From 6bfedc1d32ecc6ff9917a9887eab0cd8738b8b58 Mon Sep 17 00:00:00 2001 From: zppzhangpan Date: Mon, 23 Jun 2025 19:19:11 +0800 Subject: [PATCH] fix CVE-2024-47081 (cherry picked from commit 84fc8c004133becdcbe77e424a66dd8ce14ab364) --- backport-CVE-2024-47081.patch | 31 +++++++++++++++++++++++++++++++ python-requests.spec | 6 +++++- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2024-47081.patch diff --git a/backport-CVE-2024-47081.patch b/backport-CVE-2024-47081.patch new file mode 100644 index 0000000..d31f46d --- /dev/null +++ b/backport-CVE-2024-47081.patch @@ -0,0 +1,31 @@ +From 96ba401c1296ab1dda74a2365ef36d88f7d144ef Mon Sep 17 00:00:00 2001 +From: Nate Prewitt +Date: Wed, 25 Sep 2024 08:03:20 -0700 +Subject: [PATCH] Only use hostname to do netrc lookup instead of netloc + +Reference:https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef +Conflict:Modify file path adaptation:src/requests/utils.py->requests/utils.py + +--- + requests/utils.py | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/requests/utils.py b/requests/utils.py +index 699683e5d9..8a307ca8a0 100644 +--- a/requests/utils.py ++++ b/requests/utils.py +@@ -236,13 +236,7 @@ def get_netrc_auth(url, raise_errors=False): + return + + ri = urlparse(url) +- +- # Strip port numbers from netloc. This weird `if...encode`` dance is +- # used for Python 3.2, which doesn't support unicode literals. +- splitstr = b":" +- if isinstance(url, str): +- splitstr = splitstr.decode("ascii") +- host = ri.netloc.split(splitstr)[0] ++ host = ri.hostname + + try: + _netrc = netrc(netrc_path).authenticators(host) diff --git a/python-requests.spec b/python-requests.spec index 09d2282..4059a22 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -2,12 +2,13 @@ Name: python-requests Version: 2.31.0 -Release: 2 +Release: 3 Summary: Python HTTP Library License: ASL 2.0 URL: http://python-requests.org/ Source0: https://github.com/requests/requests/archive/v%{version}/requests-v%{version}.tar.gz#/requests-%{version}.tar.gz Patch6001: backport-requests-2.31.0-system-certs.patch +Patch6002: backport-CVE-2024-47081.patch BuildArch: noarch %description @@ -92,6 +93,9 @@ PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} -m pytest -v %doc HISTORY.md README.md %changelog +* Mon Jun 23 2025 zhangpan - 2.31.0-3 +- fix CVE-2024-47081 + * Mon Jun 09 2025 yanglu - 2.31.0-2 - fix the problem of residual directory after uninstallation -- Gitee