!150 Fix CVE-2024-56374
From: @caodongxia Reviewed-by: @cherry530 Signed-off-by: @cherry530
This commit is contained in:
openeuler-ci-bot
Gitee
commit
48ae12b320
293
CVE-2024-56374.patch
Normal file
293
CVE-2024-56374.patch
Normal file
@ -0,0 +1,293 @@
|
|||||||
|
From ad866a1ca3e7d60da888d25d27e46a8adb2ed36e Mon Sep 17 00:00:00 2001
|
||||||
|
From: Natalia <124304+nessita@users.noreply.github.com>
|
||||||
|
Date: Mon, 6 Jan 2025 15:51:45 -0300
|
||||||
|
Subject: [PATCH] [4.2.x] Fixed CVE-2024-56374 -- Mitigated potential DoS in
|
||||||
|
IPv6 validation.
|
||||||
|
|
||||||
|
Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz
|
||||||
|
Felisiak for the reviews.
|
||||||
|
|
||||||
|
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
||||||
|
---
|
||||||
|
django/db/models/fields/__init__.py | 6 +--
|
||||||
|
django/forms/fields.py | 7 +++-
|
||||||
|
django/utils/ipv6.py | 19 +++++++--
|
||||||
|
docs/ref/forms/fields.txt | 13 +++++-
|
||||||
|
docs/releases/4.2.18.txt | 12 ++++++
|
||||||
|
.../field_tests/test_genericipaddressfield.py | 33 ++++++++++++++-
|
||||||
|
tests/utils_tests/test_ipv6.py | 40 +++++++++++++++++--
|
||||||
|
7 files changed, 116 insertions(+), 14 deletions(-)
|
||||||
|
|
||||||
|
Index: Django-2.2.28/django/db/models/fields/__init__.py
|
||||||
|
===================================================================
|
||||||
|
--- Django-2.2.28.orig/django/db/models/fields/__init__.py
|
||||||
|
+++ Django-2.2.28/django/db/models/fields/__init__.py
|
||||||
|
@@ -26,7 +26,7 @@ from django.utils.dateparse import (
|
||||||
|
)
|
||||||
|
from django.utils.duration import duration_microseconds, duration_string
|
||||||
|
from django.utils.functional import Promise, cached_property
|
||||||
|
-from django.utils.ipv6 import clean_ipv6_address
|
||||||
|
+from django.utils.ipv6 import MAX_IPV6_ADDRESS_LENGTH, clean_ipv6_address
|
||||||
|
from django.utils.itercompat import is_iterable
|
||||||
|
from django.utils.text import capfirst
|
||||||
|
from django.utils.translation import gettext_lazy as _
|
||||||
|
@@ -1904,7 +1904,7 @@ class GenericIPAddressField(Field):
|
||||||
|
self.default_validators, invalid_error_message = \
|
||||||
|
validators.ip_address_validators(protocol, unpack_ipv4)
|
||||||
|
self.default_error_messages['invalid'] = invalid_error_message
|
||||||
|
- kwargs['max_length'] = 39
|
||||||
|
+ kwargs['max_length'] = MAX_IPV6_ADDRESS_LENGTH
|
||||||
|
super().__init__(verbose_name, name, *args, **kwargs)
|
||||||
|
|
||||||
|
def check(self, **kwargs):
|
||||||
|
@@ -1931,7 +1931,7 @@ class GenericIPAddressField(Field):
|
||||||
|
kwargs['unpack_ipv4'] = self.unpack_ipv4
|
||||||
|
if self.protocol != "both":
|
||||||
|
kwargs['protocol'] = self.protocol
|
||||||
|
- if kwargs.get("max_length") == 39:
|
||||||
|
+ if kwargs.get("max_length") == self.max_length:
|
||||||
|
del kwargs['max_length']
|
||||||
|
return name, path, args, kwargs
|
||||||
|
|
||||||
|
Index: Django-2.2.28/django/forms/fields.py
|
||||||
|
===================================================================
|
||||||
|
--- Django-2.2.28.orig/django/forms/fields.py
|
||||||
|
+++ Django-2.2.28/django/forms/fields.py
|
||||||
|
@@ -29,7 +29,7 @@ from django.forms.widgets import (
|
||||||
|
from django.utils import formats
|
||||||
|
from django.utils.dateparse import parse_duration
|
||||||
|
from django.utils.duration import duration_string
|
||||||
|
-from django.utils.ipv6 import clean_ipv6_address
|
||||||
|
