From e84102cd2bf8d7dc4e595cbd299767f564c69b12 Mon Sep 17 00:00:00 2001 From: anolis-bot Date: Thu, 13 Jan 2022 19:50:07 +0800 Subject: [PATCH] import python-pip-9.0.3-20.el8.src.rpm --- CVE-2018-18074.patch | 0 CVE-2018-20060.patch | 0 CVE-2019-11236.patch | 0 CVE-2019-11324.patch | 0 CVE-2021-3572.patch | 53 ++++++++++++++++++ ...given-prefix-from-wheel-RECORD-files.patch | 0 dummy-certifi.patch | 0 ...ng-when-running-with-root-privileges.patch | 0 pip-9.0.3.tar.gz | Bin ...ctory-traversal-security-issue-tests.patch | 0 pip-directory-traversal-security-issue.patch | 0 pip-nowarn-upgrade.patch | 0 python-pip.spec | 14 ++++- ...existing-dist-only-if-path-conflicts.patch | 0 14 files changed, 66 insertions(+), 1 deletion(-) mode change 100644 => 100755 CVE-2018-18074.patch mode change 100644 => 100755 CVE-2018-20060.patch mode change 100644 => 100755 CVE-2019-11236.patch mode change 100644 => 100755 CVE-2019-11324.patch create mode 100755 CVE-2021-3572.patch mode change 100644 => 100755 allow-stripping-given-prefix-from-wheel-RECORD-files.patch mode change 100644 => 100755 dummy-certifi.patch mode change 100644 => 100755 emit-a-warning-when-running-with-root-privileges.patch mode change 100644 => 100755 pip-9.0.3.tar.gz mode change 100644 => 100755 pip-directory-traversal-security-issue-tests.patch mode change 100644 => 100755 pip-directory-traversal-security-issue.patch mode change 100644 => 100755 pip-nowarn-upgrade.patch mode change 100644 => 100755 python-pip.spec mode change 100644 => 100755 remove-existing-dist-only-if-path-conflicts.patch diff --git a/CVE-2018-18074.patch b/CVE-2018-18074.patch old mode 100644 new mode 100755 diff --git a/CVE-2018-20060.patch b/CVE-2018-20060.patch old mode 100644 new mode 100755 diff --git a/CVE-2019-11236.patch b/CVE-2019-11236.patch old mode 100644 new mode 100755 diff --git a/CVE-2019-11324.patch b/CVE-2019-11324.patch old mode 100644 new mode 100755 diff --git a/CVE-2021-3572.patch b/CVE-2021-3572.patch new file mode 100755 index 0000000..b1d0a62 --- /dev/null +++ b/CVE-2021-3572.patch @@ -0,0 +1,53 @@ +Backport of https://github.com/pypa/pip/pull/9827 with parts of +https://github.com/pypa/pip/pull/4690 to make it work with pip v9.0.1 +diff --git a/pip/vcs/git.py b/pip/vcs/git.py +index 2187dd8..d1502f8 100644 +--- a/pip/vcs/git.py ++++ b/pip/vcs/git.py +@@ -81,7 +81,7 @@ class Git(VersionControl): + and branches may need origin/ as a prefix. + Returns the SHA1 of the branch or tag if found. + """ +- revisions = self.get_short_refs(dest) ++ revisions = self.get_short_refs(dest, rev) + + origin_rev = 'origin/%s' % rev + if origin_rev in revisions: +@@ -171,12 +171,20 @@ class Git(VersionControl): + ['rev-parse', 'HEAD'], show_stdout=False, cwd=location) + return current_rev.strip() + +- def get_full_refs(self, location): ++ def get_full_refs(self, location, pattern=''): + """Yields tuples of (commit, ref) for branches and tags""" +- output = self.run_command(['show-ref'], ++ output = self.run_command(['show-ref', pattern], + show_stdout=False, cwd=location) +- for line in output.strip().splitlines(): +- commit, ref = line.split(' ', 1) ++ for line in output.split("\n"): ++ line = line.rstrip("\r") ++ if not line: ++ continue ++ try: ++ commit, ref = line.split(' ', 1) ++ except ValueError: ++ # Include the