From 42683a1e914ce0e6f7f37a7eb1a684a2506a6965 Mon Sep 17 00:00:00 2001 From: liweigang Date: Sun, 7 Apr 2024 11:10:06 +0800 Subject: [PATCH] Fix CVE-2024-21506 Signed-off-by: liweigang (cherry picked from commit 436bc9cc04089a0ec53924ce5e50754e8ed39d6c) --- backport-CVE-2024-21506.patch | 47 +++++++++++++++++++++++++++++++++++ python-pymongo.spec | 11 +++++--- 2 files changed, 54 insertions(+), 4 deletions(-) create mode 100644 backport-CVE-2024-21506.patch diff --git a/backport-CVE-2024-21506.patch b/backport-CVE-2024-21506.patch new file mode 100644 index 0000000..6159b63 --- /dev/null +++ b/backport-CVE-2024-21506.patch @@ -0,0 +1,47 @@ +From 56b6b6dbc267d365d97c037082369dabf37405d2 Mon Sep 17 00:00:00 2001 +From: Shane Harvey +Date: Wed, 27 Mar 2024 16:51:23 -0700 +Subject: [PATCH] PYTHON-4305 Fix bson size check (#1564) + +(cherry picked from commit 372b5d68d5a57ccc43b33407cd23f0bc79d99283) +--- + bson/_cbsonmodule.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/bson/_cbsonmodule.c b/bson/_cbsonmodule.c +index 4e1881a275..da86cd8133 100644 +--- a/bson/_cbsonmodule.c ++++ b/bson/_cbsonmodule.c +@@ -2405,6 +2405,7 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer, + uint32_t c_w_s_size; + uint32_t code_size; + uint32_t scope_size; ++ uint32_t len; + PyObject* code; + PyObject* scope; + PyObject* code_type; +@@ -2424,7 +2425,8 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer, + memcpy(&code_size, buffer + *position, 4); + code_size = BSON_UINT32_FROM_LE(code_size); + /* code_w_scope length + code length + code + scope length */ +- if (!code_size || max < code_size || max < 4 + 4 + code_size + 4) { ++ len = 4 + 4 + code_size + 4; ++ if (!code_size || max < code_size || max < len || len < code_size) { + goto invalid; + } + *position += 4; +@@ -2442,12 +2444,9 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer, + + memcpy(&scope_size, buffer + *position, 4); + scope_size = BSON_UINT32_FROM_LE(scope_size); +- if (scope_size < BSON_MIN_SIZE) { +- Py_DECREF(code); +- goto invalid; +- } + /* code length + code + scope length + scope */ +- if ((4 + code_size + 4 + scope_size) != c_w_s_size) { ++ len = 4 + 4 + code_size + scope_size; ++ if (scope_size < BSON_MIN_SIZE || len != c_w_s_size || len < scope_size) { + Py_DECREF(code); + goto invalid; + } diff --git a/python-pymongo.spec b/python-pymongo.spec index 13acbf1..b92706c 100644 --- a/python-pymongo.spec +++ b/python-pymongo.spec @@ -1,11 +1,12 @@ Name: python-pymongo Version: 4.3.3 -Release: 1 +Release: 2 License: Apache License 2.0 Summary: PyMongo - the Python driver for MongoDB URL: https://github.com/mongodb/mongo-python-driver Source0: %{pypi_source pymongo} -# Patch01: 0001-Use-ssl.match_hostname-from-the-Python-stdlib.patch +# patch source: https://github.com/mongodb/mongo-python-driver/commit/56b6b6dbc267d365d97c037082369dabf37405d2 +Patch01: backport-CVE-2024-21506.patch BuildRequires: python3-devel python3-setuptools BuildRequires: python3-sphinx gcc python3-pip python3-dns @@ -51,7 +52,6 @@ The PyMongo distribution contains tools for interacting with MongoDB database fr %prep %autosetup -n pymongo-%{version} -p1 -# rm pymongo/ssl_match_hostname.py %build %py3_build @@ -61,7 +61,7 @@ The PyMongo distribution contains tools for interacting with MongoDB database fr chmod 755 %{buildroot}%{python3_sitearch}/bson/*.so chmod 755 %{buildroot}%{python3_sitearch}/pymongo/*.so - + %check python3 setup.py test @@ -83,6 +83,9 @@ python3 setup.py test %{_docdir}/python3-pymongo %changelog +* Sun Apr 07 2024 liweigang - 4.3.3-2 +- Fix CVE-2024-21506 + * Thu May 18 2023 chenchen - 4.3.3-1 - upgrade to 4.3.3 -- Gitee