rpms
/
python38
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import python38-3.8.16-1.module+el8.8.0+17624+9a09af5a

This commit is contained in:
CentOS Sources 2023-03-28 12:43:24 +00:00 committed by Stepan Oksanichenko
parent c6ab7bd6a7
commit 8137883946
5 changed files with 111 additions and 262 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/Python-3.8.13-noexe.tar.xz
SOURCES/Python-3.8.16-noexe.tar.xz

2
.python38.metadata
View File

@ -1 +1 @@
b1558d21c10c88078e11d74168b06ae8a49df19f SOURCES/Python-3.8.13-noexe.tar.xz
ec97523b167d5b0e915b37e58f03da6384b15caa SOURCES/Python-3.8.16-noexe.tar.xz

196
SOURCES/00329-fips.patch
View File

@ -1,4 +1,4 @@
From 9e1da6c093529d7b314f3703158a213824c3521e Mon Sep 17 00:00:00 2001
From 31ae5d3189a0b8ec07c55df3785d27d769bc90a5 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Thu, 25 Jul 2019 16:19:52 +0200
Subject: [PATCH 01/36] Expose OpenSSL FIPS_mode() as hashlib.get_fips_mode()
@ -123,10 +123,10 @@ index 9aaea47..30fd8a9 100644
-/*[clinic end generated code: output=38c2637f67e9bb79 input=a9049054013a1b77]*/
+/*[clinic end generated code: output=5467006d93e7479e input=a9049054013a1b77]*/
--
2.31.1
2.38.1
From 5a8faeb61d7acd6c7036efe24efe269c683dc1a0 Mon Sep 17 00:00:00 2001
From 9e12b2fdecca4fba5d777923f7742fffb7b6240d Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Thu, 25 Jul 2019 17:04:06 +0200
Subject: [PATCH 02/36] Use python's fall backs for the crypto it implements
@ -410,10 +410,10 @@ index 63ae836..1bcfdf9 100644
+if not get_fips_mode():
+ del __py_new
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
index 8b53d23..e9abcbb 100644
index e6cec4e..f40cc83 100644
--- a/Lib/test/test_hashlib.py
+++ b/Lib/test/test_hashlib.py
@@ -945,6 +945,7 @@ class KDFTests(unittest.TestCase):
@@ -954,6 +954,7 @@ class KDFTests(unittest.TestCase):
iterations=1, dklen=None)
self.assertEqual(out, self.pbkdf2_results['sha1'][0][0])
@ -422,10 +422,10 @@ index 8b53d23..e9abcbb 100644
self._test_pbkdf2_hmac(py_hashlib.pbkdf2_hmac)
--
2.31.1
2.38.1
From d21c5a098dda889de21985e57f12852ce9fbbcf1 Mon Sep 17 00:00:00 2001
From a7711c418ea72f9ea18bbb70a2d52ab44489066b Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Thu, 25 Jul 2019 17:19:06 +0200
Subject: [PATCH 03/36] Disable Python's hash implementations in FIPS mode,
@ -695,10 +695,10 @@ index c1fb618..34d09b4 100644
return NULL;
}
diff --git a/setup.py b/setup.py
index c28c096..a11bbda 100644
index 0b24dd6..f7c4be1 100644
--- a/setup.py
+++ b/setup.py
@@ -1673,7 +1673,6 @@ class PyBuildExt(build_ext):
@@ -1677,7 +1677,6 @@ class PyBuildExt(build_ext):
def detect_modules(self):
self.configure_compiler()
self.init_inc_lib_dirs()
@ -706,7 +706,7 @@ index c28c096..a11bbda 100644
self.detect_simple_extensions()
if TEST_EXTENSIONS:
self.detect_test_extensions()
@@ -2161,7 +2160,7 @@ class PyBuildExt(build_ext):
@@ -2165,7 +2164,7 @@ class PyBuildExt(build_ext):
sources=sources,
depends=depends))
@ -715,7 +715,7 @@ index c28c096..a11bbda 100644
# Detect SSL support for the socket module (via _ssl)
config_vars = sysconfig.get_config_vars()
@@ -2182,7 +2181,7 @@ class PyBuildExt(build_ext):
@@ -2186,7 +2185,7 @@ class PyBuildExt(build_ext):
if not openssl_libs:
# libssl and libcrypto not found
self.missing.extend(['_ssl', '_hashlib'])
@ -724,7 +724,7 @@ index c28c096..a11bbda 100644
# Find OpenSSL includes
ssl_incs = find_file(
@@ -2190,7 +2189,7 @@ class PyBuildExt(build_ext):
@@ -2194,7 +2193,7 @@ class PyBuildExt(build_ext):
)
if ssl_incs is None:
self.missing.extend(['_ssl', '_hashlib'])
@ -733,7 +733,7 @@ index c28c096..a11bbda 100644
# OpenSSL 1.0.2 uses Kerberos for KRB5 ciphers
krb5_h = find_file(
@@ -2200,12 +2199,24 @@ class PyBuildExt(build_ext):