+from django.utils.ipv6 import MAX_IPV6_ADDRESS_LENGTH, clean_ipv6_address
|
||||||
|
from django.utils.translation import gettext_lazy as _, ngettext_lazy
|
||||||
|
|
||||||
|
__all__ = (
|
||||||
|
@@ -1162,6 +1162,7 @@ class GenericIPAddressField(CharField):
|
||||||
|
def __init__(self, *, protocol='both', unpack_ipv4=False, **kwargs):
|
||||||
|
self.unpack_ipv4 = unpack_ipv4
|
||||||
|
self.default_validators = validators.ip_address_validators(protocol, unpack_ipv4)[0]
|
||||||
|
+ kwargs.setdefault("max_length", MAX_IPV6_ADDRESS_LENGTH)
|
||||||
|
super().__init__(**kwargs)
|
||||||
|
|
||||||
|
def to_python(self, value):
|
||||||
|
@@ -1169,7 +1170,9 @@ class GenericIPAddressField(CharField):
|
||||||
|
return ''
|
||||||
|
value = value.strip()
|
||||||
|
if value and ':' in value:
|
||||||
|
- return clean_ipv6_address(value, self.unpack_ipv4)
|
||||||
|
+ return clean_ipv6_address(
|
||||||
|
+ value, self.unpack_ipv4, max_length=self.max_length
|
||||||
|
+ )
|
||||||
|
return value
|
||||||
|
|
||||||
|
|
||||||
|
Index: Django-2.2.28/django/utils/ipv6.py
|
||||||
|
===================================================================
|
||||||
|
--- Django-2.2.28.orig/django/utils/ipv6.py
|
||||||
|
+++ Django-2.2.28/django/utils/ipv6.py
|
||||||
|
@@ -3,9 +3,23 @@ import ipaddress
|
||||||
|
from django.core.exceptions import ValidationError
|
||||||
|
from django.utils.translation import gettext_lazy as _
|
||||||
|
|
||||||
|
+MAX_IPV6_ADDRESS_LENGTH = 39
|
||||||
|
|
||||||
|
-def clean_ipv6_address(ip_str, unpack_ipv4=False,
|
||||||
|
- error_message=_("This is not a valid IPv6 address.")):
|
||||||
|
+
|
||||||
|
+def _ipv6_address_from_str(ip_str, max_length=MAX_IPV6_ADDRESS_LENGTH):
|
||||||
|
+ if len(ip_str) > max_length:
|
||||||
|
+ raise ValueError(
|
||||||
|
+ f"Unable to convert {ip_str} to an IPv6 address (value too long)."
|
||||||
|
+ )
|
||||||
|
+ return ipaddress.IPv6Address(int(ipaddress.IPv6Address(ip_str)))
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+def clean_ipv6_address(
|
||||||
|
+ ip_str,
|
||||||
|
+ unpack_ipv4=False,
|
||||||
|
+ error_message=_("This is not a valid IPv6 address."),
|
||||||
|
+ max_length=MAX_IPV6_ADDRESS_LENGTH,
|
||||||
|
+ ):
|
||||||
|
"""
|
||||||
|
Clean an IPv6 address string.
|
||||||
|
|
||||||
|
@@ -23,7 +37,7 @@ def clean_ipv6_address(ip_str, unpack_ip
|
||||||
|
Return a compressed IPv6 address or the same value.
|
||||||
|
"""
|
||||||
|
try:
|
||||||
|
- addr = ipaddress.IPv6Address(int(ipaddress.IPv6Address(ip_str)))
|
||||||
|
+ addr = _ipv6_address_from_str(ip_str, max_length)
|
||||||
|
except ValueError:
|
||||||
|
raise ValidationError(error_message, code='invalid')
|
||||||
|
|
||||||
|
@@ -40,7 +54,7 @@ def is_valid_ipv6_address(ip_str):
|
||||||
|
Return whether or not the `ip_str` string is a valid IPv6 address.
|
||||||
|
"""
|
||||||
|
try:
|
||||||
|
- ipaddress.IPv6Address(ip_str)
|
||||||
|
+ _ipv6_address_from_str(ip_str)
|
||||||
|
except ValueError:
|
||||||
|
return False
|
||||||
|
return True
|
||||||
|
Index: Django-2.2.28/docs/ref/forms/fields.txt
|
||||||
|
===================================================================
|
||||||
|
--- Django-2.2.28.orig/docs/ref/forms/fields.txt
|
||||||
|
+++ Django-2.2.28/docs/ref/forms/fields.txt
|
||||||
|
@@ -787,7 +787,7 @@ For each field, we describe the default
|
||||||
|
* Empty value: ``''`` (an empty string)
|
||||||
|
* Normalizes to: A string. IPv6 addresses are normalized as described below.
