From e795bfcfb60bf4a85948d8a9c6fa5e7ab8d6c9ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20N=C3=A9ri?= Date: Fri, 23 Aug 2024 10:17:57 +0200 Subject: [PATCH] main/python3: fix CVE-2024-8088 Add patch to fix CVE-2024-8088: Infinite loop when iterating over zip archive entry names. - https://github.com/python/cpython/issues/122905 - https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/ --- main/python3/APKBUILD | 6 +- main/python3/CVE-2024-8088.patch | 141 +++++++++++++++++++++++++++++++ 2 files changed, 146 insertions(+), 1 deletion(-) create mode 100644 main/python3/CVE-2024-8088.patch diff --git a/main/python3/APKBUILD b/main/python3/APKBUILD index 1aabc6b4df02..bcae9b107d36 100644 --- a/main/python3/APKBUILD +++ b/main/python3/APKBUILD @@ -5,7 +5,7 @@ pkgname=python3 pkgver=3.10.14 _bluez_ver=5.65 _basever="${pkgver%.*}" -pkgrel=1 +pkgrel=2 pkgdesc="A high-level scripting language" url="https://www.python.org/" arch="all" @@ -45,11 +45,14 @@ source="https://www.python.org/ftp/python/$pkgver/Python-$pkgver.tar.xz musl-find_library.patch custom-bluetooth-h-path.patch arm-alignment.patch + CVE-2024-8088.patch " options="net" # Required for tests builddir="$srcdir/Python-$pkgver" # secfixes: +# 3.10.14-r2: +# - CVE-2024-8088 # 3.10.14-r0: # - CVE-2024-0450 # - CVE-2023-6597 @@ -241,4 +244,5 @@ fe123dd871f7a3fa868c499a957b94f1d815a1e1de964aaff1116c579defd4d9d1e9b7eb418cf114 ab8eaa2858d5109049b1f9f553198d40e0ef8d78211ad6455f7b491af525bffb16738fed60fc84e960c4889568d25753b9e4a1494834fea48291b33f07000ec2 musl-find_library.patch 14b00953cdb5fe757b38dbf759d7203c3504b46e330494ec195db92290640ec640fb29cc4456208a25dadc028ebaf211b0df71f458a3b76023fdafb4f91ff46a custom-bluetooth-h-path.patch a84483246e413650a904c34c18f5e4f4168c39067d069f48557c330de6eb3db19fd96a4d453d742db3dcb7c7f962722903f62823c752ff90510c89830435ffc0 arm-alignment.patch +ddc6eb01847a987d0833c28ce4d340848401d353b76534cc5ca2a68d11efe9e3bf5af66ab830a1ea14f14d07ad985e62729a1abef1ca7e2e017906258dbee24d CVE-2024-8088.patch " diff --git a/main/python3/CVE-2024-8088.patch b/main/python3/CVE-2024-8088.patch new file mode 100644 index 000000000000..287bf5209fe6 --- /dev/null +++ b/main/python3/CVE-2024-8088.patch @@ -0,0 +1,141 @@ +From d82745ed652414fc5c4e18b90b815382a902c226 Mon Sep 17 00:00:00 2001 +From: "Jason R. Coombs" +Date: Mon, 19 Aug 2024 19:28:20 -0400 +Subject: [PATCH] [3.10] [3.11] gh-122905: Sanitize names in zipfile.Path. + (GH-122906) (GH-122925) + +* gh-122905: Sanitize names in zipfile.Path. (GH-122906) + +Ported from zipp 3.19.1; ref jaraco/zippGH-119. + +(cherry picked from commit 9cd03263100ddb1657826cc4a71470786cab3932) + +* [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906) + +Ported from zipp 3.19.1; ref jaraco/zippGH-119. +(cherry picked from commit 9cd03263100ddb1657826cc4a71470786cab3932) + +(cherry picked from commit 795f2597a4be988e2bb19b69ff9958e981cb894e) + +Co-authored-by: Jason R. Coombs +--- + Lib/test/test_zipfile.py | 17 ++++++ + Lib/zipfile.py | 61 ++++++++++++++++++- + ...