@@ -2204,12 +2203,24 @@ class PyBuildExt(build_ext):
if krb5_h:
ssl_incs.extend(krb5_h)
@ -761,7 +761,7 @@ index c28c096..a11bbda 100644
depends=[
'socketmodule.h',
'_ssl/debughelpers.c',
@@ -2218,22 +2229,12 @@ class PyBuildExt(build_ext):
@@ -2222,22 +2233,12 @@ class PyBuildExt(build_ext):
self.add(Extension('_hashlib', ['_hashopenssl.c'],
depends=['hashlib.h'],
@ -788,7 +788,7 @@ index c28c096..a11bbda 100644
blake2_deps = glob(os.path.join(escape(self.srcdir),
'Modules/_blake2/impl/*'))
@@ -2243,6 +2244,7 @@ class PyBuildExt(build_ext):
@@ -2247,6 +2248,7 @@ class PyBuildExt(build_ext):
['_blake2/blake2module.c',
'_blake2/blake2b_impl.c',
'_blake2/blake2s_impl.c'],
@ -796,7 +796,7 @@ index c28c096..a11bbda 100644
depends=blake2_deps))
sha3_deps = glob(os.path.join(escape(self.srcdir),
@@ -2250,7 +2252,9 @@ class PyBuildExt(build_ext):
@@ -2254,7 +2256,9 @@ class PyBuildExt(build_ext):
sha3_deps.append('hashlib.h')
self.add(Extension('_sha3',
['_sha3/sha3module.c'],
@ -808,10 +808,10 @@ index c28c096..a11bbda 100644
def detect_nis(self):
if MS_WINDOWS or CYGWIN or HOST_PLATFORM == 'qnx6':
--
2.31.1
2.38.1
From 668177d86702b10da881f76cf17bda44d8823be9 Mon Sep 17 00:00:00 2001
From 5928affee1e8306877918efc417090512faea14d Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Thu, 12 Dec 2019 16:58:31 +0100
Subject: [PATCH 04/36] Expose all hashes available to OpenSSL
@ -1310,10 +1310,10 @@ index 30fd8a9..e96a752 100644
-/*[clinic end generated code: output=5467006d93e7479e input=a9049054013a1b77]*/
+/*[clinic end generated code: output=be8e21a10dff71e7 input=a9049054013a1b77]*/
--
2.31.1
2.38.1
From 7137c003853b8672eed4d28fe8703756b75ab790 Mon Sep 17 00:00:00 2001
From eb264b74a2a6fc820813edbfa611b782edcda088 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Thu, 25 Jul 2019 18:13:45 +0200
Subject: [PATCH 05/36] Fix tests
@ -1323,7 +1323,7 @@ Subject: [PATCH 05/36] Fix tests
1 file changed, 45 insertions(+), 13 deletions(-)
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
index e9abcbb..2a55fd4 100644
index f40cc83..972eda1 100644
--- a/Lib/test/test_hashlib.py
+++ b/Lib/test/test_hashlib.py
@@ -190,7 +190,9 @@ class HashLibTestCase(unittest.TestCase):
@ -1442,10 +1442,10 @@ index e9abcbb..2a55fd4 100644
@requires_sha3
def test_extra_sha3(self):
--
2.31.1
2.38.1
From 94f13c68d2a4845e58d4c7b7adf01e64f993c4f5 Mon Sep 17 00:00:00 2001
From 7c34172f398cdea804e8a4671f996e9b3706ec7d Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 26 Jul 2019 11:27:57 +0200
Subject: [PATCH 06/36] Change FIPS exceptions from _blake2, _sha3 module init
@ -1584,10 +1584,10 @@ index 34d09b4..3079e1e 100644
if ((m = PyModule_Create(&_SHA3module)) == NULL) {
return NULL;
--
2.31.1
2.38.1
From 805af2c3dcbe1855a9fb8eb534b985aed338c2ba Mon Sep 17 00:00:00 2001
From c968e85d077123510f8b6441b169b46f6e0e9d26 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 26 Jul 2019 11:24:09 +0200
Subject: [PATCH 07/36] Make hashlib importable under FIPS mode
@ -1619,10 +1619,10 @@ index 1bcfdf9..898e6dc 100644
--
2.31.1
2.38.1
From bc3f033f0a832e6b7ddf50e1059de8fc5df08d3f Mon Sep 17 00:00:00 2001
From ea2a87a494c36eae2cc2cf343074ff0214e37517 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Fri, 26 Jul 2019 15:41:10 +0200
Subject: [PATCH 08/36] Implement hmac.new using new built-in module,
@ -2250,10 +2250,10 @@ index 0000000..b472a6e
+}
+/*[clinic end generated code: output=10b6e8cac6d7a2c9 input=a9049054013a1b77]*/
diff --git a/setup.py b/setup.py
index a11bbda..ca30105 100644
index f7c4be1..6fc7e72 100644
--- a/setup.py
+++ b/setup.py
@@ -2231,6 +2231,10 @@ class PyBuildExt(build_ext):
@@ -2235,6 +2235,10 @@ class PyBuildExt(build_ext):
