4 changed files with 156 additions and 90 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/jwcrypto-1.5.6.tar.gz
+SOURCES/jwcrypto-0.8.tar.gz
--- a/.python-jwcrypto.metadata
+++ b/.python-jwcrypto.metadata
@ -1 +1 @@
-e3fdb8f42c60e947cbe58346d086850d915a2b60 SOURCES/jwcrypto-1.5.6.tar.gz
+038ee5faf896548477c0b57c3cacb92add36e550 SOURCES/jwcrypto-0.8.tar.gz
--- a/SOURCES/0001-Address-potential-DoS-with-high-compression-ratio_rhel#28698.patch
+++ b/SOURCES/0001-Address-potential-DoS-with-high-compression-ratio_rhel#28698.patch
@ -0,0 +1,74 @@
+From 90477a3b6e73da69740e00b8161f53fea19b831f Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Tue, 5 Mar 2024 16:57:17 -0500
+Subject: [PATCH] Address potential DoS with high compression ratio
+
+Fixes CVE-2024-28102
+
+Signed-off-by: Simo Sorce <simo@redhat.com>
+---
+ jwcrypto/jwe.py   |  7 +++++++
+ jwcrypto/tests.py | 26 ++++++++++++++++++++++++++
+ 2 files changed, 33 insertions(+)
+
+diff --git a/jwcrypto/jwe.py b/jwcrypto/jwe.py
+index 9412881..5df500b 100644
+--- a/jwcrypto/jwe.py
+++ b/jwcrypto/jwe.py
+@@ -10,5 +10,8 @@
+ from jwcrypto.jwa import JWA
+ 
+# Limit the amount of data we are willing to decompress by default.
+default_max_compressed_size = 256 * 1024
+
+ 
+ # RFC 7516 - 4.1
+ # name: (description, supported?)
+@@ -387,6 +387,10 @@ def _decrypt(self, key, ppe):
+ 
+         compress = jh.get('zip', None)
+         if compress == 'DEF':
+            if len(data) > default_max_compressed_size:
+                raise InvalidJWEData(
+                    'Compressed data exceeds maximum allowed'
+                    'size' + f' ({default_max_compressed_size})')
+             self.plaintext = zlib.decompress(data, -zlib.MAX_WBITS)
+         elif compress is None:
+             self.plaintext = data
+diff --git a/jwcrypto/tests.py b/jwcrypto/tests.py
+index bb2ff10..59049f8 100644
+--- a/jwcrypto/tests.py
+++ b/jwcrypto/tests.py
+@@ -1526,6 +1526,32 @@ def test_pbes2_hs256_aeskw_custom_params(self):
+             token.deserialize(jwt=e)
+             json_decode(token.claims)
+ 
+    def test_jwe_decompression_max(self):
+        key = jwk.JWK(kty='oct', k=base64url_encode(b'A' * (128 // 8)))
+        payload = '{"u": "' + "u" * 400000000 + '", "uu":"' \
+            + "u" * 400000000 + '"}'
+        protected_header = {
+            "alg": "A128KW",
+            "enc": "A128GCM",
+            "typ": "JWE",
+            "zip": "DEF",
+        }
+        enc = jwe.JWE(payload.encode('utf-8'),
+                      recipient=key,
+                      protected=protected_header).serialize(compact=True)
+        with self.assertRaises(jwe.InvalidJWEData):
+            check = jwe.JWE()
+            check.deserialize(enc)
+            check.decrypt(key)
+
+        defmax = jwe.default_max_compressed_size
+        jwe.default_max_compressed_size = 1000000000
+        # ensure we can eraise the limit and decrypt
+        check = jwe.JWE()
+        check.deserialize(enc)
+        check.decrypt(key)
+        jwe.default_max_compressed_size = defmax
+
+ 
+ class JWATests(unittest.TestCase):
+     def test_jwa_create(self):
--- a/SPECS/python-jwcrypto.spec
+++ b/SPECS/python-jwcrypto.spec
@ -1,146 +1,140 @@
-## START: Set by rpmautospec
-## (rpmautospec version 0.6.5)
-## RPMAUTOSPEC: autorelease, autochangelog
-%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 4;
-    base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
-    print(release_number + base_release_number - 1);
-}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
-## END: Set by rpmautospec
+%if 0%{?fedora} || 0%{?rhel} > 7
+# Enable python3 build by default
+%bcond_without python3
+%else
+%bcond_with python3
+%endif
+
+%if 0%{?fedora} > 31 || 0%{?rhel} > 7
+# Disable python2 build by default
+%bcond_with python2
+%else
+%bcond_without python2
+%endif

