Browse code

python3- Fix CVE-2019-5010 and CVE-2019-9740

Change-Id: I50361f452f4ec82fb09279b5c399a3a640042c92
Signed-off-by: Tapas Kundu <tkundu@vmware.com>
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/7278
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>

Tapas Kundu authored on 2019/05/23 23:30:13
Showing 3 changed files
1 1
new file mode 100644
... ...
@@ -0,0 +1,99 @@
0
+From be5de958e9052e322b0087c6dba81cdad0c3e031 Mon Sep 17 00:00:00 2001
1
+From: "Miss Islington (bot)"
2
+ <31488909+miss-islington@users.noreply.github.com>
3
+Date: Tue, 15 Jan 2019 15:03:36 -0800
4
+Subject: [PATCH] bpo-35746: Fix segfault in ssl's cert parser (GH-11569)
5
+
6
+Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
7
+distribution points with empty DP or URI correctly. A malicious or buggy
8
+certificate can result into segfault.
9
+
10
+Signed-off-by: Christian Heimes <christian@python.org>
11
+
12
+https://bugs.python.org/issue35746
13
+(cherry picked from commit a37f52436f9aa4b9292878b72f3ff1480e2606c3)
14
+
15
+Co-authored-by: Christian Heimes <christian@python.org>
16
+
17
+--- a/Lib/test/talos-2019-0758.pem_org	2019-05-23 19:43:42.334357436 +0530
18
+@@ -0,0 +1,22 @@
19
++MIIDqDCCApKgAwIBAgIBAjALBgkqhkiG9w0BAQswHzELMAkGA1UEBhMCVUsxEDAO
20
++BgNVBAMTB2NvZHktY2EwHhcNMTgwNjE4MTgwMDU4WhcNMjgwNjE0MTgwMDU4WjA7
21
++MQswCQYDVQQGEwJVSzEsMCoGA1UEAxMjY29kZW5vbWljb24tdm0tMi50ZXN0Lmxh
22
++bC5jaXNjby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC63fGB
23
++J80A9Av1GB0bptslKRIUtJm8EeEu34HkDWbL6AJY0P8WfDtlXjlPaLqFa6sqH6ES
24
++V48prSm1ZUbDSVL8R6BYVYpOlK8/48xk4pGTgRzv69gf5SGtQLwHy8UPBKgjSZoD
25
++5a5k5wJXGswhKFFNqyyxqCvWmMnJWxXTt2XDCiWc4g4YAWi4O4+6SeeHVAV9rV7C
26
++1wxqjzKovVe2uZOHjKEzJbbIU6JBPb6TRfMdRdYOw98n1VXDcKVgdX2DuuqjCzHP
27
++WhU4Tw050M9NaK3eXp4Mh69VuiKoBGOLSOcS8reqHIU46Reg0hqeL8LIL6OhFHIF
28
++j7HR6V1X6F+BfRS/AgMBAAGjgdYwgdMwCQYDVR0TBAIwADAdBgNVHQ4EFgQUOktp
29
++HQjxDXXUg8prleY9jeLKeQ4wTwYDVR0jBEgwRoAUx6zgPygZ0ZErF9sPC4+5e2Io
30
++UU+hI6QhMB8xCzAJBgNVBAYTAlVLMRAwDgYDVQQDEwdjb2R5LWNhggkA1QEAuwb7
31
++2s0wCQYDVR0SBAIwADAuBgNVHREEJzAlgiNjb2Rlbm9taWNvbi12bS0yLnRlc3Qu
32
++bGFsLmNpc2NvLmNvbTAOBgNVHQ8BAf8EBAMCBaAwCwYDVR0fBAQwAjAAMAsGCSqG
33
++SIb3DQEBCwOCAQEAvqantx2yBlM11RoFiCfi+AfSblXPdrIrHvccepV4pYc/yO6p
34
++t1f2dxHQb8rWH3i6cWag/EgIZx+HJQvo0rgPY1BFJsX1WnYf1/znZpkUBGbVmlJr
35
++t/dW1gSkNS6sPsM0Q+7HPgEv8CPDNK5eo7vU2seE0iWOkxSyVUuiCEY9ZVGaLVit
36
++p0C78nZ35Pdv4I+1cosmHl28+es1WI22rrnmdBpH8J1eY6WvUw2xuZHLeNVN0TzV
37
++Q3qq53AaCWuLOD1AjESWuUCxMZTK9DPS4JKXTK8RLyDeqOvJGjsSWp3kL0y3GaQ+
38
++10T1rfkKJub2+m9A9duin1fn6tHc2wSvB7m3DA==
39
++-----END CERTIFICATE-----
40
+--- a/Lib/test/test_ssl.py_org	2019-05-23 19:44:27.710358343 +0530
41
+@@ -117,6 +117,7 @@ NONEXISTINGCERT = data_file("XXXnonexist
42
+ BADKEY = data_file("badkey.pem")
43
+ NOKIACERT = data_file("nokia.pem")
44
+ NULLBYTECERT = data_file("nullbytecert.pem")
45
++TALOS_INVALID_CRLDP = data_file("talos-2019-0758.pem")