depends=['hashlib.h'],
**self.detect_openssl_args()) )
@ -2265,10 +2265,10 @@ index a11bbda..ca30105 100644
# RHEL: Always force OpenSSL for md5, sha1, sha256, sha512;
# don't build Python's implementations.
--
2.31.1
2.38.1
From da75615e1f3e6b8f44a16e5113a4a6fd55e48629 Mon Sep 17 00:00:00 2001
From 03ac0fc03e418f73ed76b203f779a083312aaff9 Mon Sep 17 00:00:00 2001
From: Marcel Plch <mplch@redhat.com>
Date: Mon, 29 Jul 2019 12:45:11 +0200
Subject: [PATCH 09/36] FIPS review
@ -2480,10 +2480,10 @@ index ca95d72..216ed04 100644
+ return PyModuleDef_Init(&_hmacopenssl_def);
}
--
2.31.1
2.38.1
From f48fab4946308008e989d845ce0dbc2cff6ce9ff Mon Sep 17 00:00:00 2001
From f130424124b4cbd4b61f1dd84b69f1f4f9e766f6 Mon Sep 17 00:00:00 2001
From: Marcel Plch <mplch@redhat.com>
Date: Mon, 29 Jul 2019 13:05:04 +0200
Subject: [PATCH 10/36] revert cosmetic nitpick and remove trailing whitespace
@ -2529,10 +2529,10 @@ index 216ed04..221714c 100644
.m_methods = hmacopenssl_functions,
.m_slots = hmacopenssl_slots,
--
2.31.1
2.38.1
From dc55436077250ba791ee67692fdc8704a900987b Mon Sep 17 00:00:00 2001
From 5259a4c7bd3d1ce2f0bdbcd0c95583c95d7d0d23 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Wed, 31 Jul 2019 15:43:43 +0200
Subject: [PATCH 11/36] Add initial tests for various hashes under FIPS mode
@ -2613,10 +2613,10 @@ index 0000000..bee911e
+if __name__ == "__main__":
+ unittest.main()
--
2.31.1
2.38.1
From 446c6a790ef878bda6137ebfc570f36dee01c380 Mon Sep 17 00:00:00 2001
From c2b7ebc17d79f8c91572a790d425f9106d4dd70e Mon Sep 17 00:00:00 2001
From: Marcel Plch <mplch@redhat.com>
Date: Thu, 1 Aug 2019 16:39:37 +0200
Subject: [PATCH 12/36] Initialize HMAC type.
@ -2682,10 +2682,10 @@ index 221714c..239445a 100644
fail:
--
2.31.1
2.38.1
From 357007a6034cc3409ad2e2fe9fc77974ea6de626 Mon Sep 17 00:00:00 2001
From 931784f1a431538486905ef1d3958dfefd5478e6 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Thu, 1 Aug 2019 17:57:05 +0200
Subject: [PATCH 13/36] Use a stronger hash in multiprocessing handshake
@ -2730,10 +2730,10 @@ index 8e2facf..bb4acb6 100644
response = connection.recv_bytes(256) # reject large message
if response != WELCOME:
--
2.31.1
2.38.1
From fddd82fedc5ea8b49ceab49296c7bddb9f3f1204 Mon Sep 17 00:00:00 2001
From 8a68ba81a66181d9a4b6c7b1e77f944efada2aae Mon Sep 17 00:00:00 2001
From: Marcel Plch <mplch@redhat.com>
Date: Fri, 2 Aug 2019 17:36:01 +0200
Subject: [PATCH 14/36] Fix refcounting
@ -2804,10 +2804,10 @@ index 239445a..9c28828 100644
--
2.31.1
2.38.1
From 42f7d2fbefe161607ad146f44d2abd19fe804810 Mon Sep 17 00:00:00 2001
From 5d835c236b392e8741fabe9b9d83d5482842dd87 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 5 Aug 2019 13:37:05 +0200
Subject: [PATCH 15/36] hmac: Don't default to md5 in FIPS mode
@ -2830,10 +2830,10 @@ index daabc8c..0302364 100644
result = _hmacopenssl.new(key, digestmod=name)
if msg:
--
2.31.1
2.38.1
From e285342c3b17de9b13ccbf2dbdb68cce5b4df86c Mon Sep 17 00:00:00 2001
From d865fb5a73ffaf39de68b69c9ccb81ca17b6c430 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 5 Aug 2019 14:20:58 +0200
Subject: [PATCH 16/36] Make _hmacopenssl.HMAC subclassable; subclass it as
@ -3121,10 +3121,10 @@ index b472a6e..861acc1 100644
-/*[clinic end generated code: output=10b6e8cac6d7a2c9 input=a9049054013a1b77]*/
+/*[clinic end generated code: output=d93ad460795d49b5 input=a9049054013a1b77]*/
--
2.31.1
2.38.1
From 5dab92e1f96fc0940a2d5d365708329e8c282587 Mon Sep 17 00:00:00 2001
From 0a75e9886721aa076542a40159b02fbd18bd8cd3 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 5 Aug 2019 16:10:36 +0200
