diff --git a/1.26.3.tar.gz b/1.26.3.tar.gz deleted file mode 100644 index 7bf65bbb9e8fec2ccdd884e3ec23728e952f465f..0000000000000000000000000000000000000000 Binary files a/1.26.3.tar.gz and /dev/null differ diff --git a/1.26.7.tar.gz b/1.26.7.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..123f26b8f9079fcaab44d2ca8804ada33ea1b001 Binary files /dev/null and b/1.26.7.tar.gz differ diff --git a/backport-CVE-2021-28363.patch b/backport-CVE-2021-28363.patch index cfe2af528fa94f72850d78bcd5b01c310ad9f894..25920e99707f5d9342e84ca0955cd12f2477e3e1 100644 --- a/backport-CVE-2021-28363.patch +++ b/backport-CVE-2021-28363.patch @@ -17,14 +17,14 @@ Signed-off-by: Jorge Lopez Silva --- src/urllib3/connection.py | 4 ++++ test/conftest.py | 11 ++++++++++ - .../test_proxy_poolmanager.py | 22 +++++++++++++++++++ - 3 files changed, 37 insertions(+) + .../test_proxy_poolmanager.py | 20 +++++++++++++++++++ + 3 files changed, 35 insertions(+) diff --git a/src/urllib3/connection.py b/src/urllib3/connection.py -index 9066e6ade4..45580b7e1e 100644 +index 60f70f7..f59f29b 100644 --- a/src/urllib3/connection.py +++ b/src/urllib3/connection.py -@@ -490,6 +490,10 @@ def _connect_tls_proxy(self, hostname, conn): +@@ -495,6 +495,10 @@ class HTTPSConnection(HTTPConnection): self.ca_cert_dir, self.ca_cert_data, ) @@ -36,10 +36,10 @@ index 9066e6ade4..45580b7e1e 100644 # If no cert was provided, use only the default options for server # certificate validation diff --git a/test/conftest.py b/test/conftest.py -index ff8e463186..96c9b2b5bc 100644 +index 10c3a54..d4bbd97 100644 --- a/test/conftest.py +++ b/test/conftest.py -@@ -64,6 +64,17 @@ def no_san_server(tmp_path_factory): +@@ -103,6 +103,17 @@ def no_san_server(tmp_path_factory): yield cfg @@ -55,18 +55,16 @@ index ff8e463186..96c9b2b5bc 100644 + + @pytest.fixture - def ip_san_server(tmp_path_factory): + def no_san_proxy(tmp_path_factory): tmpdir = tmp_path_factory.mktemp("certs") diff --git a/test/with_dummyserver/test_proxy_poolmanager.py b/test/with_dummyserver/test_proxy_poolmanager.py -index 737e5f7afa..c1535bd087 100644 +index d5e91a0..0f8df60 100644 --- a/test/with_dummyserver/test_proxy_poolmanager.py +++ b/test/with_dummyserver/test_proxy_poolmanager.py -@@ -543,3 +543,25 @@ def test_basic_ipv6_proxy(self): - +@@ -565,6 +565,26 @@ class TestIPv6HTTPProxyManager(IPv6HTTPDummyProxyTestCase): r = http.request("GET", "%s/" % self.https_url) assert r.status == 200 -+ -+ + +class TestHTTPSProxyVerification: + @onlyPy3 + def test_https_proxy_hostname_verification(self, no_localhost_san_server): @@ -87,3 +85,9 @@ index 737e5f7afa..c1535bd087 100644 + assert "hostname 'localhost' doesn't match" in str( + e.value.reason + ) or "Hostname mismatch" in str(e.value.reason) + + class TestHTTPSProxyVerification: + @onlyPy3 +-- +2.27.0 + diff --git a/backport-CVE-2021-33503.patch b/backport-CVE-2021-33503.patch deleted file mode 100644 index 9227f84f914ed443bfad4c8d6f40297f1de1d8a4..0000000000000000000000000000000000000000 --- a/backport-CVE-2021-33503.