import python3x-pip-19.3.1-2.module+el8.5.0+11355+da85e731

SOURCES/CVE-2021-3572.patch

@@ -0,0 +1,34 @@
+From 4f0099156245ed2873d6945d5e58db741e15836d Mon Sep 17 00:00:00 2001
+From: Lumir Balhar <lbalhar@redhat.com>
+Date: Tue, 8 Jun 2021 09:51:47 +0200
+Subject: [PATCH] CVE-2021-3572
+
+---
+ src/pip/_internal/vcs/git.py | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/pip/_internal/vcs/git.py b/src/pip/_internal/vcs/git.py
+index 92b8457..7b3cc4a 100644
+--- a/src/pip/_internal/vcs/git.py
++++ b/src/pip/_internal/vcs/git.py
+@@ -120,9 +120,15 @@ class Git(VersionControl):
+         output = cls.run_command(['show-ref', rev], cwd=dest,
+                                  show_stdout=False, on_returncode='ignore')
+         refs = {}
+-        for line in output.strip().splitlines():
++        # NOTE: We do not use splitlines here since that would split on other
++        #       unicode separators, which can be maliciously used to install a
++        #       different revision.
++        for line in output.strip().split("\n"):
++            line = line.rstrip("\r")
++            if not line:
++                continue
+             try:
+-                sha, ref = line.split()
++                sha, ref = line.split(" ", maxsplit=2)
+             except ValueError:
+                 # Include the offending line to simplify troubleshooting if
+                 # this error ever occurs.
+-- 
+2.31.1
+

SPECS/python3x-pip.spec

@@ -16,7 +16,7 @@ Name:           python3x-%{srcname}
 # When updating, update the bundled libraries versions bellow!
 # You can use vendor_meta.sh in the dist git repo
 Version:        19.3.1
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A tool for installing and managing Python packages
 
 # We bundle a lot of libraries with pip, which itself is under MIT license.
@@ -91,6 +91,11 @@ Patch4:         dummy-certifi.patch
 # https://github.com/pypa/pip/pull/7359
 Patch5:         network-tests.patch
 
+# Patch for CVE-2021-3572 - pip incorrectly handled unicode separators in git references
+# Upstream PR: https://github.com/pypa/pip/pull/9827
+# Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1962856
+Patch6:         CVE-2021-3572.patch
+
 # Downstream only patch
 # Users might have local installations of pip from using
 # `pip install --user --upgrade pip` on older/newer versions.
@@ -242,6 +247,7 @@ popd
 %patch3 -p1
 %patch4 -p1
 %patch5 -p1
+%patch6 -p1
 
 # this goes together with patch4
 rm src/pip/_vendor/certifi/*.pem
@@ -403,6 +409,10 @@ fi
 %{python_wheeldir}/%{python_wheelname}
 
 %changelog
+* Tue Jun 08 2021 Lumír Balhar <lbalhar@redhat.com> - 19.3.1-2
+- Fix for CVE-2021-3572 - pip incorrectly handled unicode separators in git references
+Resolves: rhbz#1962856
+
 * Thu Apr 23 2020 Lumír Balhar <lbalhar@redhat.com> - 19.3.1
 - Rebase to 19.3.1 to enable support for manylinux2014
 Resolves: rhbz#1827623