906ed044aa
Fixes the following security issues:
- bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with
additional text after the address and only quad-dotted notation without
trailing whitespaces. Some inet_aton() implementations ignore whitespace
and all data after whitespace, e.g. ‘127.0.0.1 whatever’.
- bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file://
and local_file:// URL schemes in URLopener().open() and
URLopener().retrieve() of urllib.request.
- bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded
whitespace or control characters through into the underlying http client
request. Such potentially malicious header injection URLs now cause an
http.client.InvalidURL exception to be raised.
- bpo-33529: Prevent fold function used in email header encoding from
entering infinite loop when there are too many non-ASCII characters in a
header.
- bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and
if the PATH environment variable is not set. Remove also the current
directory from posixpath.defpath. On Unix, shutil.which() and the
subprocess module no longer search the executable in the current directory
if the PATH environment variable is not set.
Also remove the following upstreamed patches:
- 0033-bpo-36742-Fixes-handling-of-pre-normalization-charac.patch
- 0034-bpo-36742-Corrects-fix-to-handle-decomposition-in-us.patch
Signed-off-by: Adam Duskett <Aduskett@gmail.com>
[Peter: mention security fixes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
68 lines
2.6 KiB
Diff
68 lines
2.6 KiB
Diff
From da3880edac19100f69891f225cc2f07a82be1e52 Mon Sep 17 00:00:00 2001
|
|
From: Peter Korsgaard <peter@korsgaard.com>
|
|
Date: Thu, 20 Nov 2014 13:24:59 +0100
|
|
Subject: [PATCH] Misc/python-config.sh.in: ensure sed invocations only match
|
|
beginning of strings
|
|
|
|
The build/real prefix handling using sed breaks if build != real and the
|
|
standard include / lib directories are used ($prefix/include and $prefix/lib).
|
|
|
|
E.G.
|
|
|
|
prefix_build="/usr", libdir="$prefix/lib", includedir="$prefix/include".
|
|
|
|
If this gets installed with make DESTDIR="/foo" install, then we end up with
|
|
prefix_real = prefix = "/foo/usr" as expected, but
|
|
includedir="/foo/foo/usr/include" and libdir="/foo/foo/usr/lib" because of
|
|
the double sed invocation (prefix is already expanded). Work around it by
|
|
ensuring we only match the beginning of the string.
|
|
|
|
Submitted upstream: http://bugs.python.org/issue22907
|
|
|
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
---
|
|
Misc/python-config.sh.in | 13 +++++++------
|
|
1 file changed, 7 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/Misc/python-config.sh.in b/Misc/python-config.sh.in
|
|
index d1d3275..9e259c0 100644
|
|
--- a/Misc/python-config.sh.in
|
|
+++ b/Misc/python-config.sh.in
|
|
@@ -24,18 +24,19 @@ installed_prefix ()
|
|
echo $RESULT
|
|
}
|
|
|
|
+prefix_build="@prefix@"
|
|
prefix_real=$(installed_prefix "$0")
|
|
|
|
# Use sed to fix paths from their built-to locations to their installed-to
|
|
# locations. Keep prefix & exec_prefix using their original values in case
|
|
# they are referenced in other configure variables, to prevent double
|
|
# substitution, issue #22140.
|
|
-prefix="@prefix@"
|
|
-exec_prefix="@exec_prefix@"
|
|
+prefix=$(echo "$prefix_build" | sed "s#^$prefix_build#$prefix_real#")
|
|
+exec_prefix=$(echo "$exec_prefix_build" | sed "s#^$exec_prefix_build#$prefix_real#")
|
|
exec_prefix_real=${prefix_real}
|
|
-includedir=$(echo "@includedir@" | sed "s#$prefix#$prefix_real#")
|
|
-libdir=$(echo "@libdir@" | sed "s#$prefix#$prefix_real#")
|
|
-CFLAGS=$(echo "@CFLAGS@" | sed "s#$prefix#$prefix_real#")
|
|
+includedir=$(echo "@includedir@" | sed "s#^$prefix_build#$prefix_real#")
|
|
+libdir=$(echo "@libdir@" | sed "s#^$prefix_build#$prefix_real#")
|
|
+CFLAGS=$(echo "@CFLAGS@" | sed "s#^$prefix_build#$prefix_real#")
|
|
VERSION="@VERSION@"
|
|
LIBM="@LIBM@"
|
|
LIBC="@LIBC@"
|
|
@@ -48,7 +49,7 @@ OPT="@OPT@"
|
|
PY_ENABLE_SHARED="@PY_ENABLE_SHARED@"
|
|
LDVERSION="@LDVERSION@"
|
|
LIBDEST=${prefix_real}/lib/python${VERSION}
|
|
-LIBPL=$(echo "@LIBPL@" | sed "s#$prefix#$prefix_real#")
|
|
+LIBPL=$(echo "@LIBPL@" | sed "s#^$prefix_build#$prefix_real#")
|
|
SO="@EXT_SUFFIX@"
|
|
PYTHONFRAMEWORK="@PYTHONFRAMEWORK@"
|
|
INCDIR="-I$includedir/python${VERSION}${ABIFLAGS}"
|
|
--
|
|
2.14.3
|
|
|