new file mode 100644

@@ -0,0 +1,40 @@

+From 8f99cc799e4393bf1112b9395b2342f81b3f45ef Mon Sep 17 00:00:00 2001

+From: push0ebp <push0ebp@shl-MacBook-Pro.local>

+Date: Thu, 14 Feb 2019 02:05:46 +0900

+Subject: [PATCH] bpo-35907: Avoid file reading as disallowing the unnecessary

+ URL scheme in urllib

+

+--- a/Lib/test/test_urllib.py	2019-03-28 23:50:14.379076156 +0530

+@@ -1023,6 +1023,18 @@ class URLopener_Tests(unittest.TestCase)

+             "spam://c:|windows%/:=&?~#+!$,;'@()*[]|/path/"),

+             "//c:|windows%/:=&?~#+!$,;'@()*[]|/path/")

+ 

++def test_local_file_open(self):

++        class DummyURLopener(urllib.URLopener):

++            def open_local_file(self, url):

++                return url

++        self.assertEqual(DummyURLopener().open(

++            'local-file://example'), '//example')

++        self.assertEqual(DummyURLopener().open(

++            'local_file://example'), '//example')

++        self.assertRaises(IOError, urllib.urlopen,

++            'local-file://example')

++        self.assertRaises(IOError, urllib.urlopen,

++            'local_file://example')

+ 

+ # Just commented them out.

+ # Can't really tell why keep failing in windows and sparc.

+--- a/Lib/urllib.py	2019-03-28 23:47:22.563068712 +0530

+@@ -203,7 +203,9 @@ class URLopener:

+         name = 'open_' + urltype

+         self.type = urltype

+         name = name.replace('-', '_')

+-        if not hasattr(self, name):

++        # bpo-35907: # disallow the file reading with the type not allowed

++        if not hasattr(self, name) or \

++            (self == _urlopener and name == 'open_local_file'):

+             if proxy:

+                 return self.open_unknown_proxy(proxy, fullurl, data)

+             else:

@@ -1,7 +1,7 @@

 Summary:        A high-level scripting language

 Name:           python2

 Version:        2.7.15

-Release:        4%{?dist}

+Release:        5%{?dist}

 License:        PSF

 URL:            http://www.python.org/

 Group:          System Environment/Programming

@@ -14,6 +14,7 @@ Patch1:         added-pyopenssl-ipaddress-certificate-validation.patch

 Patch2:         python2-support-photon-platform.patch

 Patch3:         CVE-2018-14647.patch

 Patch4:         CVE-2019-9636.patch

+Patch5:         CVE-2019-9948.patch

 BuildRequires:  pkg-config >= 0.28

 BuildRequires:  bzip2-devel

 BuildRequires:  openssl-devel

@@ -116,6 +117,7 @@ The test package contains all regression tests for Python as well as the modules

 %patch2 -p1

 %patch3 -p1

 %patch4 -p1

+%patch5 -p1

 %build

 export OPT="${CFLAGS}"

@@ -238,6 +240,8 @@ make test

 %{_libdir}/python2.7/test/*

 %changelog

+*   Thu Mar 28 2019 Tapas Kundu <tkundu@vmware.com> 2.7.15-5

+-   Fix for CVE-2019-9948

 *   Tue Mar 12 2019 Tapas Kundu <tkundu@vmware.com> 2.7.15-4

 -   Added fix for CVE-2019-9636

 *   Fri Dec 21 2018 Tapas Kundu <tkundu@vmware.com> 2.7.15-3