diff --git a/00397-tarfile-filter.patch b/00397-tarfile-filter.patch index db3b9f8..172a07f 100644 --- a/00397-tarfile-filter.patch +++ b/00397-tarfile-filter.patch @@ -3247,10 +3247,120 @@ index f69cac190d9..d50f713ecad 100644 2.40.1 +From f36519078bde3cce4328c03fffccb846121fb5bc Mon Sep 17 00:00:00 2001 +From: Petr Viktorin +Date: Wed, 9 Aug 2023 20:23:03 +0200 +Subject: [PATCH] Fix symlink handling for tarfile.data_filter + +--- + Doc/library/tarfile.rst | 5 +++++ + Lib/tarfile.py | 9 ++++++++- + Lib/test/test_tarfile.py | 26 ++++++++++++++++++++++++-- + 3 files changed, 37 insertions(+), 3 deletions(-) + +diff --git a/Doc/library/tarfile.rst b/Doc/library/tarfile.rst +index 00f3070324e..e0511bfeb64 100644 +--- a/Doc/library/tarfile.rst ++++ b/Doc/library/tarfile.rst +@@ -740,6 +740,11 @@ A ``TarInfo`` object has the following public data attributes: + Name of the target file name, which is only present in :class:`TarInfo` objects + of type :const:`LNKTYPE` and :const:`SYMTYPE`. + ++ For symbolic links (``SYMTYPE``), the linkname is relative to the directory ++ that contains the link. ++ For hard links (``LNKTYPE``), the linkname is relative to the root of ++ the archive. ++ + + .. attribute:: TarInfo.uid + +diff --git a/Lib/tarfile.py b/Lib/tarfile.py +index df4e41f7a0d..d62323715b4 100755 +--- a/Lib/tarfile.py ++++ b/Lib/tarfile.py +@@ -802,7 +802,14 @@ def _get_filtered_attrs(member, dest_path, for_data=True): + if member.islnk() or member.issym(): + if os.path.isabs(member.linkname): + raise AbsoluteLinkError(member) +- target_path = os.path.realpath(os.path.join(dest_path, member.linkname)) ++ if member.issym(): ++ target_path = os.path.join(dest_path, ++ os.path.dirname(name), ++ member.linkname) ++ else: ++ target_path = os.path.join(dest_path, ++ member.linkname) ++ target_path = os.path.realpath(target_path) + if os.path.commonpath([target_path, dest_path]) != dest_path: + raise LinkOutsideDestinationError(member, target_path) + return new_attrs +diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py +index 2eda7fc4cea..79fc35c2895 100644 +--- a/Lib/test/test_tarfile.py ++++ b/Lib/test/test_tarfile.py +@@ -3337,10 +3337,12 @@ def __exit__(self, *exc): + self.bio = None + + def add(self, name, *, type=None, symlink_to=None, hardlink_to=None, +- mode=None, **kwargs): ++ mode=None, size=None, **kwargs): + """Add a member to the test archive. Call within `with`.""" + name = str(name) + tarinfo = tarfile.TarInfo(name).replace(**kwargs) ++ if size is not None: ++ tarinfo.size = size + if mode: + tarinfo.mode = _filemode_to_int(mode) + if symlink_to is not None: +@@ -3416,7 +3418,8 @@ def check_context(self, tar, filter): + raise self.raised_exception + self.assertEqual(self.expected_paths, set()) + +- def expect_file(self, name, type=None, symlink_to=None, mode=None): ++ def expect_file(self, name, type=None, symlink_to=None, mode=None, ++ size=None): + """Check a single file. See check_context.""" + if self.raised_exception: + raise self.raised_exception +@@ -3445,6 +3448,8 @@ def expect_file(self, name, type=None, symlink_to=None, mode=None): + self.assertTrue(path.is_fifo()) + else: + raise NotImplementedError(type) ++ if size is not None: ++ self.assertEqual(path.stat().st_size, size) + for parent in path.parents: + self.expected_paths.discard(parent) + +@@ -3649,6 +3654,22 @@ def test_sly_relative2(self): + + """['"].*moo['"], which is outside the """ + + "destination") + ++ def test_deep_symlink(self): ++ with ArchiveMaker() as arc: ++ arc.add('targetdir/target', size=3) ++ arc.add('linkdir/hardlink', hardlink_to='targetdir/target') ++ arc.add('linkdir/symlink', symlink_to='../targetdir/target') ++ ++ for filter in 'tar', 'data', 'fully_trusted': ++ with self.check_context(arc.open(), filter): ++ self.expect_file('targetdir/target', size=3) ++ self.expect_file('linkdir/hardlink', size=3) ++ if support.can_symlink(): ++ self.expect_file('linkdir/symlink', size=3, ++ symlink_to='../targetdir/target') ++ else: ++ self.expect_file('linkdir/symlink', size=3) ++ + def test_modes(self): + # Test how file modes are extracted + # (Note that the modes are ignored on platforms without working chmod) +-- +2.41.0 + From 8adc56296f3c78fa0b9b384f76a321b6253b2631 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 6 Mar 2023 17:24:24 +0100 -Subject: [PATCH 11/11] CVE-2007-4559, PEP-706: Add filters for tarfile +Subject: [PATCH] CVE-2007-4559, PEP-706: Add filters for tarfile extraction (downstream) Add and test RHEL-specific ways of configuring the default behavior: environment diff --git a/python3.spec b/python3.spec index 50bfe0c..6801501 100644 --- a/python3.spec +++ b/python3.spec @@ -14,7 +14,7 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well Version: %{pybasever}.8 -Release: 54%{?dist} +Release: 55%{?dist} License: Python @@ -770,6 +770,10 @@ Patch394: 00394-cve-2022-45061-cpu-denial-of-service-via-inefficient-idna-decode # The first patches in the file backport the upstream fix: # - https://github.com/python/cpython/pull/104583 # (see the linked issue for merged backports) +# Next-to-last patch fixes determination of symlink targets, which were treated +# as relative to the root of the archive, +# rather than the directory containing the symlink. +# Not yet upstream as of this writing. # The last patch is Red Hat configuration, see KB for documentation: # - https://access.redhat.com/articles/7004769 Patch397: 00397-tarfile-filter.patch @@ -2065,6 +2069,10 @@ fi # ====================================================== %changelog +* Wed Aug 09 2023 Petr Viktorin - 3.6.8-55 +- Fix symlink handling in the fix for CVE-2007-4559 +Resolves: rhbz#263261 + * Fri Jul 07 2023 Charalampos Stratakis - 3.6.8-54 - Bump release for rebuild Resolves: rhbz#2173917