Subject: [PATCH 17/36] Fix _hmacopenssl.HMAC.block_size
@ -3147,10 +3147,10 @@ index 7d3d973..a24c8ba 100644
static PyMethodDef Hmac_methods[] = {
--
2.31.1
2.38.1
From d39cc2e44d6debffce096b82d30909e2662379ab Mon Sep 17 00:00:00 2001
From 68b4ee700ed23422472c9b96cf0631cb5a5dab6e Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 5 Aug 2019 15:02:08 +0200
Subject: [PATCH 18/36] distutils upload: Skip md5 checksum in FIPS mode
@ -3229,10 +3229,10 @@ index c17d8e7..b4b64e9 100644
def test_upload_fails(self):
--
2.31.1
2.38.1
From 124f7e862bdbf6615e64fedfa73a76e199d68644 Mon Sep 17 00:00:00 2001
From 62c8250c2996af8e4d112676c0995616583fafa7 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 5 Aug 2019 15:32:25 +0200
Subject: [PATCH 19/36] Fix HMAC tests on FIPS mode
@ -3322,10 +3322,10 @@ index 23c108f..0a85981 100644
def test_equality(self):
# Testing if the copy has the same digests.
--
2.31.1
2.38.1
From 6bc6c745da5c2d860de9f76402ccf554e398bbbc Mon Sep 17 00:00:00 2001
From a7f5d3a4712694e6b74295ba6980c554b56d7227 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 5 Aug 2019 16:37:12 +0200
Subject: [PATCH 20/36] test_tools: Skip md5sum tests in FIPS mode
@ -3355,10 +3355,10 @@ index fb565b7..7028a4d 100644
@classmethod
def setUpClass(cls):
--
2.31.1
2.38.1
From 22f2476f2a19dfc4e4c25e5df2f059bf8e15d397 Mon Sep 17 00:00:00 2001
From 9e6cfe34f7377761f758d57a1b68a62fd4d0f2d1 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 5 Aug 2019 18:23:57 +0200
Subject: [PATCH 21/36] Make hashlib tests pass in FIPS mode
@ -3368,7 +3368,7 @@ Subject: [PATCH 21/36] Make hashlib tests pass in FIPS mode
1 file changed, 48 insertions(+), 19 deletions(-)
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
index 2a55fd4..9ae5efc 100644
index 972eda1..19a9868 100644
--- a/Lib/test/test_hashlib.py
+++ b/Lib/test/test_hashlib.py
@@ -28,6 +28,11 @@ COMPILED_WITH_PYDEBUG = hasattr(sys, 'gettotalrefcount')
@ -3528,7 +3528,7 @@ index 2a55fd4..9ae5efc 100644
@unittest.skipIf(sys.maxsize < _4G - 1, 'test cannot run on 32-bit systems')
@bigmemtest(size=_4G - 1, memuse=1, dry_run=False)
def test_case_md5_uintmax(self, size):
@@ -842,14 +869,16 @@ class HashLibTestCase(unittest.TestCase):
@@ -851,14 +878,16 @@ class HashLibTestCase(unittest.TestCase):
m = cons(b'x' * gil_minsize)
m.update(b'1')
@ -3550,10 +3550,10 @@ index 2a55fd4..9ae5efc 100644
@support.reap_threads
def test_threaded_hashing(self):
--
2.31.1
2.38.1
From ca8655cc0f8c1bcfb5ae970d33a826c092746203 Mon Sep 17 00:00:00 2001
From 22b6dcc045d87d130852bc4f017cfb6305b329dd Mon Sep 17 00:00:00 2001
From: Lumir Balhar <lbalhar@redhat.com>
Date: Wed, 14 Aug 2019 14:43:07 +0200
Subject: [PATCH 22/36] distutils upload: only add md5 if available, but
@ -3620,10 +3620,10 @@ index b4b64e9..f720a79 100644
def test_upload_fails(self):
--
2.31.1
2.38.1
From 12f506902ee04749565485bb60f0b927b2895e71 Mon Sep 17 00:00:00 2001
From b02daa9dbf4fcd2d1e067d63873d276bd7bf132f Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Fri, 13 Sep 2019 02:30:00 +0200
Subject: [PATCH 23/36] bpo-9216: Add usedforsecurity to hashlib constructors
@ -3709,7 +3709,7 @@ index f5da6ec..86b9f65 100644
These functions return the corresponding hash objects for calculating
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
index 9ae5efc..08bb91f 100644
index 19a9868..3ee9b14 100644
--- a/Lib/test/test_hashlib.py
+++ b/Lib/test/test_hashlib.py
@@ -226,6 +226,15 @@ class HashLibTestCase(unittest.TestCase):
@ -5854,10 +5854,10 @@ index 4167fd3..504d40a 100644
SHAobject *new;
Py_buffer buf;
--
2.31.1
2.38.1