|
||||||
|
* Validates that the given value is a valid IP address.
|
||||||
|
- * Error message keys: ``required``, ``invalid``
|
||||||
|
+ * Error message keys: ``required``, ``invalid``, ``max_length``
|
||||||
|
|
||||||
|
The IPv6 address normalization follows :rfc:`4291#section-2.2` section 2.2,
|
||||||
|
including using the IPv4 format suggested in paragraph 3 of that section, like
|
||||||
|
@@ -795,7 +795,7 @@ For each field, we describe the default
|
||||||
|
``2001::1``, and ``::ffff:0a0a:0a0a`` to ``::ffff:10.10.10.10``. All characters
|
||||||
|
are converted to lowercase.
|
||||||
|
|
||||||
|
- Takes two optional arguments:
|
||||||
|
+ Takes three optional arguments:
|
||||||
|
|
||||||
|
.. attribute:: protocol
|
||||||
|
|
||||||
|
@@ -810,6 +810,15 @@ For each field, we describe the default
|
||||||
|
``192.0.2.1``. Default is disabled. Can only be used
|
||||||
|
when ``protocol`` is set to ``'both'``.
|
||||||
|
|
||||||
|
+ .. attribute:: max_length
|
||||||
|
+
|
||||||
|
+ Defaults to 39, and behaves the same way as it does for
|
||||||
|
+ :class:`CharField`.
|
||||||
|
+
|
||||||
|
+ .. versionchanged:: 4.2.18
|
||||||
|
+
|
||||||
|
+ The default value for ``max_length`` was set to 39 characters.
|
||||||
|
+
|
||||||
|
``MultipleChoiceField``
|
||||||
|
-----------------------
|
||||||
|
|
||||||
|
Index: Django-2.2.28/tests/forms_tests/field_tests/test_genericipaddressfield.py
|
||||||
|
===================================================================
|
||||||
|
--- Django-2.2.28.orig/tests/forms_tests/field_tests/test_genericipaddressfield.py
|
||||||
|
+++ Django-2.2.28/tests/forms_tests/field_tests/test_genericipaddressfield.py
|
||||||
|
@@ -1,5 +1,6 @@
|
||||||
|
from django.forms import GenericIPAddressField, ValidationError
|
||||||
|
from django.test import SimpleTestCase
|
||||||
|
+from django.utils.ipv6 import MAX_IPV6_ADDRESS_LENGTH
|
||||||
|
|
||||||
|
|
||||||
|
class GenericIPAddressFieldTest(SimpleTestCase):
|
||||||
|
@@ -28,7 +29,7 @@ class GenericIPAddressFieldTest(SimpleTe
|
||||||
|
with self.assertRaisesMessage(ValidationError, "'Enter a valid IPv4 or IPv6 address.'"):
|
||||||
|
f.clean('256.125.1.5')
|
||||||
|
self.assertEqual(f.clean(' fe80::223:6cff:fe8a:2e8a '), 'fe80::223:6cff:fe8a:2e8a')
|
||||||
|
- self.assertEqual(f.clean(' 2a02::223:6cff:fe8a:2e8a '), '2a02::223:6cff:fe8a:2e8a')
|
||||||
|
+ self.assertEqual(f.clean(' ' * MAX_IPV6_ADDRESS_LENGTH + ' 2a02::223:6cff:fe8a:2e8a '), '2a02::223:6cff:fe8a:2e8a')
|
||||||
|
with self.assertRaisesMessage(ValidationError, "'This is not a valid IPv6 address.'"):
|
||||||
|
f.clean('12345:2:3:4')
|
||||||
|
with self.assertRaisesMessage(ValidationError, "'This is not a valid IPv6 address.'"):
|
||||||
|
@@ -89,6 +90,35 @@ class GenericIPAddressFieldTest(SimpleTe
|
||||||
|
with self.assertRaisesMessage(ValidationError, "'This is not a valid IPv6 address.'"):
|
||||||
|
f.clean('1:2')
|
||||||
|
|
||||||
|
+ def test_generic_ipaddress_max_length_custom(self):
|
||||||
|
+ # Valid IPv4-mapped IPv6 address, len 45.
