Browse code
CVE-2018-14647 - python3
Change-Id: I4b27b9e4a2b5bc686483fc423980ef83c628a7f4
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/6409
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Srinidhi Rao <srinidhir@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>
Tapas Kundu authored on 2018/12/22 05:32:18Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,79 @@ |
| 0 |
+commit 470a435f3b42c9be5fdb7f7b04f3df5663ba7305 |
|
| 1 |
+Author: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> |
|
| 2 |
+Date: Tue Sep 18 06:11:09 2018 -0700 |
|
| 3 |
+ |
|
| 4 |
+ bpo-34623: Use XML_SetHashSalt in _elementtree (GH-9146) |
|
| 5 |
+ |
|
| 6 |
+ |
|
| 7 |
+ The C accelerated _elementtree module now initializes hash randomization |
|
| 8 |
+ salt from _Py_HashSecret instead of libexpat's default CPRNG. |
|
| 9 |
+ |
|
| 10 |
+ Signed-off-by: Christian Heimes <christian@python.org> |
|
| 11 |
+ |
|
| 12 |
+ https://bugs.python.org/issue34623 |
|
| 13 |
+ (cherry picked from commit cb5778f00ce48631c7140f33ba242496aaf7102b) |
|
| 14 |
+ |
|
| 15 |
+ Co-authored-by: Christian Heimes <christian@python.org> |
|
| 16 |
+ |
|
| 17 |
+diff --git a/Include/pyexpat.h b/Include/pyexpat.h |
|
| 18 |
+index 44259bf..07020b5 100644 |
|
| 19 |
+--- a/Include/pyexpat.h |
|
| 20 |
+@@ -3,7 +3,7 @@ |
|
| 21 |
+ |
|
| 22 |
+ /* note: you must import expat.h before importing this module! */ |
|
| 23 |
+ |
|
| 24 |
+-#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.0" |
|
| 25 |
++#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.1" |
|
| 26 |
+ #define PyExpat_CAPSULE_NAME "pyexpat.expat_CAPI" |
|
| 27 |
+ |
|
| 28 |
+ struct PyExpat_CAPI |
|
| 29 |
+@@ -48,6 +48,8 @@ struct PyExpat_CAPI |
|
| 30 |
+ enum XML_Status (*SetEncoding)(XML_Parser parser, const XML_Char *encoding); |
|
| 31 |
+ int (*DefaultUnknownEncodingHandler)( |
|
| 32 |
+ void *encodingHandlerData, const XML_Char *name, XML_Encoding *info); |
|
| 33 |
++ /* might be none for expat < 2.1.0 */ |
|
| 34 |
++ int (*SetHashSalt)(XML_Parser parser, unsigned long hash_salt); |
|
| 35 |
+ /* always add new stuff to the end! */ |
|
| 36 |
+ }; |
|
| 37 |
+ |
|
| 38 |
+diff --git a/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst b/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst |
|
| 39 |
+new file mode 100644 |
|
| 40 |
+index 0000000..31ad92e |
|
| 41 |
+--- /dev/null |
|
| 42 |
+@@ -0,0 +1,2 @@ |
|
| 43 |
++The C accelerated _elementtree module now initializes hash randomization |
|
| 44 |
++salt from _Py_HashSecret instead of libexpat's default CSPRNG. |
|
| 45 |
+diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c |
|
| 46 |
+index 1dfdb3c..4b86f96 100644 |
|
| 47 |
+--- a/Modules/_elementtree.c |
|
| 48 |