From 041f34e22d7c458b611a72e3927deb85f20d1a85 Mon Sep 17 00:00:00 2001
From 0ee86826a425528d1f129788ad3e9e144e81da83 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 26 Aug 2019 19:09:39 +0200
Subject: [PATCH 24/36] Test the usedforsecurity flag
@ -5867,7 +5867,7 @@ Subject: [PATCH 24/36] Test the usedforsecurity flag
1 file changed, 54 insertions(+), 34 deletions(-)
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
index 08bb91f..1368e91 100644
index 3ee9b14..a991f0a 100644
--- a/Lib/test/test_hashlib.py
+++ b/Lib/test/test_hashlib.py
@@ -21,6 +21,7 @@ from test import support
@ -6080,9 +6080,9 @@ index 08bb91f..1368e91 100644
- self.check('md5', b'A'*size, '28138d306ff1b8281f1a9067e1a1a2b3')
+ self.check('md5', b'A'*size, '28138d306ff1b8281f1a9067e1a1a2b3', usedforsecurity=False)
# use the three examples from Federal Information Processing Standards
# Publication 180-1, Secure Hash Standard, 1995 April 17
@@ -925,6 +935,16 @@ class HashLibTestCase(unittest.TestCase):
@unittest.skipIf(sys.maxsize < _4G - 1, 'test cannot run on 32-bit systems')
@bigmemtest(size=_4G - 1, memuse=1, dry_run=False)
@@ -934,6 +944,16 @@ class HashLibTestCase(unittest.TestCase):
self.assertEqual(expected_hash, hasher.hexdigest())
@ -6100,10 +6100,10 @@ index 08bb91f..1368e91 100644
class KDFTests(unittest.TestCase):
--
2.31.1
2.38.1
From 6ae69003979add3243d700e1f5154cf83818ea62 Mon Sep 17 00:00:00 2001
From 7602d70630fa0e736ad518b243079b658893d653 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Thu, 29 Aug 2019 10:25:28 +0200
Subject: [PATCH 25/36] Skip error checking in _hashlib.get_fips_mode
@ -6155,10 +6155,10 @@ index b4d05ab..a48b607 100644
--
2.31.1
2.38.1
From 95b58ae12206c7889e0159a720c1a96fcb2dc050 Mon Sep 17 00:00:00 2001
From 07552e7758fdc9c9610d773b4100d4686b5353a3 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Thu, 10 Oct 2019 13:04:50 +0200
Subject: [PATCH 26/36] Skip error checking in _Py_hashlib_fips_error
@ -6193,10 +6193,10 @@ index 47ed003..d4cbdef 100644
}
PyErr_Format(exc, "%s is not available in FIPS mode", name);
--
2.31.1
2.38.1
From ba0462edf8fb3ae3cb04151460002cf687758605 Mon Sep 17 00:00:00 2001
From 8be15a9faf79a062be4b0f27605737bc34687e68 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 5 Aug 2019 19:12:38 +0200
Subject: [PATCH 27/36] Fixups
@ -6235,10 +6235,10 @@ index 0a85981..0b481ec 100644
h1 = hmac.HMAC(b"key", digestmod="sha1")
h2 = h1.copy()
--
2.31.1
2.38.1
From d2596ea3fab68d2fc586abaae64323599c2a74c8 Mon Sep 17 00:00:00 2001
From 112646fbf2af81df1750140f7486b32296518099 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 26 Aug 2019 19:39:48 +0200
Subject: [PATCH 28/36] Don't re-export get_fips_mode from hashlib
@ -6446,7 +6446,7 @@ index 34812e6..86e61e2 100644
self.compare_hashes(hashlib.shake_128(b'abc'), _hashlib.openssl_shake_128(b'abc'))
self.compare_hashes(hashlib.shake_256(b'abc'), _hashlib.openssl_shake_256(b'abc'))
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
index 1368e91..a4b7840 100644
index a991f0a..b535059 100644
--- a/Lib/test/test_hashlib.py
+++ b/Lib/test/test_hashlib.py
@@ -29,7 +29,9 @@ COMPILED_WITH_PYDEBUG = hasattr(sys, 'gettotalrefcount')
@ -6502,7 +6502,7 @@ index 1368e91..a4b7840 100644
self.check_blocksize_name('md5', 64, 16)
self.check_blocksize_name('sha1', 64, 20)
self.check_blocksize_name('sha224', 64, 28)
@@ -935,7 +937,7 @@ class HashLibTestCase(unittest.TestCase):
@@ -944,7 +946,7 @@ class HashLibTestCase(unittest.TestCase):
self.assertEqual(expected_hash, hasher.hexdigest())
@ -6551,7 +6551,7 @@ index 0b481ec..cc77928 100644
def test_realcopy(self):
