diff --git a/backport-CVE-2024-21506.patch b/backport-CVE-2024-21506.patch deleted file mode 100644 index 6159b636582373682dbd5bc6534089fa271b6d45..0000000000000000000000000000000000000000 --- a/backport-CVE-2024-21506.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 56b6b6dbc267d365d97c037082369dabf37405d2 Mon Sep 17 00:00:00 2001 -From: Shane Harvey -Date: Wed, 27 Mar 2024 16:51:23 -0700 -Subject: [PATCH] PYTHON-4305 Fix bson size check (#1564) - -(cherry picked from commit 372b5d68d5a57ccc43b33407cd23f0bc79d99283) ---- - bson/_cbsonmodule.c | 11 +++++------ - 1 file changed, 5 insertions(+), 6 deletions(-) - -diff --git a/bson/_cbsonmodule.c b/bson/_cbsonmodule.c -index 4e1881a275..da86cd8133 100644 ---- a/bson/_cbsonmodule.c -+++ b/bson/_cbsonmodule.c -@@ -2405,6 +2405,7 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer, - uint32_t c_w_s_size; - uint32_t code_size; - uint32_t scope_size; -+ uint32_t len; - PyObject* code; - PyObject* scope; - PyObject* code_type; -@@ -2424,7 +2425,8 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer, - memcpy(&code_size, buffer + *position, 4); - code_size = BSON_UINT32_FROM_LE(code_size); - /* code_w_scope length + code length + code + scope length */ -- if (!code_size || max < code_size || max < 4 + 4 + code_size + 4) { -+ len = 4 + 4 + code_size + 4; -+ if (!code_size || max < code_size || max < len || len < code_size) { - goto invalid; - } - *position += 4; -@@ -2442,12 +2444,9 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer, - - memcpy(&scope_size, buffer + *position, 4); - scope_size = BSON_UINT32_FROM_LE(scope_size); -- if (scope_size < BSON_MIN_SIZE) { -- Py_DECREF(code); -- goto invalid; -- } - /* code length + code + scope length + scope */ -- if ((4 + code_size + 4 + scope_size) != c_w_s_size) { -+ len = 4 + 4 + code_size + scope_size; -+ if (scope_size < BSON_MIN_SIZE || len != c_w_s_size || len < scope_size) { - Py_DECREF(code); - goto invalid; - } diff --git a/pymongo-4.3.3.tar.gz b/pymongo-4.3.3.tar.gz deleted file mode 100644 index 0a15e30014bd44e28a3a71faf0d850c44a2129a1..0000000000000000000000000000000000000000 Binary files a/pymongo-4.3.3.tar.gz and /dev/null differ diff --git a/pymongo-4.6.3.tar.gz b/pymongo-4.6.3.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..82d3bf85d16e7e73215fccfd351086ee7ee7b47d Binary files /dev/null and b/pymongo-4.6.3.tar.gz differ diff --git a/python-pymongo.spec b/python-pymongo.spec index b92706c0b20ca18cdc42dee4d956b611150d2a3d..376353b61b614748631ca0682e84f253ed63dd32 100644 --- a/python-pymongo.spec +++ b/python-pymongo.spec @@ -1,12 +1,10 @@ Name: python-pymongo -Version: 4.3.3 -Release: 2 +Version: 4.6.3 +Release: 1 License: Apache License 2.0 Summary: PyMongo - the Python driver for MongoDB URL: https://github.com/mongodb/mongo-python-driver Source0: %{pypi_source pymongo} -# patch source: https://github.com/mongodb/mongo-python-driver/commit/56b6b6dbc267d365d97c037082369dabf37405d2 -Patch01: backport-CVE-2024-21506.patch BuildRequires: python3-devel python3-setuptools BuildRequires: python3-sphinx gcc python3-pip python3-dns @@ -63,7 +61,7 @@ chmod 755 %{buildroot}%{python3_sitearch}/bson/*.so chmod 755 %{buildroot}%{python3_sitearch}/pymongo/*.so %check -python3 setup.py test +python3 -m unittest discover -v %files -n python3-bson %license LICENSE @@ -83,6 +81,10 @@ python3 setup.py test %{_docdir}/python3-pymongo %changelog +* Wed Jun 05 2024 yaoxin - 4.6.3-1 +- Update to 4.6.3 +- Fixed a potential memory access violation when decoding invalid bson. + * Sun Apr 07 2024 liweigang - 4.3.3-2 - Fix CVE-2024-21506