|
||||||
|
+ addr = "0000:0000:0000:0000:0000:ffff:192.168.100.228"
|
||||||
|
+ f = GenericIPAddressField(max_length=len(addr))
|
||||||
|
+ f.clean(addr)
|
||||||
|
+
|
||||||
|
+ def test_generic_ipaddress_max_length_validation_error(self):
|
||||||
|
+ # Valid IPv4-mapped IPv6 address, len 45.
|
||||||
|
+ addr = "0000:0000:0000:0000:0000:ffff:192.168.100.228"
|
||||||
|
+
|
||||||
|
+ cases = [
|
||||||
|
+ ({}, MAX_IPV6_ADDRESS_LENGTH), # Default value.
|
||||||
|
+ ({"max_length": len(addr) - 1}, len(addr) - 1),
|
||||||
|
+ ]
|
||||||
|
+ for kwargs, max_length in cases:
|
||||||
|
+ max_length_plus_one = max_length + 1
|
||||||
|
+ msg = (
|
||||||
|
+ f"Ensure this value has at most {max_length} characters (it has "
|
||||||
|
+ f"{max_length_plus_one}).'"
|
||||||
|
+ )
|
||||||
|
+ with self.subTest(max_length=max_length):
|
||||||
|
+ f = GenericIPAddressField(**kwargs)
|
||||||
|
+ with self.assertRaisesMessage(ValidationError, msg):
|
||||||
|
+ f.clean("x" * max_length_plus_one)
|
||||||
|
+ with self.assertRaisesMessage(
|
||||||
|
+ ValidationError, "This is not a valid IPv6 address."
|
||||||
|
+ ):
|
||||||
|
+ f.clean(addr)
|
||||||
|
+
|
||||||
|
def test_generic_ipaddress_as_generic_not_required(self):
|
||||||
|
f = GenericIPAddressField(required=False)
|
||||||
|
self.assertEqual(f.clean(''), '')
|
||||||
|
Index: Django-2.2.28/tests/utils_tests/test_ipv6.py
|
||||||
|
===================================================================
|
||||||
|
--- Django-2.2.28.orig/tests/utils_tests/test_ipv6.py
|
||||||
|
+++ Django-2.2.28/tests/utils_tests/test_ipv6.py
|
||||||
|
@@ -1,9 +1,16 @@
|
||||||
|
-import unittest
|
||||||
|
+import traceback
|
||||||
|
+from io import StringIO
|
||||||
|
|
||||||
|
-from django.utils.ipv6 import clean_ipv6_address, is_valid_ipv6_address
|
||||||
|
+from django.core.exceptions import ValidationError
|
||||||
|
+from django.test import SimpleTestCase
|
||||||
|
+from django.utils.ipv6 import (
|
||||||
|
+ MAX_IPV6_ADDRESS_LENGTH,
|
||||||
|
+ clean_ipv6_address,
|
||||||
|
+ is_valid_ipv6_address,
|
||||||
|
+)
|
||||||
|
+from django.utils.version import PY310
|
||||||
|
|
||||||
|
-
|
||||||
|
-class TestUtilsIPv6(unittest.TestCase):
|
||||||
|
+class TestUtilsIPv6(SimpleTestCase):
|
||||||
|
|
||||||
|
def test_validates_correct_plain_address(self):
|
||||||
|
self.assertTrue(is_valid_ipv6_address('fe80::223:6cff:fe8a:2e8a'))
|
||||||
|
@@ -55,3 +62,29 @@ class TestUtilsIPv6(unittest.TestCase):
|
||||||
|
self.assertEqual(clean_ipv6_address('::ffff:0a0a:0a0a', unpack_ipv4=True), '10.10.10.10')
|
||||||
|
self.assertEqual(clean_ipv6_address('::ffff:1234:1234', unpack_ipv4=True), '18.52.18.52')
|
||||||
|
self.assertEqual(clean_ipv6_address('::ffff:18.52.18.52', unpack_ipv4=True), '18.52.18.52')
|
||||||
|
+
|
||||||
|
+ def test_address_too_long(self):
|
||||||
|
+ addresses = [
|
||||||
|
+ "0000:0000:0000:0000:0000:ffff:192.168.100.228", # IPv4-mapped IPv6 address
|
||||||
|
+ "0000:0000:0000:0000:0000:ffff:192.168.100.228%123456", # % scope/zone
|
||||||
|
+ "fe80::223:6cff:fe8a:2e8a:1234:5678:00000", # MAX_IPV6_ADDRESS_LENGTH + 1
|
||||||
|
+ ]
|
||||||
|
+ msg = "This is the error message."
