diff --git a/backport-CVE-2023-32681.patch b/backport-CVE-2023-32681.patch new file mode 100644 index 0000000000000000000000000000000000000000..96800d6430cbadfa672b4eb9493dc6435bd3a4a0 --- /dev/null +++ b/backport-CVE-2023-32681.patch @@ -0,0 +1,59 @@ +From 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 Mon Sep 17 00:00:00 2001 +From: Nate Prewitt +Date: Mon, 22 May 2023 08:08:57 -0700 +Subject: [PATCH] Merge pull request from GHSA-j8r2-6x86-q33q + +Reference:https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 +Conflict:NA + +--- + requests/sessions.py | 4 +++- + tests/test_requests.py | 20 ++++++++++++++++++++ + 2 files changed, 23 insertions(+), 1 deletion(-) + +diff --git a/requests/sessions.py b/requests/sessions.py +index 6cb3b4dae3..dbcf2a7b0e 100644 +--- a/requests/sessions.py ++++ b/requests/sessions.py +@@ -324,7 +324,9 @@ def rebuild_proxies(self, prepared_request, proxies): + except KeyError: + username, password = None, None + +- if username and password: ++ # urllib3 handles proxy authorization for us in the standard adapter. ++ # Avoid appending this to TLS tunneled requests where it may be leaked. ++ if not scheme.startswith('https') and username and password: + headers["Proxy-Authorization"] = _basic_auth_str(username, password) + + return new_proxies +diff --git a/tests/test_requests.py b/tests/test_requests.py +index b1c8dd4534..b420c44d73 100644 +--- a/tests/test_requests.py ++++ b/tests/test_requests.py +@@ -647,6 +647,26 @@ def test_proxy_authorization_preserved_on_request(self, httpbin): + + assert sent_headers.get("Proxy-Authorization") == proxy_auth_value + ++ ++ @pytest.mark.parametrize( ++ "url,has_proxy_auth", ++ ( ++ ('http://example.com', True), ++ ('https://example.com', False), ++ ), ++ ) ++ def test_proxy_authorization_not_appended_to_https_request(self, url, has_proxy_auth): ++ session = requests.Session() ++ proxies = { ++ 'http': 'http://test:pass@localhost:8080', ++ 'https': 'http://test:pass@localhost:8090', ++ } ++ req = requests.Request('GET', url) ++ prep = req.prepare() ++ session.rebuild_proxies(prep, proxies) ++ ++ assert ('Proxy-Authorization' in prep.headers) is has_proxy_auth ++ + def test_basicauth_with_netrc(self, httpbin): + auth = ("user", "pass") + wrong_auth = ("wronguser", "wrongpass") diff --git a/python-requests.spec b/python-requests.spec index 2cdfb687e6543354a63fc87de9a8e2104f15fc0b..b7943bbc23b88688b515bb9072cc7696eed65630 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -2,7 +2,7 @@ Name: python-requests Version: 2.28.1 -Release: 2 +Release: 3 Summary: Python HTTP Library License: ASL 2.0 URL: http://python-requests.org/ @@ -11,6 +11,7 @@ Source0: https://github.com/requests/requests/archive/v%{version}/request Patch6001: backport-requests-2.28.1-system-certs.patch Patch6002: backport-requests-2.28.1-tests_nonet.patch Patch6003: Allow-charset-normalizer-version-between-2-and-4.patch +Patch6004: backport-CVE-2023-32681.patch BuildArch: noarch @@ -95,6 +96,9 @@ PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} -m pytest -v %doc HISTORY.md README.md %changelog +* Wed May 31 2023 zhangpan - 2.28.1-3 +- fix CVE-2023-32681 + * Wed Jan 11 2023 yaoxin - 2.28.1-2 - Fix the publicsuffix2 build error caused by the python-charset-normalizer update.