From fd966da23f2c3ab0e7521bd645900ae12c5720b7 Mon Sep 17 00:00:00 2001 From: wk333 <13474090681@163.com> Date: Wed, 3 Apr 2024 07:02:33 +0800 Subject: [PATCH] Fix CVE-2024-21506 --- backport-CVE-2024-21506.patch | 47 +++++++++++++++++++++++++++++++++++ python-pymongo.spec | 11 +++++--- 2 files changed, 55 insertions(+), 3 deletions(-) create mode 100644 backport-CVE-2024-21506.patch diff --git a/backport-CVE-2024-21506.patch b/backport-CVE-2024-21506.patch new file mode 100644 index 0000000..6159b63 --- /dev/null +++ b/backport-CVE-2024-21506.patch @@ -0,0 +1,47 @@ +From 56b6b6dbc267d365d97c037082369dabf37405d2 Mon Sep 17 00:00:00 2001 +From: Shane Harvey +Date: Wed, 27 Mar 2024 16:51:23 -0700 +Subject: [PATCH] PYTHON-4305 Fix bson size check (#1564) + +(cherry picked from commit 372b5d68d5a57ccc43b33407cd23f0bc79d99283) +--- + bson/_cbsonmodule.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/bson/_cbsonmodule.c b/bson/_cbsonmodule.c +index 4e1881a275..da86cd8133 100644 +--- a/bson/_cbsonmodule.c ++++ b/bson/_cbsonmodule.c +@@ -2405,6 +2405,7 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer, + uint32_t c_w_s_size; + uint32_t code_size; + uint32_t scope_size; ++ uint32_t len; + PyObject* code; + PyObject* scope; + PyObject* code_type; +@@ -2424,7 +2425,8 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer, + memcpy(&code_size, buffer + *position, 4); + code_size = BSON_UINT32_FROM_LE(code_size); + /* code_w_scope length + code length + code + scope length */ +- if (!code_size || max < code_size || max < 4 + 4 + code_size + 4) { ++ len = 4 + 4 + code_size + 4; ++ if (!code_size || max < code_size || max < len || len < code_size) { + goto invalid; + } + *position += 4; +@@ -2442,12 +2444,9 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer, + + memcpy(&scope_size, buffer + *position, 4); + scope_size = BSON_UINT32_FROM_LE(scope_size); +- if (scope_size < BSON_MIN_SIZE) { +- Py_DECREF(code); +- goto invalid; +- } + /* code length + code + scope length + scope */ +- if ((4 + code_size + 4 + scope_size) != c_w_s_size) { ++ len = 4 + 4 + code_size + scope_size; ++ if (scope_size < BSON_MIN_SIZE || len != c_w_s_size || len < scope_size) { + Py_DECREF(code); + goto invalid; + } diff --git a/python-pymongo.spec b/python-pymongo.spec index b6ec111..c977f9d 100644 --- a/python-pymongo.spec +++ b/python-pymongo.spec @@ -1,6 +1,6 @@ Name: python-pymongo Version: 3.9.0 -Release: 5 +Release: 6 License: Apache License 2.0 Summary: PyMongo - the Python driver for MongoDB URL: https://github.com/mongodb/mongo-python-driver @@ -11,13 +11,15 @@ BuildRequires: python2-devel python3-devel BuildRequires: python2-setuptools python3-setuptools BuildRequires: python3-sphinx -Patch0002: 0001-PYTHON-1918-Stop-using-BSON.encode-and-BSON.decode-f.patch - %global _description \ The PyMongo distribution contains tools for interacting with \ MongoDB database from Python.\ PyMongo supports MongoDB 2.6, 3.0, 3.2, 3.4, 3.6, 4.0 and 4.2. +Patch0002: 0001-PYTHON-1918-Stop-using-BSON.encode-and-BSON.decode-f.patch +# patch source: https://github.com/mongodb/mongo-python-driver/commit/56b6b6dbc267d365d97c037082369dabf37405d2 +Patch0003: backport-CVE-2024-21506.patch + %description %{_description} %package -n python2-bson @@ -158,6 +160,9 @@ popd %{_pkgdocdir} %changelog +* Sun Apr 07 2024 liweigang - 3.9.0-6 +- Fix CVE-2024-21506 + * Thu Dec 21 2023 liubo - 3.9.0-5 - PYTHON-1918 Stop using BSON.encode and BSON.decode functions -- Gitee