-08-11-14-08-04.gh-issue-122905.7tDsxA.rst | 1 + + 3 files changed, 78 insertions(+), 1 deletion(-) + create mode 100644 Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst + +diff --git a/Lib/test/test_zipfile.py b/Lib/test/test_zipfile.py +index 32c01704d9d1d6..a60dc11688d20b 100644 +--- a/Lib/test/test_zipfile.py ++++ b/Lib/test/test_zipfile.py +@@ -3280,6 +3280,23 @@ def test_extract_orig_with_implied_dirs(self, alpharep): + zipfile.Path(zf) + zf.extractall(source_path.parent) + ++ def test_malformed_paths(self): ++ """ ++ Path should handle malformed paths. ++ """ ++ data = io.BytesIO() ++ zf = zipfile.ZipFile(data, "w") ++ zf.writestr("/one-slash.txt", b"content") ++ zf.writestr("//two-slash.txt", b"content") ++ zf.writestr("../parent.txt", b"content") ++ zf.filename = '' ++ root = zipfile.Path(zf) ++ assert list(map(str, root.iterdir())) == [ ++ 'one-slash.txt', ++ 'two-slash.txt', ++ 'parent.txt', ++ ] ++ + + class StripExtraTests(unittest.TestCase): + # Note: all of the "z" characters are technically invalid, but up +diff --git a/Lib/zipfile.py b/Lib/zipfile.py +index 7d18bc2479fcda..cbac8d9160e72b 100644 +--- a/Lib/zipfile.py ++++ b/Lib/zipfile.py +@@ -9,6 +9,7 @@ + import itertools + import os + import posixpath ++import re + import shutil + import stat + import struct +@@ -2182,7 +2183,65 @@ def _difference(minuend, subtrahend): + return itertools.filterfalse(set(subtrahend).__contains__, minuend) + + +-class CompleteDirs(ZipFile): ++class SanitizedNames: ++ """ ++ ZipFile mix-in to ensure names are sanitized. ++ """ ++ ++ def namelist(self): ++ return list(map(self._sanitize, super().namelist())) ++ ++ @staticmethod ++ def _sanitize(name): ++ r""" ++ Ensure a relative path with posix separators and no dot names. ++ Modeled after ++ https://github.com/python/cpython/blob/bcc1be39cb1d04ad9fc0bd1b9193d3972835a57c/Lib/zipfile/__init__.py#L1799-L1813 ++ but provides consistent cross-platform behavior. ++ >>> san = SanitizedNames._sanitize ++ >>> san('/foo/bar') ++ 'foo/bar' ++ >>> san('//foo.txt') ++ 'foo.txt' ++ >>> san('foo/.././bar.txt') ++ 'foo/bar.txt' ++ >>> san('foo../.bar.txt') ++ 'foo../.bar.txt' ++ >>> san('\\foo\\bar.txt') ++ 'foo/bar.txt' ++ >>> san('D:\\foo.txt') ++ 'D/foo.txt' ++ >>> san('\\\\server\\share\\file.txt') ++ 'server/share/file.txt' ++ >>> san('\\\\?\\GLOBALROOT\\Volume3') ++ '?/GLOBALROOT/Volume3' ++ >>> san('\\\\.\\PhysicalDrive1\\root') ++ 'PhysicalDrive1/root' ++ Retain any trailing slash. ++ >>> san('abc/') ++ 'abc/' ++ Raises a ValueError if the result is empty. ++ >>> san('../..') ++ Traceback (most recent call last): ++ ... ++ ValueError: Empty filename ++ """ ++ ++ def allowed(part): ++ return part and part not in {'..', '.'} ++ ++ # Remove the drive letter. ++ # Don't use ntpath.splitdrive, because that also strips UNC paths ++ bare = re.sub('^([A-Z]):', r'\1', name, flags=re.IGNORECASE) ++ clean = bare.replace('\\', '/') ++ parts = clean.split('/') ++ joined = '/'.join(filter(allowed, parts)) ++ if not joined: ++ raise ValueError("Empty filename") ++ return joined + '/' * name.endswith('/') ++ ++ ++class CompleteDirs(SanitizedNames, ZipFile): + """ + A ZipFile subclass that ensures that implied directories + are always included in the namelist. +diff --git a/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst b/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst +new file mode 100644 +index 00000000000000..1be44c906c4f30 +--- /dev/null ++++ b/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst +@@ -0,0 +1 @@ ++:class:`zipfile.Path` objects now sanitize names from the zipfile.