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 2d4a3fee6de2fa45eb82169361918f759269b4ec Mon Sep 17 00:00:00 2001 -From: Seth Michael Larson -Date: Wed, 26 May 2021 10:43:12 -0500 -Subject: [PATCH] Improve performance of sub-authority splitting in URL - ---- - src/urllib3/util/url.py | 8 +++++--- - test/test_util.py | 10 ++++++++++ - 2 files changed, 15 insertions(+), 3 deletions(-) - -diff --git a/src/urllib3/util/url.py b/src/urllib3/util/url.py -index 793324e..318a6d6 100644 ---- a/src/urllib3/util/url.py -+++ b/src/urllib3/util/url.py -@@ -63,12 +63,12 @@ IPV6_ADDRZ_RE = re.compile("^" + IPV6_ADDRZ_PAT + "$") - BRACELESS_IPV6_ADDRZ_RE = re.compile("^" + IPV6_ADDRZ_PAT[2:-2] + "$") - ZONE_ID_RE = re.compile("(" + ZONE_ID_PAT + r")\]$") - --SUBAUTHORITY_PAT = (u"^(?:(.*)@)?(%s|%s|%s)(?::([0-9]{0,5}))?$") % ( -+_HOST_PORT_PAT = ("^(%s|%s|%s)(?::([0-9]{0,5}))?$") % ( - REG_NAME_PAT, - IPV4_PAT, - IPV6_ADDRZ_PAT, - ) --SUBAUTHORITY_RE = re.compile(SUBAUTHORITY_PAT, re.UNICODE | re.DOTALL) -+_HOST_PORT_RE = re.compile(_HOST_PORT_PAT, re.UNICODE | re.DOTALL) - - UNRESERVED_CHARS = set( - "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-~" -@@ -365,7 +365,9 @@ def parse_url(url): - scheme = scheme.lower() - - if authority: -- auth, host, port = SUBAUTHORITY_RE.match(authority).groups() -+ auth, _, host_port = authority.rpartition("@") -+ auth = auth or None -+ host, port = _HOST_PORT_RE.match(host_port).groups() - if auth and normalize_uri: - auth = _encode_invalid_chars(auth, USERINFO_CHARS) - if port == "": -diff --git a/test/test_util.py b/test/test_util.py -index 838c751..ef6aa11 100644 ---- a/test/test_util.py -+++ b/test/test_util.py -@@ -437,6 +437,16 @@ class TestUtil(object): - fragment="hash", - ), - ), -+ # Tons of '@' causing backtracking -+ ("https://" + ("@" * 10000) + "[", False), -+ ( -+ "https://user:" + ("@" * 10000) + "example.com", -+ Url( -+ scheme="https", -+ auth="user:" + ("%40" * 9999), -+ host="example.com", -+ ), -+ ), - ] - - @pytest.mark.parametrize("url, expected_url", url_vulnerabilities) --- -2.23.0 - diff --git a/python-urllib3.spec b/python-urllib3.spec index dec7db6e8737adbbefc2e29d437a3700de6fa5b8..c71737a4568fbc6d5b2fd983b8880c19fda13957 100644 --- a/python-urllib3.spec +++ b/python-urllib3.spec @@ -2,8 +2,8 @@ %bcond_without tests Name: python-%{srcname} -Version: 1.26.3 -Release: 3 +Version: 1.26.7 +Release: 1 Summary: Sanity-friendly HTTP client for Python License: MIT URL: https://urllib3.readthedocs.io @@ -12,7 +12,6 @@ Source1: ssl_match_hostname_py3.py Patch0001: remove_mock.patch Patch6000: backport-CVE-2021-28363.patch -Patch6001: backport-CVE-2021-33503.patch BuildArch: noarch @@ -49,8 +48,8 @@ rm -rf test/test_no_ssl.py %install %py3_install -rm -rf %{buildroot}%{python3_sitelib}/urllib3/packages/six.py* -rm -rf %{buildroot}%{python3_sitelib}/urllib3/packages/__pycache__/six* +rm -rf %{buildroot}%{python3_sitelib}/urllib3/packages/six.py +rm -rf %{buildroot}%{python3_sitelib}/urllib3/packages/__pycache__/six.* rm -rf %{buildroot}%{python3_sitelib}/urllib3/packages/ssl_match_hostname/ mkdir -p %{buildroot}/%{python3_sitelib}/urllib3/packages/ @@ -69,11 +68,14 @@ PYTHONPATH=%{buildroot}%{python3_sitelib}:%{python3_sitelib} %{__python3} -m pyt %files -n python3-urllib3 %defattr(-,root,root) %license LICENSE.txt -%doc CHANGES.rst README.rst CONTRIBUTORS.txt +%doc CHANGES.rst README.rst %{python3_sitelib}/urllib3/ %{python3_sitelib}/urllib3-*.egg-info %changelog +* Sat Nov 27 2021 zhanzhimin - 1.26.7-1 +- update to 1.26.7 + * Mon Jul 5 2021 zhanzhimin - 1.26.3-3 - fix CVE-2021-33503