offending line to simplify troubleshooting if ++ # this error ever occurs. ++ raise ValueError(f'unexpected show-ref line: {line!r}') + yield commit.strip(), ref.strip() + + def is_ref_remote(self, ref): +@@ -200,10 +208,10 @@ class Git(VersionControl): + def get_refs(self, location): + return self.get_short_refs(location) + +- def get_short_refs(self, location): ++ def get_short_refs(self, location, pattern=''): + """Return map of named refs (branches or tags) to commit hashes.""" + rv = {} +- for commit, ref in self.get_full_refs(location): ++ for commit, ref in self.get_full_refs(location, pattern): + ref_name = None + if self.is_ref_remote(ref): + ref_name = ref[len('refs/remotes/'):] diff --git a/allow-stripping-given-prefix-from-wheel-RECORD-files.patch b/allow-stripping-given-prefix-from-wheel-RECORD-files.patch old mode 100644 new mode 100755 diff --git a/dummy-certifi.patch b/dummy-certifi.patch old mode 100644 new mode 100755 diff --git a/emit-a-warning-when-running-with-root-privileges.patch b/emit-a-warning-when-running-with-root-privileges.patch old mode 100644 new mode 100755 diff --git a/pip-9.0.3.tar.gz b/pip-9.0.3.tar.gz old mode 100644 new mode 100755 diff --git a/pip-directory-traversal-security-issue-tests.patch b/pip-directory-traversal-security-issue-tests.patch old mode 100644 new mode 100755 diff --git a/pip-directory-traversal-security-issue.patch b/pip-directory-traversal-security-issue.patch old mode 100644 new mode 100755 diff --git a/pip-nowarn-upgrade.patch b/pip-nowarn-upgrade.patch old mode 100644 new mode 100755 diff --git a/python-pip.spec b/python-pip.spec old mode 100644 new mode 100755 index 11f0af1..36f242f --- a/python-pip.spec +++ b/python-pip.spec @@ -14,7 +14,7 @@ Name: python-%{srcname} # When updating, update the bundled libraries versions bellow! Version: 9.0.3 -Release: 19%{?dist} +Release: 20%{?dist} Summary: A tool for installing and managing Python packages Group: Development/Libraries @@ -116,6 +116,13 @@ Patch8: CVE-2018-18074.patch Patch9: pip-directory-traversal-security-issue.patch Patch10: pip-directory-traversal-security-issue-tests.patch +# Patch for CVE-2021-3572 - pip incorrectly handled unicode separators in git references +# The patch is adjusted for older pip where it's necessary to also switch +# the way pip gets revisions from git +# Upstream PR: https://github.com/pypa/pip/pull/9827 +# Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1962856 +Patch11: CVE-2021-3572.patch + %global _description \ pip is a package management system used to install and manage software packages \ written in Python. Many packages can be found in the Python Package Index \ @@ -257,6 +264,7 @@ popd %if %{with tests} %patch10 -p1 %endif +%patch11 -p1 # this goes together with patch4 rm pip/_vendor/certifi/*.pem @@ -364,6 +372,10 @@ py.test-%{python3_version} -m 'not network' %endif %changelog +* Mon Jun 07 2021 Lumír Balhar - 9.0.3-20 +- Fix for CVE-2021-3572 - pip incorrectly handled unicode separators in git references +Resolves: rhbz#1962856 + * Fri Jan 08 2021 Lumír Balhar - 9.0.3-19 - Fix bash completion files and simplify spec Resolves: rhbz#1904478 diff --git a/remove-existing-dist-only-if-path-conflicts.patch b/remove-existing-dist-only-if-path-conflicts.patch old mode 100644 new mode 100755 -- Gitee