From d3f0d6834416b3ee0e09f7b6a3ae09839fc16376 Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Sun, 2 Oct 2016 10:48:28 -0700 Subject: python: Security fix CVE-2016-1000110 Signed-off-by: Armin Kuster --- .../python/python/CVE-2016-1000110.patch | 157 +++++++++++++++++++++ meta/recipes-devtools/python/python_2.7.11.bb | 1 + 2 files changed, 158 insertions(+) create mode 100644 meta/recipes-devtools/python/python/CVE-2016-1000110.patch (limited to 'meta/recipes-devtools') diff --git a/meta/recipes-devtools/python/python/CVE-2016-1000110.patch b/meta/recipes-devtools/python/python/CVE-2016-1000110.patch new file mode 100644 index 0000000000..071175acec --- /dev/null +++ b/meta/recipes-devtools/python/python/CVE-2016-1000110.patch @@ -0,0 +1,157 @@ +From 5be8d3e97b1d2e526548cb346fd5f8980d31616a Mon Sep 17 00:00:00 2001 +From: Senthil Kumaran +Date: Sat, 30 Jul 2016 05:49:53 -0700 +Subject: [PATCH] Prevent HTTPoxy attack (CVE-2016-1000110) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which +indicates that the script is in CGI mode. + +Issue reported and patch contributed by Rémi Rampin. + +Upstream-Status: Backport +CVE: CVE-2016-1000110 + +Signed-off-by: Armin Kuster + +--- + Doc/howto/urllib2.rst | 5 +++++ + Doc/library/urllib.rst | 10 ++++++++++ + Doc/library/urllib2.rst | 5 +++++ + Lib/test/test_urllib.py | 12 ++++++++++++ + Lib/urllib.py | 9 +++++++++ + Misc/ACKS | 1 + + Misc/NEWS | 4 ++++ + 7 files changed, 46 insertions(+) + +Index: Python-2.7.11/Doc/howto/urllib2.rst +=================================================================== +--- Python-2.7.11.orig/Doc/howto/urllib2.rst ++++ Python-2.7.11/Doc/howto/urllib2.rst +@@ -523,6 +523,11 @@ setting up a `Basic Authentication`_ han + through a proxy. However, this can be enabled by extending urllib2 as + shown in the recipe [#]_. + ++.. note:: ++ ++ ``HTTP_PROXY`` will be ignored if a variable ``REQUEST_METHOD`` is set; see ++ the documentation on :func:`~urllib.getproxies`. ++ + + Sockets and Layers + ================== +Index: Python-2.7.11/Doc/library/urllib.rst +=================================================================== +--- Python-2.7.11.orig/Doc/library/urllib.rst ++++ Python-2.7.11/Doc/library/urllib.rst +@@ -293,6 +293,16 @@ Utility functions + find it, looks for proxy information from Mac OSX System Configuration for + Mac OS X and Windows Systems Registry for Windows. + ++ .. note:: ++ ++ If the environment variable ``REQUEST_METHOD`` is set, which usually ++ indicates your script is running in a CGI environment, the environment ++ variable ``HTTP_PROXY`` (uppercase ``_PROXY``) will be ignored. This is ++ because that variable can be injected by a client using the "Proxy:" ++ HTTP header. If you need to use an HTTP proxy in a CGI environment, ++ either use ``ProxyHandler`` explicitly, or make sure the variable name ++ is in lowercase (or at least the ``_proxy`` suffix). ++ + .. note:: + urllib also exposes certain utility functions like splittype, splithost and + others parsing url into various components. But it is recommended to use +Index: Python-2.7.11/Doc/library/urllib2.rst +=================================================================== +--- Python-2.7.11.orig/Doc/library/urllib2.rst ++++ Python-2.7.11/Doc/library/urllib2.rst +@@ -229,6 +229,11 @@ The following classes are