46
+ 
47
+ DHFILE = data_file("dh1024.pem")
48
+ BYTES_DHFILE = os.fsencode(DHFILE)
49
+@@ -364,6 +365,27 @@ class BasicSocketTests(unittest.TestCase
50
+         self.assertEqual(p['crlDistributionPoints'],
51
+                          ('http://SVRIntl-G3-crl.verisign.com/SVRIntlG3.crl',))
52
+ 
53
++    def test_parse_cert_CVE_2019_5010(self):
54
++        p = ssl._ssl._test_decode_cert(TALOS_INVALID_CRLDP)
55
++        if support.verbose:
56
++            sys.stdout.write("\n" + pprint.pformat(p) + "\n")
57
++        self.assertEqual(
58
++            p,
59
++            {
60
++                'issuer': (
61
++                    (('countryName', 'UK'),), (('commonName', 'cody-ca'),)),
62
++                'notAfter': 'Jun 14 18:00:58 2028 GMT',
63
++                'notBefore': 'Jun 18 18:00:58 2018 GMT',
64
++                'serialNumber': '02',
65
++                'subject': ((('countryName', 'UK'),),
66
++                            (('commonName',
67
++                              'codenomicon-vm-2.test.lal.cisco.com'),)),
68
++                'subjectAltName': (
69
++                    ('DNS', 'codenomicon-vm-2.test.lal.cisco.com'),),
70
++                'version': 3
71
++            }
72
++        )
73
++
74
+     def test_parse_cert_CVE_2013_4238(self):
75
+         p = ssl._ssl._test_decode_cert(NULLBYTECERT)
76
+         if support.verbose:
77
+--- a/Misc/NEWS.d/next/Security/2019-01-15-18-16-05.bpo-35746.nMSd0j.rst_org	2019-05-23 19:46:36.086360907 +0530
78
+@@ -0,0 +1,3 @@
79
++[CVE-2019-5010] Fix a NULL pointer deref in ssl module. The cert parser did
80
++not handle CRL distribution points with empty DP or URI correctly. A
81
++malicious or buggy certificate can result into segfault.
82
+--- a/Modules/_ssl.c_org	2019-05-23 19:47:08.374361552 +0530
83
+@@ -1501,6 +1501,10 @@ _get_crl_dp(X509 *certificate) {
84
+         STACK_OF(GENERAL_NAME) *gns;
85
+ 
86
+         dp = sk_DIST_POINT_value(dps, i);
87
++        if (dp->distpoint == NULL) {
88
++            /* Ignore empty DP value, CVE-2019-5010 */
89
++            continue;
90
++        }
91
+         gns = dp->distpoint->name.fullname;
92
+ 
93
+         for (j=0; j < sk_GENERAL_NAME_num(gns); j++) {
0 94
new file mode 100644
... ...
@@ -0,0 +1,147 @@
0
+From 7e200e0763f5b71c199aaf98bd5588f291585619 Mon Sep 17 00:00:00 2001
1
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
2
+Date: Tue, 7 May 2019 17:28:47 +0200
3
+Subject: [PATCH] bpo-30458: Disallow control chars in http URLs. (GH-12755)
4
+ (GH-13154)
5
+MIME-Version: 1.0
6
+Content-Type: text/plain; charset=UTF-8
7
+Content-Transfer-Encoding: 8bit
8
+
9
+Disallow control chars in http URLs in urllib.urlopen.  This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.
10
+
11
+Disable https related urllib tests on a build without ssl (GH-13032)
12
+These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures.
