new file mode 100644

@@ -0,0 +1,79 @@

+commit f7666e828cc3d5873136473ea36ba2013d624fa1

+Author: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>

+Date:   Tue Sep 18 06:14:13 2018 -0700

+

+    bpo-34623: Use XML_SetHashSalt in _elementtree (GH-9146)

+    

+    

+    The C accelerated _elementtree module now initializes hash randomization

+    salt from _Py_HashSecret instead of libexpat's default CPRNG.

+    

+    Signed-off-by: Christian Heimes <christian@python.org>

+    

+    https://bugs.python.org/issue34623

+    (cherry picked from commit cb5778f00ce48631c7140f33ba242496aaf7102b)

+    

+    Co-authored-by: Christian Heimes <christian@python.org>

+

+diff --git a/Include/pyexpat.h b/Include/pyexpat.h

+index 44259bf..07020b5 100644

+--- a/Include/pyexpat.h

+@@ -3,7 +3,7 @@

+ 

+ /* note: you must import expat.h before importing this module! */

+ 

+-#define PyExpat_CAPI_MAGIC  "pyexpat.expat_CAPI 1.0"

++#define PyExpat_CAPI_MAGIC  "pyexpat.expat_CAPI 1.1"

+ #define PyExpat_CAPSULE_NAME "pyexpat.expat_CAPI"

+ 

+ struct PyExpat_CAPI

+@@ -48,6 +48,8 @@ struct PyExpat_CAPI

+     enum XML_Status (*SetEncoding)(XML_Parser parser, const XML_Char *encoding);

+     int (*DefaultUnknownEncodingHandler)(

+         void *encodingHandlerData, const XML_Char *name, XML_Encoding *info);

++    /* might be none for expat < 2.1.0 */

++    int (*SetHashSalt)(XML_Parser parser, unsigned long hash_salt);

+     /* always add new stuff to the end! */

+ };

+ 

+diff --git a/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst b/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst

+new file mode 100644

+index 0000000..31ad92e

+--- /dev/null

+@@ -0,0 +1,2 @@

++The C accelerated _elementtree module now initializes hash randomization

++salt from _Py_HashSecret instead of libexpat's default CSPRNG.

+diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c

+index 707ab29..53f05f9 100644

+--- a/Modules/_elementtree.c

+@@ -3261,6 +3261,11 @@ _elementtree_XMLParser___init___impl(XMLParserObject *self, PyObject *html,

+         PyErr_NoMemory();

+         return -1;

+     }

++    /* expat < 2.1.0 has no XML_SetHashSalt() */

++    if (EXPAT(SetHashSalt) != NULL) {

++        EXPAT(SetHashSalt)(self->parser,

++                           (unsigned long)_Py_HashSecret.expat.hashsalt);

++    }

+ 

+     if (target) {

+         Py_INCREF(target);

+diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c

+index 47c3e86..aa21d93 100644

+--- a/Modules/pyexpat.c

+@@ -1887,6 +1887,11 @@ MODULE_INITFUNC(void)

+     capi.SetStartDoctypeDeclHandler = XML_SetStartDoctypeDeclHandler;

+     capi.SetEncoding = XML_SetEncoding;

+     capi.DefaultUnknownEncodingHandler = PyUnknownEncodingHandler;

++#if XML_COMBINED_VERSION >= 20100

++    capi.SetHashSalt = XML_SetHashSalt;

++#else

++    capi.SetHashSalt = NULL;

++#endif

+ 

+     /* export using capsule */

+     capi_object = PyCapsule_New(&capi, PyExpat_CAPSULE_NAME, NULL);

@@ -1,7 +1,7 @@

 Summary:        A high-level scripting language

 Name:           python3

 Version:        3.5.6

-Release:        1%{?dist}

+Release:        2%{?dist}

 License:        PSF

 URL:            http://www.python.org/

 Group:          System Environment/Programming

@@ -14,6 +14,7 @@ Patch1:         sockWarning.patch

 Patch3:         python3-CVE-2018-1000117.patch

 Patch4:         python3-CVE-2017-18207.patch

 Patch5:         python3-CVE-2018-1061.patch

+Patch6:         python3-CVE-2018-14647.patch

 BuildRequires:  pkg-config >= 0.28

 BuildRequires:  bzip2-devel

 BuildRequires:  ncurses-devel >= 6.0-3

@@ -95,6 +96,7 @@ to build python programs.

 %patch3 -p1

 %patch4 -p1

 %patch5 -p1

+%patch6 -p1

 %build

 export OPT="${CFLAGS}"

@@ -199,6 +201,8 @@ rm -rf %{buildroot}/*

 %{_bindir}/idle*

 %changelog

+*   Mon Dec 31 2018 Tapas Kundu <tkundu@vmware.com> 3.5.6-2

+-   Fix for CVE-2018-14647

 *   Thu Dec 06 2018 Sujay G <gsujay@vmware.com> 3.5.6-1

 -   Upgrade to version 3.5.6

 *   Fri Aug 17 2018 Dweep Advani <dadvani@vmware.com> 3.5.5-2