 %global srcname jwcrypto

 Name:           python-%{srcname}
-Version:        1.5.6
-Release:        %autorelease
+Version:        0.8
+Release:        5%{?dist}
 Summary:        Implements JWK, JWS, JWE specifications using python-cryptography

-License:        LGPL-3.0-or-later
+License:        LGPLv3+
 URL:            https://github.com/latchset/%{srcname}
 Source0:        https://github.com/latchset/%{srcname}/releases/download/v%{version}/%{srcname}-%{version}.tar.gz

+Patch1:         0001-Address-potential-DoS-with-high-compression-ratio_rhel#28698.patch
+
 BuildArch:      noarch
+%if 0%{?with_python2}
+BuildRequires:  python2-devel
+BuildRequires:  python2-setuptools
+BuildRequires:  python2-cryptography >= 1.5
+BuildRequires:  python2-pytest
+%endif
+
+%if 0%{?with_python3}
 BuildRequires:  python%{python3_pkgversion}-devel
 BuildRequires:  python%{python3_pkgversion}-setuptools
-BuildRequires:  python%{python3_pkgversion}-cryptography >= 2.3
+BuildRequires:  python%{python3_pkgversion}-cryptography >= 1.5
 BuildRequires:  python%{python3_pkgversion}-pytest
-BuildRequires:  python%{python3_pkgversion}-typing-extensions
-%if %{undefined rhel}
-BuildRequires:  python%{python3_pkgversion}-deprecated
 %endif

 %description
 Implements JWK, JWS, JWE specifications using python-cryptography


+%if 0%{?with_python2}
+%package -n python2-%{srcname}
+Summary:        Implements JWK,JWS,JWE specifications using python-cryptography
+Requires:       python2-cryptography >= 1.5
+%{?python_provide:%python_provide python2-%{srcname}}
+
+%description -n python2-%{srcname}
+Implements JWK, JWS, JWE specifications using python-cryptography
+%endif
+
+
+%if 0%{?with_python3}
 %package -n python%{python3_pkgversion}-%{srcname}
 Summary:        Implements JWK, JWS, JWE specifications using python-cryptography
-Requires:       python%{python3_pkgversion}-cryptography >= 2.3
-%if %{undefined rhel}
-Requires:       python%{python3_pkgversion}-deprecated
-%endif
+Requires:       python%{python3_pkgversion}-cryptography >= 1.5
 %{?python_provide:%python_provide python%{python3_pkgversion}-%{srcname}}

 %description -n python%{python3_pkgversion}-%{srcname}
 Implements JWK, JWS, JWE specifications using python-cryptography
+%endif


 %prep
 %setup -q -n %{srcname}-%{version}
-%if %{defined rhel}
-# avoid python-deprecated dependency
-sed -i -e '/deprecated/d' setup.py %{srcname}.egg-info/requires.txt
-sed -i -e '/^from deprecated/d' -e '/@deprecated/d' %{srcname}/*.py
-%endif

+%autopatch -p 1

 %build
+%if 0%{?with_python2}
+%py2_build
+%endif
+%if 0%{?with_python3}
 %py3_build
+%endif


