From c16e57a2282fb2c0cefbc1ade8cfffb489acec2b Mon Sep 17 00:00:00 2001 From: MSVSphere Packaging Team Date: Mon, 18 Dec 2023 17:16:59 +0300 Subject: [PATCH] import python-requests-2.22.0-10.module+el8.9.0+19598+4a60c7b7 --- SOURCES/CVE-2023-32681.patch | 59 ++++++++++++++++++++++++++++++++++++ SPECS/python-requests.spec | 14 +++++++-- 2 files changed, 71 insertions(+), 2 deletions(-) create mode 100644 SOURCES/CVE-2023-32681.patch diff --git a/SOURCES/CVE-2023-32681.patch b/SOURCES/CVE-2023-32681.patch new file mode 100644 index 0000000..4d3d51f --- /dev/null +++ b/SOURCES/CVE-2023-32681.patch @@ -0,0 +1,59 @@ +From 88313c734876b90c266d183d07d26338a14bc54c Mon Sep 17 00:00:00 2001 +From: Nate Prewitt +Date: Mon, 22 May 2023 08:08:57 -0700 +Subject: [PATCH] Merge pull request from GHSA-j8r2-6x86-q33q + +--- + requests/sessions.py | 4 +++- + tests/test_requests.py | 20 ++++++++++++++++++++ + 2 files changed, 23 insertions(+), 1 deletion(-) + +diff --git a/requests/sessions.py b/requests/sessions.py +index 45ab8a5..db9c594 100644 +--- a/requests/sessions.py ++++ b/requests/sessions.py +@@ -306,7 +306,9 @@ class SessionRedirectMixin(object): + except KeyError: + username, password = None, None + +- if username and password: ++ # urllib3 handles proxy authorization for us in the standard adapter. ++ # Avoid appending this to TLS tunneled requests where it may be leaked. ++ if not scheme.startswith('https') and username and password: + headers['Proxy-Authorization'] = _basic_auth_str(username, password) + + return new_proxies +diff --git a/tests/test_requests.py b/tests/test_requests.py +index 5e721cb..c70706f 100644 +--- a/tests/test_requests.py ++++ b/tests/test_requests.py +@@ -551,6 +551,26 @@ class TestRequests: + with pytest.raises(InvalidProxyURL): + requests.get(httpbin(), proxies={'http': 'http:///example.com:8080'}) + ++ ++ @pytest.mark.parametrize( ++ "url,has_proxy_auth", ++ ( ++ ('http://example.com', True), ++ ('https://example.com', False), ++ ), ++ ) ++ def test_proxy_authorization_not_appended_to_https_request(self, url, has_proxy_auth): ++ session = requests.Session() ++ proxies = { ++ 'http': 'http://test:pass@localhost:8080', ++ 'https': 'http://test:pass@localhost:8090', ++ } ++ req = requests.Request('GET', url) ++ prep = req.prepare() ++ session.rebuild_proxies(prep, proxies) ++ ++ assert ('Proxy-Authorization' in prep.headers) is has_proxy_auth ++ + def test_basicauth_with_netrc(self, httpbin): + auth = ('user', 'pass') + wrong_auth = ('wronguser', 'wrongpass') +-- +2.40.1 + diff --git a/SPECS/python-requests.spec b/SPECS/python-requests.spec index 964f6f3..bb9da79 100644 --- a/SPECS/python-requests.spec +++ b/SPECS/python-requests.spec @@ -2,7 +2,7 @@ Name: python-requests Version: 2.22.0 -Release: 9%{?dist} +Release: 10%{?dist} Summary: HTTP library, written in Python, for human beings License: ASL 2.0 @@ -31,6 +31,12 @@ Patch5: requests-2.20.0-no-py2-httpbin.patch # https://github.com/kennethreitz/requests/pull/5049 Patch6: support-pytest-4.patch +# Security fix for CVE-2023-32681 +# Unintended leak of Proxy-Authorization header +# Resolved upstream: https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 +# Tracking bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2209469 +Patch7: CVE-2023-32681.patch + BuildArch: noarch # Exclude i686 arch. Due to a modularity issue it's being added to the # x86_64 compose of CRB, but we don't want to ship it at all. @@ -100,9 +106,13 @@ PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} -m pytest -v %changelog -* Tue Dec 12 2023 MSVSphere Packaging Team - 2.22.0-9 +* Tue Dec 12 2023 MSVSphere Packaging Team - 2.22.0-10 - Rebuilt for MSVSphere 8.8 +* Wed Jun 21 2023 Lumír Balhar - 2.22.0-10 +- Security fix for CVE-2023-32681 +Resolves: rhbz#2209469 + * Fri Dec 13 2019 Tomas Orsava - 2.22.0-9 - Exclude unsupported i686 arch