fix CVE-2021-46823
(cherry picked from commit 6e1b818c405f65fb3a21f1e4ef74537f1018f639)
This commit is contained in:
zhouwenpei
openeuler-sync-bot
parent
154f876d70
commit
d2256dde7a
74
backport-0001-CVE-2021-46823.patch
Normal file
74
backport-0001-CVE-2021-46823.patch
Normal file
@ -0,0 +1,74 @@
|
||||
From 7e084aec1ba9ced25b44fd3db77e65242a827806 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
|
||||
Date: Wed, 6 May 2020 15:48:46 +0100
|
||||
Subject: [PATCH] Get rid of expected failures in tokenizer tests
|
||||
|
||||
https://github.com/python-ldap/python-ldap/pull/283
|
||||
---
|
||||
Lib/ldap/schema/tokenizer.py | 10 +++++++---
|
||||
Tests/t_ldap_schema_tokenizer.py | 6 ++----
|
||||
2 files changed, 9 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/Lib/ldap/schema/tokenizer.py b/Lib/ldap/schema/tokenizer.py
|
||||
index 20958c09..69823f2b 100644
|
||||
--- a/Lib/ldap/schema/tokenizer.py
|
||||
+++ b/Lib/ldap/schema/tokenizer.py
|
||||
@@ -13,12 +13,16 @@
|
||||
r"|" # or
|
||||
r"([^'$()\s]+)" # string of length >= 1 without '$() or whitespace
|
||||
r"|" # or
|
||||
- r"('.*?'(?!\w))" # any string or empty string surrounded by single quotes
|
||||
- # except if right quote is succeeded by alphanumeric char
|
||||
+ r"('(?:[^'\\]|\\\\|\\.)*?'(?!\w))"
|
||||
+ # any string or empty string surrounded by unescaped
|
||||
+ # single quotes except if right quote is succeeded by
|
||||
+ # alphanumeric char
|
||||
r"|" # or
|
||||
r"([^\s]+?)", # residue, all non-whitespace strings
|
||||
).findall
|
||||
|
||||
+UNESCAPE_PATTERN = re.compile(r"\\(.)")
|
||||
+
|
||||
|
||||
def split_tokens(s):
|
||||
"""
|
||||
@@ -30,7 +34,7 @@ def split_tokens(s):
|
||||
if unquoted:
|
||||
parts.append(unquoted)
|
||||
elif quoted:
|
||||
- parts.append(quoted[1:-1])
|
||||
+ parts.append(UNESCAPE_PATTERN.sub(r'\1', quoted[1:-1]))
|
||||
elif opar:
|
||||
parens += 1
|
||||
parts.append(opar)
|
||||
diff --git a/Tests/t_ldap_schema_tokenizer.py b/Tests/t_ldap_schema_tokenizer.py
|
||||
index c8581771..0890379a 100644
|
||||
--- a/Tests/t_ldap_schema_tokenizer.py
|
||||
+++ b/Tests/t_ldap_schema_tokenizer.py
|
||||
@@ -44,8 +44,8 @@
|
||||
|
||||
# broken schema of Oracle Internet Directory
|
||||
TESTCASES_BROKEN_OID = (
|
||||
- ("BLUBB DI 'BLU B B ER'MUST 'BLAH' ", ['BLUBB', 'DI', 'BLU B B ER', 'MUST', 'BLAH']),
|
||||
- ("BLUBBER DI 'BLU'BB ER' DA 'BLAH' ", ["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]),
|
||||
+ "BLUBB DI 'BLU B B ER'MUST 'BLAH' ", #['BLUBB', 'DI', 'BLU B B ER', 'MUST', 'BLAH']
|
||||
+ "BLUBBER DI 'BLU'BB ER' DA 'BLAH' ", #["BLUBBER", "DI", "BLU'BB ER", "DA", "BLAH"]
|
||||
)
|
||||
|
||||
# for quoted single quotes inside string values
|
||||
@@ -104,14 +104,12 @@ def test_utf8(self):
|
||||
"""
|
||||
self._run_split_tokens_tests(TESTCASES_UTF8)
|
||||
|
||||
- @unittest.expectedFailure
|
||||
def test_broken_oid(self):
|
||||
"""
|
||||
run test cases specified in constant TESTCASES_BROKEN_OID
|
||||
"""
|
||||
self._run_failure_tests(TESTCASES_BROKEN_OID)
|
||||
|
||||
- @unittest.expectedFailure
|
||||
def test_escaped_quotes(self):
|
||||
"""
|
||||
run test cases specified in constant TESTCASES_ESCAPED_QUOTES
|
||||
|
||||
22
backport-0002-CVE-2021-46823.patch
Normal file
22
backport-0002-CVE-2021-46823.patch
Normal file
@ -0,0 +1,22 @@
|
||||
From faa011b41f7141121546045925d809d54e70f5fd Mon Sep 17 00:00:00 2001
|
||||
From: Kevin Backhouse <kevinbackhouse@github.com>
|
||||
Date: Fri, 15 Oct 2021 15:21:37 +0100
|
||||
Subject: [PATCH] Fix ReDoS in regex.