 %check
+%if 0%{?with_python2}
+%{__python2} -bb -m pytest %{srcname}/test*.py
+%endif
+%if 0%{?with_python3}
 %{__python3} -bb -m pytest %{srcname}/test*.py
+%endif


 %install
+%if 0%{?with_python2}
+%py2_install
+%endif
+%if 0%{?with_python3}
 %py3_install
+%endif

 rm -rf %{buildroot}%{_docdir}/%{srcname}
+%if 0%{?with_python2}
+rm -rf %{buildroot}%{python2_sitelib}/%{srcname}/tests{,-cookbook}.py*
+%endif
+%if 0%{?with_python3}
 rm -rf %{buildroot}%{python3_sitelib}/%{srcname}/tests{,-cookbook}.py*
 rm -rf %{buildroot}%{python3_sitelib}/%{srcname}/__pycache__/tests{,-cookbook}.*.py*
+%endif
+

+%if 0%{?with_python2}
+%files -n python2-%{srcname}
+%doc README.md
+%license LICENSE
+%{python2_sitelib}/%{srcname}
+%{python2_sitelib}/%{srcname}-%{version}-py%{python2_version}.egg-info
+%endif

+%if 0%{?with_python3}
 %files -n python%{python3_pkgversion}-%{srcname}
 %doc README.md
 %license LICENSE
 %{python3_sitelib}/%{srcname}
 %{python3_sitelib}/%{srcname}-%{version}-py%{python3_version}.egg-info
+%endif


 %changelog
-## START: Generated by rpmautospec
-* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.5.6-4
- Bump release for October 2024 mass rebuild:
-
-* Fri Oct 25 2024 MSVSphere Packaging Team <packager@msvsphere-os.ru> - 1.5.6-3
- Rebuilt for MSVSphere 10
-
-* Fri Jun 28 2024 Sudhir Menon <sumenon@redhat.com> - 1.5.6-3
- Added gating.yaml and tests for python-jwcrypto
-
-* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 1.5.6-2
- Bump release for June 2024 mass rebuild
-
-* Wed Jun 12 2024 Rafael Guterres Jeffman <rjeffman@redhat.com> - 1.5.6-1
- Rebase to version 1.5.6
-
-* Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.2-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.2-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Mon Jul 24 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 1.4.2-7
- Avoid python-deprecated dependency in RHEL builds
-
-* Mon Jul 24 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 1.4.2-6
- Remove obsolete python2 packaging
+* Thu Apr 04 2024 Rafael Jeffman <rjeffman@redhat.com> - 0.8-5
+- Address potential DoS with high compression ratio
+  Resolves: RHEL-28698

-* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.2-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 0.8-4
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688

-* Thu Jun 15 2023 Python Maint <python-maint@redhat.com> - 1.4.2-4
- Rebuilt for Python 3.12
-
-* Tue Apr 04 2023 Christian Heimes <cheimes@redhat.com> - 1.4.2-3
- Use SPDX license tags
-
-* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Thu Sep 15 2022 Simo Sorce <simo@redhat.com> - 1.4.2-1
- Version 1.4.2
-
-* Wed Sep 14 2022 Simo Sorce <simo@redhat.com> - 1.4.1-1
- Version 1.4.1
-
-* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.9.1-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Tue Jun 14 2022 Python Maint <python-maint@redhat.com> - 0.9.1-4
- Rebuilt for Python 3.11
-
-* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.9.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.9.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Thu Jun 10 2021 Simo Sorce <simo@redhat.com> - 0.9.1-1
- Sync with upstream release 0.9.1
-
-* Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 0.8-3
- Rebuilt for Python 3.10
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 0.8-3
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937

 * Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.8-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
@ -253,5 +247,3 @@ rm -rf %{buildroot}%{python3_sitelib}/%{srcname}/__pycache__/tests{,-cookbook}.*

 * Tue Jun 16 2015 Patrick Uiterwijk <puiterwijk@redhat.com> - 0.2.0-1
 - Initial packaging
-
-## END: Generated by rpmautospec