+@@ -3305,6 +3305,11 @@ _elementtree_XMLParser___init___impl(XMLParserObject *self, PyObject *html, |
|
| 49 |
+ PyErr_NoMemory(); |
|
| 50 |
+ return -1; |
|
| 51 |
+ } |
|
| 52 |
++ /* expat < 2.1.0 has no XML_SetHashSalt() */ |
|
| 53 |
++ if (EXPAT(SetHashSalt) != NULL) {
|
|
| 54 |
++ EXPAT(SetHashSalt)(self->parser, |
|
| 55 |
++ (unsigned long)_Py_HashSecret.expat.hashsalt); |
|
| 56 |
++ } |
|
| 57 |
+ |
|
| 58 |
+ if (target) {
|
|
| 59 |
+ Py_INCREF(target); |
|
| 60 |
+diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c |
|
| 61 |
+index c8a01d4..c52079e 100644 |
|
| 62 |
+--- a/Modules/pyexpat.c |
|
| 63 |
+@@ -1877,6 +1877,11 @@ MODULE_INITFUNC(void) |
|
| 64 |
+ capi.SetStartDoctypeDeclHandler = XML_SetStartDoctypeDeclHandler; |
|
| 65 |
+ capi.SetEncoding = XML_SetEncoding; |
|
| 66 |
+ capi.DefaultUnknownEncodingHandler = PyUnknownEncodingHandler; |
|
| 67 |
++#if XML_COMBINED_VERSION >= 20100 |
|
| 68 |
++ capi.SetHashSalt = XML_SetHashSalt; |
|
| 69 |
++#else |
|
| 70 |
++ capi.SetHashSalt = NULL; |
|
| 71 |
++#endif |
|
| 72 |
+ |
|
| 73 |
+ /* export using capsule */ |
|
| 74 |
+ capi_object = PyCapsule_New(&capi, PyExpat_CAPSULE_NAME, NULL); |
| ... | ... |
@@ -1,7 +1,7 @@ |
| 1 | 1 |
Summary: A high-level scripting language |
| 2 | 2 |
Name: python3 |
| 3 | 3 |
Version: 3.7.0 |
| 4 |
-Release: 2%{?dist}
|
|
| 4 |
+Release: 3%{?dist}
|
|
| 5 | 5 |
License: PSF |
| 6 | 6 |
URL: http://www.python.org/ |
| 7 | 7 |
Group: System Environment/Programming |
| ... | ... |
@@ -11,6 +11,7 @@ Source0: https://www.python.org/ftp/python/%{version}/Python-%{version}.t
|
| 11 | 11 |
%define sha1 Python=653cffa5b9f2a28150afe4705600d2e55d89b564 |
| 12 | 12 |
Patch0: cgi3.patch |
| 13 | 13 |
Patch1: python3-support-photon-platform.patch |
| 14 |
+Patch2: CVE-2018-14647.patch |
|
| 14 | 15 |
BuildRequires: pkg-config >= 0.28 |
| 15 | 16 |
BuildRequires: bzip2-devel |
| 16 | 17 |
BuildRequires: ncurses-devel |
| ... | ... |
@@ -131,6 +132,7 @@ The test package contains all regression tests for Python as well as the modules |
| 131 | 131 |
%setup -q -n Python-%{version}
|
| 132 | 132 |
%patch0 -p1 |
| 133 | 133 |
%patch1 -p1 |
| 134 |
+%patch2 -p1 |
|
| 134 | 135 |
|
| 135 | 136 |
%build |
| 136 | 137 |
export OPT="${CFLAGS}"
|
| ... | ... |
@@ -257,6 +259,8 @@ rm -rf %{buildroot}/*
|
| 257 | 257 |
%{_libdir}/python3.7/test/*
|
| 258 | 258 |
|
| 259 | 259 |
%changelog |
| 260 |
+* Fri Dec 21 2018 Tapas Kundu <tkundu@vmware.com> 3.7.0-3 |
|
| 261 |
+- Fix for CVE-2018-14647 |
|
| 260 | 262 |
* Tue Dec 04 2018 Tapas Kundu <tkundu@vmware.com> 3.7.0-2 |
| 261 | 263 |
- Excluded windows installer from python3 libs packaging. |
| 262 | 264 |
* Wed Sep 26 2018 Tapas Kundu <tkundu@vmware.com> 3.7.0-1 |