|
||||
|
||||
---
|
||||
Lib/ldap/schema/tokenizer.py | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Lib/ldap/schema/tokenizer.py b/Lib/ldap/schema/tokenizer.py
|
||||
index 69823f2b..623b86d5 100644
|
||||
--- a/Lib/ldap/schema/tokenizer.py
|
||||
+++ b/Lib/ldap/schema/tokenizer.py
|
||||
@@ -13,7 +13,7 @@
|
||||
r"|" # or
|
||||
r"([^'$()\s]+)" # string of length >= 1 without '$() or whitespace
|
||||
r"|" # or
|
||||
- r"('(?:[^'\\]|\\\\|\\.)*?'(?!\w))"
|
||||
+ r"('(?:[^'\\]|\\.)*'(?!\w))"
|
||||
# any string or empty string surrounded by unescaped
|
||||
# single quotes except if right quote is succeeded by
|
||||
# alphanumeric char
|
||||
@ -1,12 +1,15 @@
|
||||
%define debug_package %{nil}
|
||||
Name: python-ldap
|
||||
Version: 3.1.0
|
||||
Release: 3
|
||||
Release: 4
|
||||
Summary: An object-oriented API to access LDAP directory servers
|
||||
License: Python
|
||||
URL: http://python-ldap.org/
|
||||
Source0: https://files.pythonhosted.org/packages/source/p/%{name}/%{name}-%{version}.tar.gz
|
||||
|
||||
Patch0: backport-0001-CVE-2021-46823.patch
|
||||
Patch1: backport-0002-CVE-2021-46823.patch
|
||||
|
||||
BuildRequires: gcc openldap-devel openssl-devel cyrus-sasl-devel
|
||||
BuildRequires: python3-devel python3-setuptools openldap-servers
|
||||
|
||||
@ -35,7 +38,7 @@ OpenLDAP 2.x libraries, and contains modules for other LDAP-related tasks\
|
||||
%package_help
|
||||
|
||||
%prep
|
||||
%autosetup -n %{name}-%{version}
|
||||
%autosetup -p1 -n %{name}-%{version}
|
||||
find . -name '*.py' | xargs sed -i '1s|^#!/usr/bin/env python|#!%{__python3}|'
|
||||
sed -i 's,-Werror,-Wignore,g' tox.ini
|
||||
%build
|
||||
@ -56,6 +59,9 @@ sed -i 's,-Werror,-Wignore,g' tox.ini
|
||||
%doc CHANGES README TODO Demo
|
||||
|
||||
%changelog
|
||||
* Tue Jul 26 2022 zhouwenpei<zhouwenpei1@h-partners.com> - 3.1.0-4
|
||||
- fix CVE-2021-46823
|
||||
|
||||
* Wed Oct 14 2020 shixuantong<shixuantong@huawei.com> - 3.1.0-3
|
||||
- delete useless buildrequires
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user