From 969ceb86efa479eb75301f545827714c510295e6 Mon Sep 17 00:00:00 2001 From: lizhipeng Date: Mon, 13 Oct 2025 16:58:10 +0800 Subject: [PATCH 1/2] fix CVE-2025-61911 Signed-off-by: lizhipeng --- backport-CVE-2025-61911.patch | 38 +++++++++++++++++++++++++++++++++++ python-ldap.spec | 9 ++++++++- 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2025-61911.patch diff --git a/backport-CVE-2025-61911.patch b/backport-CVE-2025-61911.patch new file mode 100644 index 0000000..9c4e8a0 --- /dev/null +++ b/backport-CVE-2025-61911.patch @@ -0,0 +1,38 @@ +From 3957526fb1852e84b90f423d9fef34c7af25b85a Mon Sep 17 00:00:00 2001 +From: lukas-eu <62448426+lukas-eu@users.noreply.github.com> +Date: Fri, 10 Oct 2025 19:47:46 +0200 +Subject: [PATCH] Merge commit from fork + +--- + Lib/ldap/filter.py | 2 ++ + Tests/t_ldap_filter.py | 4 ++++ + 2 files changed, 6 insertions(+) + +diff --git a/Lib/ldap/filter.py b/Lib/ldap/filter.py +index 782737aa..5bd41b21 100644 +--- a/Lib/ldap/filter.py ++++ b/Lib/ldap/filter.py +@@ -24,6 +24,8 @@ def escape_filter_chars(assertion_value,escape_mode=0): + If 1 all NON-ASCII chars are escaped. + If 2 all chars are escaped. + """ ++ if not isinstance(assertion_value, str): ++ raise TypeError("assertion_value must be of type str.") + if escape_mode: + r = [] + if escape_mode==1: +diff --git a/Tests/t_ldap_filter.py b/Tests/t_ldap_filter.py +index 313b3733..54312050 100644 +--- a/Tests/t_ldap_filter.py ++++ b/Tests/t_ldap_filter.py +@@ -49,6 +49,10 @@ def test_escape_filter_chars_mode1(self): + ), + r'\c3\a4\c3\b6\c3\bc\c3\84\c3\96\c3\9c\c3\9f' + ) ++ with self.assertRaises(TypeError): ++ escape_filter_chars(["abc@*()/xyz"], escape_mode=1) ++ with self.assertRaises(TypeError): ++ escape_filter_chars({"abc@*()/xyz": 1}, escape_mode=1) + + def test_escape_filter_chars_mode2(self): + """ diff --git a/python-ldap.spec b/python-ldap.spec index 59b039e..fb57a46 100644 --- a/python-ldap.spec +++ b/python-ldap.spec @@ -1,10 +1,11 @@ Name: python-ldap Version: 3.4.4 -Release: 1 +Release: 2 Summary: An object-oriented API to access LDAP directory servers License: Python-2.0 URL: http://python-ldap.org/ Source0: https://files.pythonhosted.org/packages/source/p/%{name}/%{name}-%{version}.tar.gz +Patch0001: backport-CVE-2025-61911.patch BuildRequires: gcc openldap-devel BuildRequires: python3-devel python3-setuptools @@ -55,6 +56,12 @@ sed -i 's,-Werror,-Wignore,g' tox.ini %doc CHANGES README TODO Demo %changelog +* Mon Oct 13 2025 lizhipeng - 3.4.4-2 +- Type: bugfix +- ID: NA +- SUG: NA +- DESC: fix CVE-2025-61911 + * Thu Feb 1 2024 liubo - 3.4.4-1 - Type: requirement - ID: NA -- Gitee From 264ad5ac1eb5e2ab78b50e23fee2580a45b0b1ff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=99=A4=E4=BA=86=E4=B8=8A=E7=8F=AD=E5=AF=B9=E5=95=A5?= =?UTF-8?q?=E9=83=BD=E6=84=9F=E5=85=B4=E8=B6=A3?= <2659187352@qq.com> Date: Wed, 22 Oct 2025 16:40:15 +0800 Subject: [PATCH 2/2] fix CVE-2025-61912 --- backport-CVE-2025-61912.patch | 38 +++++++++++++++++++++++++++++++++++ python-ldap.spec | 9 ++++++++- 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2025-61912.patch diff --git a/backport-CVE-2025-61912.patch b/backport-CVE-2025-61912.patch new file mode 100644 index 0000000..8dbebc1 --- /dev/null +++ b/backport-CVE-2025-61912.patch @@ -0,0 +1,38 @@ +From 6ea80326a34ee6093219628d7690bced50c49a3f Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Fri, 10 Oct 2025 10:46:45 -0700 +Subject: [PATCH] Merge commit from fork + +Update tests to expect \00 and verify RFC-compliant escaping +--- + Lib/ldap/dn.py | 3 ++- + Tests/t_ldap_dn.py | 2 +- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/Lib/ldap/dn.py b/Lib/ldap/dn.py +index dd7278b6..64d7d0e9 100644 +--- a/Lib/ldap/dn.py ++++ b/Lib/ldap/dn.py +@@ -26,7 +26,8 @@ def escape_dn_chars(s): + s = s.replace('>' ,'\\>') + s = s.replace(';' ,'\\;') + s = s.replace('=' ,'\\=') +- s = s.replace('\000' ,'\\\000') ++ # RFC 4514 requires NULL (U+0000) to be escaped as hex pair "\00" ++ s = s.replace('\x00' ,'\\00') + if s[-1]==' ': + s = ''.join((s[:-1],'\\ ')) + if s[0]=='#' or s[0]==' ': +diff --git a/Tests/t_ldap_dn.py b/Tests/t_ldap_dn.py +index 86d3640..7c04777 100644 +--- a/Tests/t_ldap_dn.py ++++ b/Tests/t_ldap_dn.py +@@ -49,7 +49,7 @@ class TestDN(unittest.TestCase): + self.assertEqual(ldap.dn.escape_dn_chars(' '), '\\ ') + self.assertEqual(ldap.dn.escape_dn_chars(' '), '\\ \\ ') + self.assertEqual(ldap.dn.escape_dn_chars('foobar '), 'foobar\\ ') +- self.assertEqual(ldap.dn.escape_dn_chars('f+o>o,bo\\,b\\o,bo\,b\ - 3.4.4-3 +- Type:CVE +- Id:CVE-2025-61912 +- SUG:NA +- DESC:fix CVE-2025-61912 + * Mon Oct 13 2025 lizhipeng - 3.4.4-2 - Type: bugfix - ID: NA -- Gitee