From 638100f5728d1611ae8e245b6c00fd05a06f9437 Mon Sep 17 00:00:00 2001 From: MSVSphere Packaging Team Date: Mon, 18 Dec 2023 20:57:53 +0300 Subject: [PATCH] import python3x-pip-19.3.1-1.module+el8.4.0+8888+89bc7e79 --- SOURCES/CVE-2021-33503.patch | 42 ----------- SOURCES/CVE-2021-3572.patch | 34 --------- SOURCES/cve-2007-4559-tarfile.patch | 78 ------------------- SOURCES/fix-tmpdir-infinite-recursion.patch | 84 --------------------- SPECS/python3x-pip.spec | 68 +---------------- 5 files changed, 4 insertions(+), 302 deletions(-) delete mode 100644 SOURCES/CVE-2021-33503.patch delete mode 100644 SOURCES/CVE-2021-3572.patch delete mode 100644 SOURCES/cve-2007-4559-tarfile.patch delete mode 100644 SOURCES/fix-tmpdir-infinite-recursion.patch diff --git a/SOURCES/CVE-2021-33503.patch b/SOURCES/CVE-2021-33503.patch deleted file mode 100644 index d7a8b01..0000000 --- a/SOURCES/CVE-2021-33503.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 6d2dcef3427b96c36ddfebf217f774a2c5ecad38 Mon Sep 17 00:00:00 2001 -From: Lumir Balhar -Date: Wed, 30 Jun 2021 09:27:07 +0200 -Subject: [PATCH] CVE-2021-33503 - ---- - src/pip/_vendor/urllib3/util/url.py | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - -diff --git a/src/pip/_vendor/urllib3/util/url.py b/src/pip/_vendor/urllib3/util/url.py -index 5fe37a7..addaeb7 100644 ---- a/src/pip/_vendor/urllib3/util/url.py -+++ b/src/pip/_vendor/urllib3/util/url.py -@@ -63,12 +63,12 @@ IPV6_ADDRZ_RE = re.compile("^" + IPV6_ADDRZ_PAT + "$") - BRACELESS_IPV6_ADDRZ_RE = re.compile("^" + IPV6_ADDRZ_PAT[2:-2] + "$") - ZONE_ID_RE = re.compile("(" + ZONE_ID_PAT + r")\]$") - --SUBAUTHORITY_PAT = (u"^(?:(.*)@)?(%s|%s|%s)(?::([0-9]{0,5}))?$") % ( -+_HOST_PORT_PAT = ("^(%s|%s|%s)(?::([0-9]{0,5}))?$") % ( - REG_NAME_PAT, - IPV4_PAT, - IPV6_ADDRZ_PAT, - ) --SUBAUTHORITY_RE = re.compile(SUBAUTHORITY_PAT, re.UNICODE | re.DOTALL) -+_HOST_PORT_RE = re.compile(_HOST_PORT_PAT, re.UNICODE | re.DOTALL) - - UNRESERVED_CHARS = set( - "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-~" -@@ -374,7 +374,9 @@ def parse_url(url): - scheme = scheme.lower() - - if authority: -- auth, host, port = SUBAUTHORITY_RE.match(authority).groups() -+ auth, _, host_port = authority.rpartition("@") -+ auth = auth or None -+ host, port = _HOST_PORT_RE.match(host_port).groups() - if auth and normalize_uri: - auth = _encode_invalid_chars(auth, USERINFO_CHARS) - if port == "": --- -2.31.1 - diff --git a/SOURCES/CVE-2021-3572.patch b/SOURCES/CVE-2021-3572.patch deleted file mode 100644 index 04739c1..0000000 --- a/SOURCES/CVE-2021-3572.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 4f0099156245ed2873d6945d5e58db741e15836d Mon Sep 17 00:00:00 2001 -From: Lumir Balhar -Date: Tue, 8 Jun 2021 09:51:47 +0200 -Subject: [PATCH] CVE-2021-3572 - ---- - src/pip/_internal/vcs/git.py | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/src/pip/_internal/vcs/git.py b/src/pip/_internal/vcs/git.py -index 92b8457..7b3cc4a 100644 ---- a/src/pip/_internal/vcs/git.py -+++ b/src/pip/_internal/vcs/git.py -@@ -120,9 +120,15 @@ class Git(VersionControl): - output = cls.run_command(['show-ref', rev], cwd=dest, - show_stdout=False, on_returncode='ignore') - refs = {} -- for line in output.strip().splitlines(): -+ # NOTE: We do not use splitlines here since that would split on other -+ # unicode separators, which can be maliciously used to install a -+ # different revision. -+ for line in output.strip().split("\n"): -+ line = line.rstrip("\r") -+ if not line: -+ continue - try: -- sha, ref = line.split() -+ sha, ref = line.split(" ", maxsplit=2) - except ValueError: - # Include the offending line to simplify troubleshooting if - # this error ever occurs. --- -2.31.1 - diff --git a/SOURCES/cve-2007-4559-tarfile.patch