diff --git a/fix-cve-2024-47081.patch b/fix-cve-2024-47081.patch new file mode 100644 index 0000000000000000000000000000000000000000..0b4848263c5f3ee499d1904fccbd53789d76c2ed --- /dev/null +++ b/fix-cve-2024-47081.patch @@ -0,0 +1,18 @@ +diff -urN requests-2.32.3/src/requests/utils.py requests-2.32.3-new/src/requests/utils.py +--- requests-2.32.3/src/requests/utils.py 2024-05-29 23:36:10.000000000 +0800 ++++ requests-2.32.3-new/src/requests/utils.py 2025-07-01 17:33:44.315382792 +0800 +@@ -234,12 +234,8 @@ + + ri = urlparse(url) + +- # Strip port numbers from netloc. This weird `if...encode`` dance is +- # used for Python 3.2, which doesn't support unicode literals. +- splitstr = b":" +- if isinstance(url, str): +- splitstr = splitstr.decode("ascii") +- host = ri.netloc.split(splitstr)[0] ++ ++ host = ri.hostname + + try: + _netrc = netrc(netrc_path).authenticators(host) diff --git a/python-requests.spec b/python-requests.spec index 2fea8c3352559ecb5d612c47da803e05fd28cf1b..cf5dde19aff04b64f6ece8d7269afe1837b2ef71 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -2,13 +2,14 @@ Name: python-requests Version: 2.32.3 -Release: 3 +Release: 4 Summary: Python HTTP Library License: ASL 2.0 URL: https://github.com/psf/requests Source: %{url}/archive/v%{version}/requests-%{version}.tar.gz Patch6001: backport-requests-2.32.3-system-certs.patch Patch6002: backport-CVE-2024-47081.patch +Patch6003: fix-cve-2024-47081.patch BuildArch: noarch %description @@ -93,6 +94,12 @@ PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} -m pytest -v %doc HISTORY.md README.md %changelog +* Tue Jul 1 2025 wubijie123 - 2.32.3-4 +- Type:cves +- ID:CVE-2024-47081 +- SUG:NA +- DESC:Batch fix cve-2024-47081 + * Mon Jun 23 2025 zhangpan - 2.32.3-3 - fix CVE-2024-47081