13
+
14
+Use http.client.InvalidURL instead of ValueError as the new error case's exception. (GH-13044)
15
+
16
+Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz>
17
+---
18
+ Lib/http/client.py                            | 15 ++++++
19
+ Lib/test/test_urllib.py                       | 53 +++++++++++++++++++
20
+ Lib/test/test_xmlrpc.py                       |  7 ++-
21
+ .../2019-04-10-08-53-30.bpo-30458.51E-DA.rst  |  1 +
22
+ 4 files changed, 75 insertions(+), 1 deletion(-)
23
+ create mode 100644 Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst
24
+
25
+diff --git a/Lib/http/client.py b/Lib/http/client.py
26
+index 1de151c38e92..2afd452fe30f 100644
27
+--- a/Lib/http/client.py
28
+@@ -140,6 +140,16 @@
29
+ _is_legal_header_name = re.compile(rb'[^:\s][^:\r\n]*').fullmatch
30
+ _is_illegal_header_value = re.compile(rb'\n(?![ \t])|\r(?![ \t\n])').search
31
+ 
32
++# These characters are not allowed within HTTP URL paths.
33
++#  See https://tools.ietf.org/html/rfc3986#section-3.3 and the
34
++#  https://tools.ietf.org/html/rfc3986#appendix-A pchar definition.
35
++# Prevents CVE-2019-9740.  Includes control characters such as \r\n.
36
++# We don't restrict chars above \x7f as putrequest() limits us to ASCII.
37
++_contains_disallowed_url_pchar_re = re.compile('[\x00-\x20\x7f]')
38
++# Arguably only these _should_ allowed:
39
++#  _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$")
40
++# We are more lenient for assumed real world compatibility purposes.
41
++
42
+ # We always set the Content-Length header for these methods because some
43
+ # servers will otherwise respond with a 411
44
+ _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'}
45
+@@ -1101,6 +1111,11 @@ def putrequest(self, method, url, skip_host=False,
46
+         self._method = method
47
+         if not url:
48
+             url = '/'
49
++        # Prevent CVE-2019-9740.
50
++        match = _contains_disallowed_url_pchar_re.search(url)
51
++        if match:
52
++            raise InvalidURL(f"URL can't contain control characters. {url!r} "
53
++                             f"(found at least {match.group()!r})")
54
+         request = '%s %s %s' % (method, url, self._http_vsn_str)
55
+ 
56
+         # Non-ASCII characters should have been eliminated earlier
57
+diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
58
+index 2ac73b58d832..7214492eca9d 100644
59
+--- a/Lib/test/test_urllib.py
60
+@@ -329,6 +329,59 @@ def test_willclose(self):
61
+         finally:
62
+             self.unfakehttp()
63
+ 
64
++    @unittest.skipUnless(ssl, "ssl module required")
65
++    def test_url_with_control_char_rejected(self):
66
++        for char_no in list(range(0, 0x21)) + [0x7f]:
67
++            char = chr(char_no)
68
++            schemeless_url = f"//localhost:7777/test{char}/"
69
++            self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
70
++            try:
71
++                # We explicitly test urllib.request.urlopen() instead of the top
72
++                # level 'def urlopen()' function defined in this... (quite ugly)
73
++                # test suite.  They use different url opening codepaths.  Plain
74
++                # urlopen uses FancyURLOpener which goes via a codepath that
75
++                # calls urllib.parse.quote() on the URL which makes all of the
76
++                # above attempts at injection within the url _path_ safe.
77
++                escaped_char_repr = repr(char).replace('\\', r'\\')
78
++                InvalidURL = http.client.InvalidURL
79
++                with self.assertRaisesRegex(
80
++                    InvalidURL, f"contain control.*{escaped_char_repr}"):
81
++                    urllib.request.urlopen(f"http:{schemeless_url}")
82
++                with self.assertRaisesRegex(
83
++                    InvalidURL, f"contain control.*{escaped_char_repr}"):
84
++                    urllib.request.urlopen(f"https:{schemeless_url}")
85
++                # This code path quotes the URL so there is no injection.
86
++                resp = urlopen(f"http:{schemeless_url}")
87
++                self.assertNotIn(char, resp.geturl())
88
++            finally:
89
++                self.unfakehttp()
90
++
91
++    @unittest.skipUnless(ssl, "ssl module required")
92
++    def test_url_with_newline_header_injection_rejected(self):
93
++        self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
94
++        host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123"
95
++        schemeless_url = "//" + host + ":8080/test/?test=a"
96
++        try:
97
++            # We explicitly test urllib.request.urlopen() instead of the top
98
++            # level 'def urlopen()' function defined in this... (quite ugly)
99
++            # test suite.  They use different url opening codepaths.  Plain
100
++            # urlopen uses FancyURLOpener which goes via a codepath that
101
++            # calls urllib.parse.quote() on the URL which makes all of the
102
++            # above attempts at injection within the url _path_ safe.