b/SOURCES/cve-2007-4559-tarfile.patch deleted file mode 100644 index 3008a79..0000000 --- a/SOURCES/cve-2007-4559-tarfile.patch +++ /dev/null @@ -1,78 +0,0 @@ -Minimal patch for pip - -diff -rU3 pip-orig/src/pip/_internal/utils/unpacking.py pip/src/pip/_internal/utils/unpacking.py ---- pip-orig/src/pip/_internal/utils/unpacking.py 2022-11-05 16:25:43.000000000 +0100 -+++ pip/src/pip/_internal/utils/unpacking.py 2023-08-08 13:17:47.705613554 +0200 -@@ -184,6 +184,13 @@ - raise InstallationError( - message.format(filename, path, location) - ) -+ -+ # Call the `data` filter for its side effect (raising exception) -+ try: -+ tarfile.data_filter(member.replace(name=fn), location) -+ except tarfile.LinkOutsideDestinationError: -+ pass -+ - if member.isdir(): - ensure_dir(path) - elif member.issym(): - - -Test from https://github.com/pypa/pip/pull/12214 - -diff -rU3 pip-orig/tests/unit/test_utils_unpacking.py pip/tests/unit/test_utils_unpacking.py ---- pip-orig/tests/unit/test_utils_unpacking.py 2022-11-05 16:25:43.000000000 +0100 -+++ pip/tests/unit/test_utils_unpacking.py 2023-08-08 13:17:35.151540108 +0200 -@@ -171,6 +171,23 @@ - test_tar = self.make_tar_file('test_tar.tar', files) - untar_file(test_tar, self.tempdir) - -+ def test_unpack_tar_filter(self) -> None: -+ """ -+ Test that the tarfile.data_filter is used to disallow dangerous -+ behaviour (PEP-721) -+ """ -+ test_tar = os.path.join(self.tempdir, "test_tar_filter.tar") -+ with tarfile.open(test_tar, "w") as mytar: -+ file_tarinfo = tarfile.TarInfo("bad-link") -+ file_tarinfo.type = tarfile.SYMTYPE -+ file_tarinfo.linkname = "../../../../pwn" -+ mytar.addfile(file_tarinfo, io.BytesIO(b"")) -+ with pytest.raises(InstallationError) as e: -+ untar_file(test_tar, self.tempdir) -+ -+ assert "is outside the destination" in str(e.value) -+ -+ - - @pytest.mark.parametrize('args, expected', [ - # Test the second containing the first. - - -Patch for vendored distlib from https://github.com/pypa/distlib/pull/201 - -diff --git a/distlib/util.py b/distlib/util.py -index e0622e4..4349d0b 100644 ---- a/src/pip/_vendor/distlib/util.py -+++ b/src/pip/_vendor/distlib/util.py -@@ -1249,6 +1249,19 @@ def check_path(path): - for tarinfo in archive.getmembers(): - if not isinstance(tarinfo.name, text_type): - tarinfo.name = tarinfo.name.decode('utf-8') -+ -+ # Limit extraction of dangerous items, if this Python -+ # allows it easily. If not, just trust the input. -+ # See: https://docs.python.org/3/library/tarfile.html#extraction-filters -+ def extraction_filter(member, path): -+ """Run tarfile.tar_fillter, but raise the expected ValueError""" -+ # This is only called if the current Python has tarfile filters -+ try: -+ return tarfile.tar_filter(member, path) -+ except tarfile.FilterError as exc: -+ raise ValueError(str(exc)) -+ archive.extraction_filter = extraction_filter -+ - archive.extractall(dest_dir) - - finally: diff --git a/SOURCES/fix-tmpdir-infinite-recursion.patch b/SOURCES/fix-tmpdir-infinite-recursion.patch deleted file mode 100644 index c27ebb2..0000000 --- a/SOURCES/fix-tmpdir-infinite-recursion.patch +++ /dev/null @@ -1,84 +0,0 @@ -diff -up pip-19.3.1/news/7872.bugfix.pip7873 pip-19.3.1/news/7872.bugfix ---- pip-19.3.1/news/7872.bugfix.pip7873 2022-05-24 08:34:03.285054864 -0600 -+++ pip-19.3.1/news/7872.bugfix 2022-05-24 08:34:03.285054864 -0600 -@@ -0,0 +1 @@ -+Prevent an infinite recursion with ``pip wheel`` when ``$TMPDIR`` is within the source directory. -diff -up pip-19.3.1/src/pip/_internal/download.py.pip7873 pip-19.3.1/src/pip/_internal/download.py ---- pip-19.3.1/src/pip/_internal/download.py.pip7873 2019-10-17 13:32:34.000000000 -0600 -+++ pip-19.3.1/src/pip/_internal/download.py 2022-05-24 08:35:17.013833331 -0600 -@@ -350,12 +350,24 @@ def _copy2_ignoring_special_files(src, d - - def _copy_source_tree(source, target): - # type: (str, str) -> None -+ target_abspath = os.path.abspath(target) -+ target_basename = os.path.basename(target_abspath) -+ target_dirname = os.path.dirname(target_abspath) -+ - def ignore(d, names): -- # Pulling in those directories can potentially be very slow, -- # exclude the following directories if they appear in the top -- # level dir (and only it). -- # See discussion at https://github.com/pypa/pip/pull/6770 -- return ['.tox', '.nox'] if d == source else [] -+ skipped = [] # type: List[str] -+ if d == source: -+ # Pulling in those directories can potentially be very slow, -+ # exclude the following directories if they appear in the top -+ # level dir (and only it). -+ # See discussion at https://github.com/pypa/pip/pull/6770 -+ skipped += ['.tox', '.nox'] -+ if os.path.abspath(d) == target_dirname: -+ # Prevent an infinite recursion if the target is in source. -+ # This can happen when TMPDIR is set to ${PWD}/... -+ # and we copy PWD to TMPDIR. -+ skipped += [target_basename] -+ return skipped - - kwargs = dict(ignore=ignore, symlinks=True) # type: CopytreeKwargs - -diff -up pip-19.3.1/src/pip/_internal/operations/prepare.py.pip7873 pip-19.3.1/src/pip/_internal/operations/prepare.py -diff -up pip-19.3.1/tests/data/src/extension/extension.c.pip7873 pip-19.3.1/tests/data/src/extension/extension.c -diff -up pip-19.3.1/tests/data/src/extension/setup.py.pip7873 pip-19.3.1/tests/data/src/extension/setup.py ---- pip-19.3.1/tests/data/src/extension/setup.py.pip7873 2022-05-24 08:34:03.285054864 -0600 -+++ pip-19.3.1/tests/data/src/extension/setup.py 2022-05-24 08:34:03.285054864 -0600 -@@ -0,0 +1,4 @@ -+from setuptools import Extension, setup -+ -+module = Extension('extension', sources=['extension.c']) -+setup(name='extension', version='0.0.1', ext_modules = [module]) -diff -up pip-19.3.1/tests/functional/test_wheel.py.pip7873 pip-19.3.1/tests/functional/test_wheel.py ---- pip-19.3.1/tests/functional/test_wheel.py.pip7873 2019-10-17 13:32:34.000000000 -0600 -+++ pip-19.3.1/tests/functional/test_wheel.py 2022-05-24 08:34:03.285054864 -0600 -@@ -1,6 +1,7 @@ - """'pip wheel' tests""" - import os - import re -+import sys - from os.path import exists - - import pytest -@@ -228,6 +229,24 @@ def test_pip_wheel_with_user_set_in_conf - assert "Successfully built withpyproject" in result.stdout, result.stdout - - -+@pytest.mark.skipif(sys.platform.startswith('win'), -+ reason='The empty extension module does not work on Win') -+def test_pip_wheel_ext_module_with_tmpdir_inside(script, data, common_wheels): -+ tmpdir = data.src / 'extension/tmp' -+ tmpdir.mkdir() -+ script.environ['TMPDIR'] = str(tmpdir) -+ -+ # To avoid a test dependency on a C compiler, we set the env vars to "noop" -+ # The .c source is empty anyway -+ script.environ['CC'] = script.environ['LDSHARED'] = str('true') -+ -+ result = script.pip( -+ 'wheel', data.src / 'extension', -+ '--no-index', '-f', common_wheels -+ ) -+ assert "Successfully built extension" in result.stdout, result.stdout -+ -+ - @pytest.mark.network - def test_pep517_wheels_are_not_confused_with_other_files(script, tmpdir, data): - """Check correct wheels are copied. (#6196) diff --git a/SPECS/python3x-pip.spec b/SPECS/python3x-pip.spec index 7b55275..f692ef7 100644 --- a/SPECS/python3x-pip.spec +++ b/SPECS/python3x-pip.spec @@ -16,7 +16,7 @@ Name: python3x-%{srcname} # When updating, update the bundled libraries versions bellow! # You can use vendor_meta.sh in the dist git repo Version: 19.3.1 -Release: 7%{?dist} +Release: 1%{?dist} Summary: A tool for installing and managing Python packages # We bundle a lot of libraries with pip, which itself is under MIT license. @@ -91,28 +91,6 @@ Patch4: dummy-certifi.patch # https://github.com/pypa/pip/pull/7359 Patch5: network-tests.patch -# Patch for CVE-2021-3572 - pip incorrectly handled unicode separators in git references -# Upstream PR: https://github.com/pypa/pip/pull/9827 -# Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1962856 -Patch6: CVE-2021-3572.patch - -# CVE-2021-33503 Catastrophic backtracking in URL authority parser -# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=1968074 -# Upstream fix: https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ec -Patch7: CVE-2021-33503.patch - -# Prevent infinite recursion with pip wheel with $TMPDIR in $PWD -# https://github.com/pypa/pip/pull/7873 -Patch8: fix-tmpdir-infinite-recursion.patch - -# CVE-2007-4559, PEP-721, PEP-706: Use tarfile.data_filter for extracting -# - Minimal downstream-only patch, to be replaced by upstream solution -# proposed in https://github.com/pypa/pip/pull/12214 -# - Test patch submitted upstream in the above pull request -# - Patch for vendored distlib, accepted upstream: -# https://github.com/pypa/distlib/pull/201 -Patch9: cve-2007-4559-tarfile.patch - # Downstream only patch # Users might have local installations of pip from using # `pip install --user --upgrade pip` on older/newer versions. @@ -207,8 +185,6 @@ BuildRequires: ca-certificates Requires: ca-certificates Requires: python%{python3_pkgversion}-setuptools -# Require alternatives version that implements the --keep-foreign flag -Requires(postun): alternatives >= 1.19.1-1 # python38 installs the alternatives master symlink to which we attach a slave Requires: python38 Requires(post): python38 @@ -266,10 +242,6 @@ popd %patch3 -p1 %patch4 -p1 %patch5 -p1 -%patch6 -p1 -%patch7 -p1 -%patch8 -p1 -%patch9 -p1 # this goes together with patch4 rm src/pip/_vendor/certifi/*.pem @@ -279,14 +251,6 @@ rm src/pip/_vendor/certifi/*.pem ln -s %{python_wheeldir} tests/data/common_wheels %endif -# Remove windows executable binaries -rm -v src/pip/_vendor/distlib/*.exe -sed -i '/\.exe/d' setup.py - -# Backports for Python 2 -rm src/pip/_vendor/distlib/_backport/shutil.py -rm src/pip/_vendor/distlib/_backport/tarfile.py - %build %py3_build_wheel @@ -402,9 +366,9 @@ if [ $1 -eq 0 ]; then grep -c "^/usr/bin/python3.8 - priority [0-9]*"` if [ $EXISTS -ne 0 ]; then - alternatives --keep-foreign --remove-slave python3 %{_bindir}/python3.8 \ + alternatives --remove-slave python3 %{_bindir}/python3.8 \ pip3 - alternatives --keep-foreign --remove-slave python3 %{_bindir}/python3.8 \ + alternatives --remove-slave python3 %{_bindir}/python3.8 \ pip-3 fi fi @@ -439,33 +403,9 @@ fi %{python_wheeldir}/%{python_wheelname} %changelog -* Tue Dec 12 2023 MSVSphere Packaging Team - 19.3.1-6 +* Tue Dec 12 2023 MSVSphere Packaging Team - 19.3.1 - Rebuilt for MSVSphere 8.8 -* Tue Aug 08 2023 Petr Viktorin - 19.3.1-6 -- Use tarfile.data_filter for extracting (CVE-2007-4559, PEP-721, PEP-706) -Resolves: RHBZ#2218267 - -* Tue May 24 2022 Orion Poplawski - 19.3.1-6 -- Backport patch to fix infinite recursion with pip wheel with $TMPDIR in $PWD -- Resolves: rhbz#2090006 - -* Thu Oct 14 2021 Charalampos Stratakis - 19.3.1-5 -- Remove bundled windows executables -- Resolves: rhbz#2006789 - -* Mon Aug 02 2021 Tomas Orsava - 19.3.1-4 -- Adjusted the postun scriptlets to enable upgrading to RHEL 9 -- Resolves: rhbz#1933055 - -* Wed Jun 30 2021 Lumír Balhar - 19.3.1-3 -- Fix for CVE-2021-33503 Catastrophic backtracking in URL authority parser -Resolves: rhbz#1968074 - -* Tue Jun 08 2021 Lumír Balhar - 19.3.1-2 -- Fix for CVE-2021-3572 - pip incorrectly handled unicode separators in git references -Resolves: rhbz#1962856 - * Thu Apr 23 2020 Lumír Balhar - 19.3.1 - Rebase to 19.3.1 to enable support for manylinux2014 Resolves: rhbz#1827623