# Testing if the copy method created a real copy.
diff --git a/Lib/test/test_smtplib.py b/Lib/test/test_smtplib.py
index c9205ae..e4d7fb4 100644
index d14eb45..af53ec9 100644
--- a/Lib/test/test_smtplib.py
+++ b/Lib/test/test_smtplib.py
@@ -17,6 +17,8 @@ import select
@ -6563,7 +6563,7 @@ index c9205ae..e4d7fb4 100644
import unittest
from test import support, mock_socket
@@ -1059,7 +1061,7 @@ class SMTPSimTests(unittest.TestCase):
@@ -1114,7 +1116,7 @@ class SMTPSimTests(unittest.TestCase):
def testAUTH_multiple(self):
# Test that multiple authentication methods are tried.
@ -6605,10 +6605,10 @@ index 1cb358f..6f5cb7f 100644
from test import support
--
2.31.1
2.38.1
From 7873a4a314732768bc4d11a095ae50f0553bdebd Mon Sep 17 00:00:00 2001
From 69a0ddba408a9595aa0fc5b3fdfe7e59838acea2 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Wed, 20 Nov 2019 10:59:25 +0100
Subject: [PATCH 29/36] Use FIPS compliant CSPRNG
@ -6773,10 +6773,10 @@ index eb2b6d0..cb38cfe 100644
return win32_urandom((unsigned char *)buffer, size, raise);
#else
--
2.31.1
2.38.1
From 99ee25369116bf17731502e77a81bd0c5ac59b38 Mon Sep 17 00:00:00 2001
From 72894033d2c1d29897204c5272d8f2878c17254c Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Thu, 28 Nov 2019 17:26:02 +0100
Subject: [PATCH 30/36] Fixups for FIPS compliant CSPRNG
@ -6872,10 +6872,10 @@ index cb38cfe..08fa29a 100644
return 0;
}
--
2.31.1
2.38.1
From 3750c8b8b4c09c6bc795721bc353da23b015fe4d Mon Sep 17 00:00:00 2001
From d8bc6ab755acf0e2feffda802aeed032a2319df8 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Thu, 2 Apr 2020 16:50:37 +0200
Subject: [PATCH 31/36] Do not raise a ValueError if digestmod is missing in
@ -6902,10 +6902,10 @@ index 5055027..ee1ad76 100644
return digestmod.lower()
elif callable(digestmod):
--
2.31.1
2.38.1
From 737af204f04bb39e5f87d53fe07713137639234e Mon Sep 17 00:00:00 2001
From 9dd6dc8c11b96ac74abf220ed76d1176041c3711 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Thu, 2 Apr 2020 16:55:36 +0200
Subject: [PATCH 32/36] Regenerate the clinic files
@ -6989,10 +6989,10 @@ index 861acc1..527be83 100644
-/*[clinic end generated code: output=d93ad460795d49b5 input=a9049054013a1b77]*/
+/*[clinic end generated code: output=9b75c31e1116bf6f input=a9049054013a1b77]*/
--
2.31.1
2.38.1
From d0e7edf46ceef6ffb6075bb8b8b966f31df018fc Mon Sep 17 00:00:00 2001
From f646402958e8d284519ef7f72d0225ace210ffa7 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 7 Apr 2020 15:16:45 +0200
Subject: [PATCH 33/36] Pass kwargs (like usedforsecurity) through __hash_new
@ -7024,10 +7024,10 @@ index 2fc214e..785858f 100644
try:
--
2.31.1
2.38.1
From 0e3f635871d22831cbb5f0bffb9962f2a1ad29eb Mon Sep 17 00:00:00 2001
From bd206ed69e7c19b62f0174a649b5c2d03f0d9f5b Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Tue, 7 Apr 2020 15:18:48 +0200
Subject: [PATCH 34/36] Adjust new upstream test for failing hashes with
@ -7038,7 +7038,7 @@ Subject: [PATCH 34/36] Adjust new upstream test for failing hashes with
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
index a4b7840..a858bf4 100644
index b535059..6e846c4 100644
--- a/Lib/test/test_hashlib.py
+++ b/Lib/test/test_hashlib.py
@@ -239,15 +239,23 @@ class HashLibTestCase(unittest.TestCase):