103
++            InvalidURL = http.client.InvalidURL
104
++            with self.assertRaisesRegex(
105
++                InvalidURL, r"contain control.*\\r.*(found at least . .)"):
106
++                urllib.request.urlopen(f"http:{schemeless_url}")
107
++            with self.assertRaisesRegex(InvalidURL, r"contain control.*\\n"):
108
++                urllib.request.urlopen(f"https:{schemeless_url}")
109
++            # This code path quotes the URL so there is no injection.
110
++            resp = urlopen(f"http:{schemeless_url}")
111
++            self.assertNotIn(' ', resp.geturl())
112
++            self.assertNotIn('\r', resp.geturl())
113
++            self.assertNotIn('\n', resp.geturl())
114
++        finally:
115
++            self.unfakehttp()
116
++
117
+     def test_read_0_9(self):
118
+         # "0.9" response accepted (but not "simple responses" without
119
+         # a status line)
120
+diff --git a/Lib/test/test_xmlrpc.py b/Lib/test/test_xmlrpc.py
121
+index 32263f7f0b3b..0e002ec4ef9f 100644
122
+--- a/Lib/test/test_xmlrpc.py
123
+@@ -945,7 +945,12 @@ def test_unicode_host(self):
124
+     def test_partial_post(self):
125
+         # Check that a partial POST doesn't make the server loop: issue #14001.
126
+         conn = http.client.HTTPConnection(ADDR, PORT)
127
+-        conn.request('POST', '/RPC2 HTTP/1.0\r\nContent-Length: 100\r\n\r\nbye')
128
++        conn.send('POST /RPC2 HTTP/1.0\r\n'
129
++                  'Content-Length: 100\r\n\r\n'
130
++                  'bye HTTP/1.1\r\n'
131
++                  f'Host: {ADDR}:{PORT}\r\n'
132
++                  'Accept-Encoding: identity\r\n'
133
++                  'Content-Length: 0\r\n\r\n'.encode('ascii'))
134
+         conn.close()
135
+ 
136
+     def test_context_manager(self):
137
+diff --git a/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst
138
+new file mode 100644
139
+index 000000000000..ed8027fb4d64
140
+--- /dev/null
141
+@@ -0,0 +1 @@
142
++Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request.  Such potentially malicious header injection URLs now cause an http.client.InvalidURL exception to be raised.
... ...
@@ -1,7 +1,7 @@
1 1
 Summary:        A high-level scripting language
2 2
 Name:           python3
3 3
 Version:        3.7.0
4
-Release:        5%{?dist}
4
+Release:        6%{?dist}
5 5
 License:        PSF
6 6
 URL:            http://www.python.org/
7 7
 Group:          System Environment/Programming
... ...
@@ -14,6 +14,8 @@ Patch1:         python3-support-photon-platform.patch
14 14
 Patch2:         CVE-2018-14647.patch
15 15
 Patch3:         CVE-2018-20406.patch
16 16
 Patch4:         CVE-2019-9636.patch
17
+Patch5:         CVE-2019-5010.patch
18
+Patch6:         CVE-2019-9740.patch
17 19
 BuildRequires:  pkg-config >= 0.28
18 20
 BuildRequires:  bzip2-devel
19 21
 BuildRequires:  ncurses-devel
... ...
@@ -137,6 +139,8 @@ The test package contains all regression tests for Python as well as the modules
137 137
 %patch2 -p1
138 138
 %patch3 -p1
139 139
 %patch4 -p1
140
+%patch5 -p1
141
+%patch6 -p1
140 142
 
141 143
 %build
142 144
 export OPT="${CFLAGS}"
... ...
@@ -263,6 +267,9 @@ rm -rf %{buildroot}/*
263 263
 %{_libdir}/python3.7/test/*
264 264
 
265 265
 %changelog
266
+*   Thu May 23 2019 Tapas Kundu <tkundu@vmware.com> 3.7.0-6
267
+-   Fix for CVE-2019-5010
268
+-   Fix for CVE-2019-9740
266 269
 *   Tue Mar 12 2019 Tapas Kundu <tkundu@vmware.com> 3.7.0-5
267 270
 -   Fix for CVE-2019-9636
268 271
 *   Mon Feb 11 2019 Taps Kundu <tkundu@vmware.com> 3.7.0-4