|
||||||
|
+ value_error_msg = "Unable to convert %s to an IPv6 address (value too long)."
|
||||||
|
+ for addr in addresses:
|
||||||
|
+ with self.subTest(addr=addr):
|
||||||
|
+ self.assertGreater(len(addr), MAX_IPV6_ADDRESS_LENGTH)
|
||||||
|
+ self.assertEqual(is_valid_ipv6_address(addr), False)
|
||||||
|
+ with self.assertRaisesMessage(ValidationError, msg) as ctx:
|
||||||
|
+ clean_ipv6_address(addr, error_message=msg)
|
||||||
|
+ exception_traceback = StringIO()
|
||||||
|
+ if PY310:
|
||||||
|
+ traceback.print_exception(ctx.exception, file=exception_traceback)
|
||||||
|
+ else:
|
||||||
|
+ traceback.print_exception(
|
||||||
|
+ type(ctx.exception),
|
||||||
|
+ value=ctx.exception,
|
||||||
|
+ tb=ctx.exception.__traceback__,
|
||||||
|
+ file=exception_traceback,
|
||||||
|
+ )
|
||||||
|
+ self.assertIn(value_error_msg % addr, exception_traceback.getvalue())
|
||||||
|
Index: Django-2.2.28/django/utils/version.py
|
||||||
|
===================================================================
|
||||||
|
--- Django-2.2.28.orig/django/utils/version.py
|
||||||
|
+++ Django-2.2.28/django/utils/version.py
|
||||||
|
@@ -13,6 +13,7 @@ PY36 = sys.version_info >= (3, 6)
|
||||||
|
PY37 = sys.version_info >= (3, 7)
|
||||||
|
PY38 = sys.version_info >= (3, 8)
|
||||||
|
PY39 = sys.version_info >= (3, 9)
|
||||||
|
+PY310 = sys.version_info >= (3, 10)
|
||||||
|
|
||||||
|
|
||||||
|
def get_version(version=None):
|
||||||
|
|
||||||
@ -1,7 +1,7 @@
|
|||||||
%global _empty_manifest_terminate_build 0
|
%global _empty_manifest_terminate_build 0
|
||||||
Name: python-django
|
Name: python-django
|
||||||
Version: 2.2.27
|
Version: 2.2.27
|
||||||
Release: 13
|
Release: 14
|
||||||
Summary: A high-level Python Web framework that encourages rapid development and clean, pragmatic design.
|
Summary: A high-level Python Web framework that encourages rapid development and clean, pragmatic design.
|
||||||
License: Apache-2.0 and Python-2.0 and OFL-1.1 and MIT
|
License: Apache-2.0 and Python-2.0 and OFL-1.1 and MIT
|
||||||
URL: https://www.djangoproject.com/
|
URL: https://www.djangoproject.com/
|
||||||
@ -37,6 +37,7 @@ Patch18: CVE-2024-42005.patch
|
|||||||
Patch19: CVE-2024-45230.patch
|
Patch19: CVE-2024-45230.patch
|
||||||
Patch20: CVE-2024-45231.patch
|
Patch20: CVE-2024-45231.patch
|
||||||
Patch21: CVE-2024-53907.patch
|
Patch21: CVE-2024-53907.patch
|
||||||
|
Patch22: CVE-2024-56374.patch
|
||||||
|
|
||||||
BuildArch: noarch
|
BuildArch: noarch
|
||||||
%description
|
%description
|
||||||
@ -103,6 +104,9 @@ mv %{buildroot}/doclist.lst .
|
|||||||
%{_docdir}/*
|
%{_docdir}/*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Jan 17 2025 caodongxia <caodongxia@h-partners.com> - 2.2.27-14
|
||||||
|
- Fix CVE-2024-56374
|
||||||
|
|
||||||
* Mon Dec 09 2024 wangkai <13474090681@163.com> - 2.2.27-13
|
* Mon Dec 09 2024 wangkai <13474090681@163.com> - 2.2.27-13
|
||||||
- Fix CVE-2024-53907
|
- Fix CVE-2024-53907
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user