@ -7070,10 +7070,10 @@ index a4b7840..a858bf4 100644
self.assertRaises(ValueError, hashlib.new, 'spam spam spam spam spam')
self.assertRaises(TypeError, hashlib.new, 1)
--
2.31.1
2.38.1
From 8145cfd2f71749a9fe844e5abc725f36e9085b22 Mon Sep 17 00:00:00 2001
From d1ce20110573989382948a901896169eb637b265 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Fri, 24 Apr 2020 19:57:16 +0200
Subject: [PATCH 35/36] Skip the test_with_digestmod_no_default under FIPS
@ -7116,10 +7116,10 @@ index cc77928..fd068e0 100644
class ConstructorTestCase(unittest.TestCase):
--
2.31.1
2.38.1
From 969498fda9699b2e9d2df4a78a671e37d578daea Mon Sep 17 00:00:00 2001
From bff06e176e60200582a42611d4fe3c240da314a3 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Tue, 31 Mar 2020 18:00:42 +0200
Subject: [PATCH 36/36] Add a sentinel value on the Hmac_members table of the
@ -7142,5 +7142,5 @@ index 9577cad..4bd7c15 100644
PyDoc_STRVAR(hmactype_doc,
--
2.31.1
2.38.1

150
SOURCES/00382-cve-2015-20107.patch
View File

@ -1,150 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com>
Date: Fri, 3 Jun 2022 11:43:35 +0200
Subject: [PATCH] 00382: CVE-2015-20107
Make mailcap refuse to match unsafe filenames/types/params (GH-91993)
Upstream: https://github.com/python/cpython/issues/68966
Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390
---
Doc/library/mailcap.rst | 12 +++++++++
Lib/mailcap.py | 26 +++++++++++++++++--
Lib/test/test_mailcap.py | 8 ++++--
...2-04-27-18-25-30.gh-issue-68966.gjS8zs.rst | 4 +++
4 files changed, 46 insertions(+), 4 deletions(-)
create mode 100644 Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst
diff --git a/Doc/library/mailcap.rst b/Doc/library/mailcap.rst
index bf9639bdac..a75857be62 100644
--- a/Doc/library/mailcap.rst
+++ b/Doc/library/mailcap.rst
@@ -54,6 +54,18 @@ standard. However, mailcap files are supported on most Unix systems.
use) to determine whether or not the mailcap line applies. :func:`findmatch`
will automatically check such conditions and skip the entry if the check fails.
+ .. versionchanged:: 3.11
+
+ To prevent security issues with shell metacharacters (symbols that have
+ special effects in a shell command line), ``findmatch`` will refuse
+ to inject ASCII characters other than alphanumerics and ``@+=:,./-_``
+ into the returned command line.
+
+ If a disallowed character appears in *filename*, ``findmatch`` will always
+ return ``(None, None)`` as if no entry was found.
+ If such a character appears elsewhere (a value in *plist* or in *MIMEtype*),
+ ``findmatch`` will ignore all mailcap entries which use that value.
+ A :mod:`warning <warnings>` will be raised in either case.
.. function:: getcaps()
diff --git a/Lib/mailcap.py b/Lib/mailcap.py
index bd0fc0981c..dcd4b449e8 100644
--- a/Lib/mailcap.py
+++ b/Lib/mailcap.py
@@ -2,6 +2,7 @@
import os
import warnings
+import re
__all__ = ["getcaps","findmatch"]
@@ -13,6 +14,11 @@ def lineno_sort_key(entry):
else:
return 1, 0
+_find_unsafe = re.compile(r'[^\xa1-\U0010FFFF\w@+=:,./-]').search
+
+class UnsafeMailcapInput(Warning):
+ """Warning raised when refusing unsafe input"""
+
# Part 1: top-level interface.
@@ -165,15 +171,22 @@ def findmatch(caps, MIMEtype, key='view', filename="/dev/null", plist=[]):
entry to use.
