From 91b3d2a91b06b1cb774d6d8d7e11fa99db6d4409 Mon Sep 17 00:00:00 2001 From: liweigang Date: Sun, 7 Apr 2024 11:21:37 +0800 Subject: [PATCH] Fix CVE-2024-21506 Signed-off-by: liweigang (cherry picked from commit 037f4e7b710c8d955c717860bcb37325feca90c8) --- backport-CVE-2024-21506.patch | 47 +++++++++++++++++++++++++++++++++++ python-pymongo.spec | 7 +++++- 2 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2024-21506.patch diff --git a/backport-CVE-2024-21506.patch b/backport-CVE-2024-21506.patch new file mode 100644 index 0000000..6159b63 --- /dev/null +++ b/backport-CVE-2024-21506.patch @@ -0,0 +1,47 @@ +From 56b6b6dbc267d365d97c037082369dabf37405d2 Mon Sep 17 00:00:00 2001 +From: Shane Harvey +Date: Wed, 27 Mar 2024 16:51:23 -0700 +Subject: [PATCH] PYTHON-4305 Fix bson size check (#1564) + +(cherry picked from commit 372b5d68d5a57ccc43b33407cd23f0bc79d99283) +--- + bson/_cbsonmodule.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/bson/_cbsonmodule.c b/bson/_cbsonmodule.c +index 4e1881a275..da86cd8133 100644 +--- a/bson/_cbsonmodule.c ++++ b/bson/_cbsonmodule.c +@@ -2405,6 +2405,7 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer, + uint32_t c_w_s_size; + uint32_t code_size; + uint32_t scope_size; ++ uint32_t len; + PyObject* code; + PyObject* scope; + PyObject* code_type; +@@ -2424,7 +2425,8 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer, + memcpy(&code_size, buffer + *position, 4); + code_size = BSON_UINT32_FROM_LE(code_size); + /* code_w_scope length + code length + code + scope length */ +- if (!code_size || max < code_size || max < 4 + 4 + code_size + 4) { ++ len = 4 + 4 + code_size + 4; ++ if (!code_size || max < code_size || max < len || len < code_size) { + goto invalid; + } + *position += 4; +@@ -2442,12 +2444,9 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer, + + memcpy(&scope_size, buffer + *position, 4); + scope_size = BSON_UINT32_FROM_LE(scope_size); +- if (scope_size < BSON_MIN_SIZE) { +- Py_DECREF(code); +- goto invalid; +- } + /* code length + code + scope length + scope */ +- if ((4 + code_size + 4 + scope_size) != c_w_s_size) { ++ len = 4 + 4 + code_size + scope_size; ++ if (scope_size < BSON_MIN_SIZE || len != c_w_s_size || len < scope_size) { + Py_DECREF(code); + goto invalid; + } diff --git a/python-pymongo.spec b/python-pymongo.spec index c2c7991..1dec153 100644 --- a/python-pymongo.spec +++ b/python-pymongo.spec @@ -1,12 +1,14 @@ Name: python-pymongo Version: 3.11.3 -Release: 2 +Release: 3 License: Apache License 2.0 Summary: PyMongo - the Python driver for MongoDB URL: https://github.com/mongodb/mongo-python-driver Source0: https://files.pythonhosted.org/packages/72/82/e7196f2f69318dd206db26db68fcfa0ff821d88fbca6d0f0c7b678ba0353/pymongo-3.11.3.tar.gz Patch01: 0001-Use-ssl.match_hostname-from-the-Python-stdlib.patch Patch02: 0001-PYTHON-2631-Add-missing-error-message-to-InvalidBSON.patch +# patch source: https://github.com/mongodb/mongo-python-driver/commit/56b6b6dbc267d365d97c037082369dabf37405d2 +Patch03: backport-CVE-2024-21506.patch BuildRequires: python3-devel python3-setuptools BuildRequires: python3-sphinx gcc @@ -86,6 +88,9 @@ python3 setup.py test %{_pkgdocdir} %changelog +* Sun Apr 07 2024 liweigang - 3.11.3-3 +- Fix CVE-2024-21506 + * Wed Nov 8 2023 liubo - 3.11.3-2 - Add missing error message to InvalidBSON error -- Gitee