From 744eb37c8abf4c30a0c462580541bf195a987a56 Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Sun, 2 Oct 2016 10:49:08 -0700 Subject: python3: Security fix CVE-2016-1000110 Signed-off-by: Armin Kuster --- .../python/python3/CVE-2016-1000110.patch | 129 +++++++++++++++++++++ meta/recipes-devtools/python/python3_3.5.1.bb | 1 + 2 files changed, 130 insertions(+) create mode 100644 meta/recipes-devtools/python/python3/CVE-2016-1000110.patch diff --git a/meta/recipes-devtools/python/python3/CVE-2016-1000110.patch b/meta/recipes-devtools/python/python3/CVE-2016-1000110.patch new file mode 100644 index 0000000000..659dcb2f0c --- /dev/null +++ b/meta/recipes-devtools/python/python3/CVE-2016-1000110.patch @@ -0,0 +1,129 @@ +From 5e0700418dc27b645edbe33c744daff93cd66618 Mon Sep 17 00:00:00 2001 +From: Senthil Kumaran +Date: Sat, 30 Jul 2016 23:24:16 -0700 +Subject: [PATCH] Prevent HTTPoxy attack (CVE-2016-1000110) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which +indicates that the script is in CGI mode. + +Issue #27568 Reported and patch contributed by Rémi Rampin. + +Upstream-Status: Backport +CVE: CVE-2016-1000110 + +Signed-off-by: Armin Kuster + +--- + Doc/howto/urllib2.rst | 5 +++++ + Doc/library/urllib.request.rst | 13 +++++++++++++ + Lib/test/test_urllib.py | 13 +++++++++++++ + Lib/urllib/request.py | 7 +++++++ + Misc/NEWS | 4 ++++ + 5 files changed, 42 insertions(+) + +Index: Python-3.5.1/Doc/howto/urllib2.rst +=================================================================== +--- Python-3.5.1.orig/Doc/howto/urllib2.rst ++++ Python-3.5.1/Doc/howto/urllib2.rst +@@ -538,6 +538,11 @@ setting up a `Basic Authentication`_ han + through a proxy. However, this can be enabled by extending urllib.request as + shown in the recipe [#]_. + ++.. note:: ++ ++ `HTTP_PROXY`` will be ignored if a variable ``REQUEST_METHOD`` is set; see ++ the documentation on :func:`~urllib.request.getproxies`. ++ + + Sockets and Layers + ================== +Index: Python-3.5.1/Doc/library/urllib.request.rst +=================================================================== +--- Python-3.5.1.orig/Doc/library/urllib.request.rst ++++ Python-3.5.1/Doc/library/urllib.request.rst +@@ -166,6 +166,14 @@ The :mod:`urllib.request` module defines + cannot find it, looks for proxy information from Mac OSX System + Configuration for Mac OS X and Windows Systems Registry for Windows. + ++ .. note:: ++ ++ If the environment variable ``REQUEST_METHOD`` is set, which usually ++ indicates your script is running in a CGI environment, the environment ++ variable ``HTTP_PROXY`` (uppercase ``_PROXY``) will be ignored. This is ++ because that variable can be injected by a client using the "Proxy:" HTTP ++ header. If you need to use an HTTP proxy in a CGI environment use ++ ``ProxyHandler`` explicitly. + + The following classes are provided: + +@@ -275,6 +283,11 @@ The following classes are provided: + + To disable autodetected proxy pass an empty dictionary. + ++ .. note:: ++ ++ ``HTTP_PROXY`` will be ignored if a variable ``REQUEST_METHOD`` is set; ++ see the documentation on :func:`~urllib.request.getproxies`. ++ + + .. class:: HTTPPasswordMgr() + +Index: Python-3.5.1/Lib/urllib/request.py +=================================================================== +--- Python-3.5.1.orig/Lib/urllib/request.py ++++ Python-3.5.1/Lib/urllib/request.py +@@ -2394,6 +2394,13 @@ def getproxies_environment(): + name = name.lower() + if value and name[-6:] == '_proxy': + proxies[name[:-6]] = value ++ ++ # CVE-2016-1000110 - If we are running as CGI script, forget HTTP_PROXY ++ # (non-all-lowercase) as it may be set from the web server by a "Proxy:" ++ # header from the client ++ if 'REQUEST_METHOD' in os.environ: ++ proxies.pop('http', None) ++ + return proxies + + def proxy_bypass_environment(host): +Index: Python-3.5.1/Misc/NEWS +=================================================================== +--- Python-3.5.1.orig/Misc/NEWS ++++ Python-3.5.1/Misc/NEWS +@@ -1266,6 +1266,10 @@ Library + lines from the code object, fixing an issue when a lambda function is used as + decorator argument. Patch by Thomas Ballinger and Allison Kaptur. + ++- Issue #27568: Prevent HTTPoxy attack (CVE-2016-1000110). Ignore the ++ HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates ++ that the script is in CGI mode. ++ + - Issue #24521: Fix possible integer overflows in the pickle module. + + - Issue #22931: Allow '[' and ']' in cookie values. +Index: Python-3.5.1/Lib/test/test_urllib.py +=================================================================== +--- Python-3.5.1.orig/Lib/test/test_urllib.py ++++ Python-3.5.1/Lib/test/test_urllib.py +@@ -224,6 +224,18 @@ class ProxyTests(unittest.TestCase): + # List of no_proxies with space. + self.env.set('NO_PROXY', 'localhost, anotherdomain.com, newdomain.com') + self.assertTrue(urllib.request.proxy_bypass_environment('anotherdomain.com')) ++ def test_proxy_cgi_ignore(self): ++ try: ++ self.env.set('HTTP_PROXY', 'http://somewhere:3128') ++ proxies = urllib.request.getproxies_environment() ++ self.assertEqual('http://somewhere:3128', proxies['http']) ++ self.env.set('REQUEST_METHOD', 'GET') ++ proxies = urllib.request.getproxies_environment() ++ self.assertNotIn('http', proxies) ++ finally: ++ self.env.unset('REQUEST_METHOD') ++ self.env.unset('HTTP_PROXY') ++ + + class urlopen_HttpTests(unittest.TestCase, FakeHTTPMixin, FakeFTPMixin): + """Test urlopen() opening a fake http connection.""" diff --git a/meta/recipes-devtools/python/python3_3.5.1.bb b/meta/recipes-devtools/python/python3_3.5.1.bb index 37ef26775b..f83a032bd3 100644 --- a/meta/recipes-devtools/python/python3_3.5.1.bb +++ b/meta/recipes-devtools/python/python3_3.5.1.bb @@ -38,6 +38,7 @@ SRC_URI += "\ file://setup.py-find-libraries-in-staging-dirs.patch \ file://use_packed_importlib.patch \ file://configure.ac-fix-LIBPL.patch \ + file://CVE-2016-1000110.patch \ " SRC_URI[md5sum] = "e9ea6f2623fffcdd871b7b19113fde80" SRC_URI[sha256sum] = "c6d57c0c366d9060ab6c0cdf889ebf3d92711d466cc0119c441dbf2746f725c9" -- cgit 1.2.3-korg