"""
+ if _find_unsafe(filename):
+ msg = "Refusing to use mailcap with filename %r. Use a safe temporary filename." % (filename,)
+ warnings.warn(msg, UnsafeMailcapInput)
+ return None, None
entries = lookup(caps, MIMEtype, key)
# XXX This code should somehow check for the needsterminal flag.
for e in entries:
if 'test' in e:
test = subst(e['test'], filename, plist)
+ if test is None:
+ continue
if test and os.system(test) != 0:
continue
command = subst(e[key], MIMEtype, filename, plist)
- return command, e
+ if command is not None:
+ return command, e
return None, None
def lookup(caps, MIMEtype, key=None):
@@ -206,6 +219,10 @@ def subst(field, MIMEtype, filename, plist=[]):
elif c == 's':
res = res + filename
elif c == 't':
+ if _find_unsafe(MIMEtype):
+ msg = "Refusing to substitute MIME type %r into a shell command." % (MIMEtype,)
+ warnings.warn(msg, UnsafeMailcapInput)
+ return None
res = res + MIMEtype
elif c == '{':
start = i
@@ -213,7 +230,12 @@ def subst(field, MIMEtype, filename, plist=[]):
i = i+1
name = field[start:i]
i = i+1
- res = res + findparam(name, plist)
+ param = findparam(name, plist)
+ if _find_unsafe(param):
+ msg = "Refusing to substitute parameter %r (%s) into a shell command" % (param, name)
+ warnings.warn(msg, UnsafeMailcapInput)
+ return None
+ res = res + param
# XXX To do:
# %n == number of parts if type is multipart/*
# %F == list of alternating type and filename for parts
diff --git a/Lib/test/test_mailcap.py b/Lib/test/test_mailcap.py
index c08423c670..920283d9a2 100644
--- a/Lib/test/test_mailcap.py
+++ b/Lib/test/test_mailcap.py
@@ -121,7 +121,8 @@ class HelperFunctionTest(unittest.TestCase):
(["", "audio/*", "foo.txt"], ""),
(["echo foo", "audio/*", "foo.txt"], "echo foo"),
(["echo %s", "audio/*", "foo.txt"], "echo foo.txt"),
- (["echo %t", "audio/*", "foo.txt"], "echo audio/*"),
+ (["echo %t", "audio/*", "foo.txt"], None),
+ (["echo %t", "audio/wav", "foo.txt"], "echo audio/wav"),
(["echo \\%t", "audio/*", "foo.txt"], "echo %t"),
(["echo foo", "audio/*", "foo.txt", plist], "echo foo"),
(["echo %{total}", "audio/*", "foo.txt", plist], "echo 3")
@@ -205,7 +206,10 @@ class FindmatchTest(unittest.TestCase):
('"An audio fragment"', audio_basic_entry)),
([c, "audio/*"],
{"filename": fname},
- ("/usr/local/bin/showaudio audio/*", audio_entry)),
+ (None, None)),
+ ([c, "audio/wav"],
+ {"filename": fname},
+ ("/usr/local/bin/showaudio audio/wav", audio_entry)),
([c, "message/external-body"],
{"plist": plist},
("showexternal /dev/null default john python.org /tmp foo bar", message_entry))
diff --git a/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst b/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst
new file mode 100644
index 0000000000..da81a1f699
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst
@@ -0,0 +1,4 @@
+The deprecated mailcap module now refuses to inject unsafe text (filenames,
+MIME types, parameters) into shell commands. Instead of using such text, it
+will warn and act as if a match was not found (or for test commands, as if
+the test failed).

23
SPECS/python38.spec
View File

@ -13,7 +13,7 @@ URL: https://www.python.org/
# WARNING When rebasing to a new Python version,
# remember to update the python3-docs package as well
%global general_version %{pybasever}.13
%global general_version %{pybasever}.16
#global prerel ...
%global upstream_version %{general_version}%{?prerel}
Version: %{general_version}%{?prerel:~%{prerel}}
@ -382,16 +382,6 @@ Patch359: 00359-CVE-2021-23336.patch
# Upstream: https://bugs.python.org/issue46811
Patch378: 00378-support-expat-2-4-5.patch
# 00382 #
# CVE-2015-20107
#
# Make mailcap refuse to match unsafe filenames/types/params (GH-91993)
#
# Upstream: https://github.com/python/cpython/issues/68966
#
# Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390
Patch382: 00382-cve-2015-20107.patch
# (New patches go here ^^^)
#
# When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@ -749,7 +739,6 @@ rm Lib/ensurepip/_bundled/*.whl
%patch353 -p1
%patch359 -p1
%patch378 -p1
%patch382 -p1
# Remove files that should be generated by the build
# (This is after patching, so that we can use patches directly from upstream)
@ -1838,6 +1827,16 @@ fi
# ======================================================
%changelog
* Tue Dec 13 2022 Charalampos Stratakis <cstratak@redhat.com> - 3.8.16-1
- Update to 3.8.16
- Security fix for CVE-2022-45061
Resolves: rhbz#2144072
* Mon Sep 12 2022 Charalampos Stratakis <cstratak@redhat.com> - 3.8.14-1
- Rebase to 3.8.14
- Security fixes for CVE-2020-10735 and CVE-2021-28861
Resolves: rhbz#1834423, rhbz#2120642
* Tue Jun 14 2022 Charalampos Stratakis <cstratak@redhat.com> - 3.8.13-1
- Rebase to 3.8.13
- Security fix for CVE-2015-20107