a/SOURCES/fix_test_ssltransport_py311.patch b/SOURCES/fix_test_ssltransport_py311.patch new file mode 100644 index 0000000..82d7cbf --- /dev/null +++ b/SOURCES/fix_test_ssltransport_py311.patch @@ -0,0 +1,31 @@ +From 00c3895e43305e8fd8394ef74d6466f90afcedb6 Mon Sep 17 00:00:00 2001 +From: Thomas Grainger +Date: Mon, 24 Apr 2023 19:10:26 +0100 +Subject: [PATCH] Fix test_ssl_object_attributes + +Co-authored-by: Seth Michael Larson +--- + test/test_ssltransport.py | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/test/test_ssltransport.py b/test/test_ssltransport.py +index f548e06..fd363a2 100644 +--- a/test/test_ssltransport.py ++++ b/test/test_ssltransport.py +@@ -202,8 +202,11 @@ class SingleTLSLayerTestCase(SocketDummyServerTestCase): + assert ssock.selected_npn_protocol() is None + + shared_ciphers = ssock.shared_ciphers() +- assert type(shared_ciphers) == list +- assert len(shared_ciphers) > 0 ++ # SSLContext.shared_ciphers() changed behavior completely in a patch version. ++ # See: https://github.com/python/cpython/issues/96931 ++ assert shared_ciphers is None or ( ++ type(shared_ciphers) is list and len(shared_ciphers) > 0 ++ ) + + assert ssock.compression() is None + +-- +2.46.2 + diff --git a/SPECS/python3.11-urllib3.spec b/SPECS/python3.11-urllib3.spec index 82941f3..6e895f0 100644 --- a/SPECS/python3.11-urllib3.spec +++ b/SPECS/python3.11-urllib3.spec @@ -8,7 +8,7 @@ Name: python%{python3_pkgversion}-%{srcname} Version: 1.26.12 -Release: 2%{?dist} +Release: 5%{?dist} Summary: Python HTTP library with thread-safe connection pooling and file post License: MIT @@ -26,6 +26,24 @@ BuildArch: noarch # Upstream fix: https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb Patch1: CVE-2023-43804.patch +# CVE-2024-37891 +# Proxy-authorization request header is not stripped during cross-origin redirects. +# Tracking bug: https://issues.redhat.com/browse/RHEL-43172 +# Upstream fix: https://github.com/urllib3/urllib3/commit/40b6d1605814dd1db0a46e202d6e56f2e4c9a468 +Patch2: CVE-2024-37891.patch + +# The implementation of ssl.SSLSocket.shared_ciphers has been fixed +# in Python 3.11.3 and that requires a fix for the testsuite. +# Upstream fix: https://github.com/urllib3/urllib3/commit/25cca389496b86ee809c21e5b641aeaa74809263 +# CPython change: https://github.com/python/cpython/issues/96931 +Patch3: fix_test_ssltransport_py311.patch + +# CVE-2023-45803 +# Remove HTTP request body when request method is changed. +# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-45803 +# Upstream fix: https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9 +Patch4: CVE-2023-45803.patch + BuildRequires: python%{python3_pkgversion}-devel BuildRequires: python%{python3_pkgversion}-rpm-macros BuildRequires: python%{python3_pkgversion}-setuptools @@ -120,6 +138,18 @@ ln -s %{python3_sitelib}/__pycache__/six.cpython-%{python3_version_nodots}.pyc \ %changelog +* Tue Nov 19 2024 Charalampos Stratakis - 1.26.12-5 +- Security fix for CVE-2023-45803 +Resolves: RHEL-66551 + +* Tue Oct 01 2024 Lumír Balhar - 1.26.12-4 +- Fix test_ssltransport for changes in ssl.SSLSocket in Python 3.11.3 +Related: RHEL-59991 + +* Wed Sep 25 2024 Lumír Balhar - 1.26.12-3 +- Security fix for CVE-2024-37891 +Resolves: RHEL-59991 + * Fri Oct 13 2023 Lumír Balhar - 1.26.12-2 - Security fix for CVE-2023-43804 Resolves: RHEL-12003