provided: + + To disable autodetected proxy pass an empty dictionary. + ++ .. note:: ++ ++ ``HTTP_PROXY`` will be ignored if a variable ``REQUEST_METHOD`` is set; ++ see the documentation on :func:`~urllib.getproxies`. ++ + + .. class:: HTTPPasswordMgr() + +Index: Python-2.7.11/Misc/ACKS +=================================================================== +--- Python-2.7.11.orig/Misc/ACKS ++++ Python-2.7.11/Misc/ACKS +@@ -1110,6 +1110,7 @@ Jérôme Radix + Burton Radons + Jeff Ramnani + Brodie Rao ++Rémi Rampin + Senko Rasic + Antti Rasinen + Nikolaus Rath +Index: Python-2.7.11/Lib/test/test_urllib.py +=================================================================== +--- Python-2.7.11.orig/Lib/test/test_urllib.py ++++ Python-2.7.11/Lib/test/test_urllib.py +@@ -162,6 +162,18 @@ class ProxyTests(unittest.TestCase): + self.assertTrue(urllib.proxy_bypass_environment('anotherdomain.com')) + + ++ def test_proxy_cgi_ignore(self): ++ try: ++ self.env.set('HTTP_PROXY', 'http://somewhere:3128') ++ proxies = urllib.getproxies_environment() ++ self.assertEqual('http://somewhere:3128', proxies['http']) ++ self.env.set('REQUEST_METHOD', 'GET') ++ proxies = urllib.getproxies_environment() ++ self.assertNotIn('http', proxies) ++ finally: ++ self.env.unset('REQUEST_METHOD') ++ self.env.unset('HTTP_PROXY') ++ + class urlopen_HttpTests(unittest.TestCase, FakeHTTPMixin): + """Test urlopen() opening a fake http connection.""" + +Index: Python-2.7.11/Lib/urllib.py +=================================================================== +--- Python-2.7.11.orig/Lib/urllib.py ++++ Python-2.7.11/Lib/urllib.py +@@ -1382,11 +1382,21 @@ def getproxies_environment(): + [Fancy]URLopener constructor. + + """ ++ # Get all variables + proxies = {} + for name, value in os.environ.items(): + name = name.lower() + if value and name[-6:] == '_proxy': + proxies[name[:-6]] = value ++ ++ # CVE-2016-1000110 - If we are running as CGI script, forget HTTP_PROXY ++ # (non-all-lowercase) as it may be set from the web server by a "Proxy:" ++ # header from the client ++ # If "proxy" is lowercase, it will still be used thanks to the next block ++ if 'REQUEST_METHOD' in os.environ: ++ proxies.pop('http', None) ++ ++ # Get lowercase variables + return proxies + + def proxy_bypass_environment(host): +Index: Python-2.7.11/Misc/NEWS +=================================================================== +--- Python-2.7.11.orig/Misc/NEWS ++++ Python-2.7.11/Misc/NEWS +@@ -10,6 +10,10 @@ What's New in Python 2.7.11? + Library + ------- + ++- Issue #27568: Prevent HTTPoxy attack (CVE-2016-1000110). Ignore the ++ HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates ++ that the script is in CGI mode. ++ + - Issue #25624: ZipFile now always writes a ZIP_STORED header for directory + entries. Patch by Dingyuan Wang. + diff --git a/meta/recipes-devtools/python/python_2.7.11.bb b/meta/recipes-devtools/python/python_2.7.11.bb index 606f153623..9697c1bf0b 100644 --- a/meta/recipes-devtools/python/python_2.7.11.bb +++ b/meta/recipes-devtools/python/python_2.7.11.bb @@ -27,6 +27,7 @@ SRC_URI += "\ file://use_sysroot_ncurses_instead_of_host.patch \ file://avoid_parallel_make_races_on_pgen.patch \ file://add-CROSSPYTHONPATH-for-PYTHON_FOR_BUILD.patch \ + file://CVE-2016-1000110.patch \ " S = "${WORKDIR}/Python-${PV}" -- cgit 1.2.3-korg