diff options
| -rw-r--r-- | gnu/local.mk | 1 | ||||
| -rw-r--r-- | gnu/packages/patches/python-CVE-2018-14647.patch | 61 | ||||
| -rw-r--r-- | gnu/packages/python.scm | 26 |
3 files changed, 84 insertions, 4 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index b8248e8da0..d30bbedee6 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -1076,6 +1076,7 @@ dist_patch_DATA = \ %D%/packages/patches/python-3-deterministic-build-info.patch \ %D%/packages/patches/python-3-search-paths.patch \ %D%/packages/patches/python-3-fix-tests.patch \ + %D%/packages/patches/python-CVE-2018-14647.patch \ %D%/packages/patches/python-axolotl-AES-fix.patch \ %D%/packages/patches/python-cairocffi-dlopen-path.patch \ %D%/packages/patches/python-fix-tests.patch \ diff --git a/gnu/packages/patches/python-CVE-2018-14647.patch b/gnu/packages/patches/python-CVE-2018-14647.patch new file mode 100644 index 0000000000..24f8d21820 --- /dev/null +++ b/gnu/packages/patches/python-CVE-2018-14647.patch @@ -0,0 +1,61 @@ +Fix CVE-2018-14647: +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14647 +https://bugs.python.org/issue34623 + +Taken from upstream: +https://github.com/python/cpython/commit/f7666e828cc3d5873136473ea36ba2013d624fa1 + +diff --git Include/pyexpat.h Include/pyexpat.h +index 44259bf6d7..07020b5dc9 100644 +--- Include/pyexpat.h ++++ Include/pyexpat.h +@@ -3,7 +3,7 @@ + + /* note: you must import expat.h before importing this module! */ + +-#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.0" ++#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.1" + #define PyExpat_CAPSULE_NAME "pyexpat.expat_CAPI" + + struct PyExpat_CAPI +@@ -48,6 +48,8 @@ struct PyExpat_CAPI + enum XML_Status (*SetEncoding)(XML_Parser parser, const XML_Char *encoding); + int (*DefaultUnknownEncodingHandler)( + void *encodingHandlerData, const XML_Char *name, XML_Encoding *info); ++ /* might be none for expat < 2.1.0 */ ++ int (*SetHashSalt)(XML_Parser parser, unsigned long hash_salt); + /* always add new stuff to the end! */ + }; + +diff --git Modules/_elementtree.c Modules/_elementtree.c +index 707ab2912b..53f05f937f 100644 +--- Modules/_elementtree.c ++++ Modules/_elementtree.c +@@ -3261,6 +3261,11 @@ _elementtree_XMLParser___init___impl(XMLParserObject *self, PyObject *html, + PyErr_NoMemory(); + return -1; + } ++ /* expat < 2.1.0 has no XML_SetHashSalt() */ ++ if (EXPAT(SetHashSalt) != NULL) { ++ EXPAT(SetHashSalt)(self->parser, ++ (unsigned long)_Py_HashSecret.expat.hashsalt); ++ } + + if (target) { + Py_INCREF(target); +diff --git Modules/pyexpat.c Modules/pyexpat.c +index 47c3e86c20..aa21d93c11 100644 +--- Modules/pyexpat.c ++++ Modules/pyexpat.c +@@ -1887,6 +1887,11 @@ MODULE_INITFUNC(void) + capi.SetStartDoctypeDeclHandler = XML_SetStartDoctypeDeclHandler; + capi.SetEncoding = XML_SetEncoding; + capi.DefaultUnknownEncodingHandler = PyUnknownEncodingHandler; ++#if XML_COMBINED_VERSION >= 20100 ++ capi.SetHashSalt = XML_SetHashSalt; ++#else ++ capi.SetHashSalt = NULL; ++#endif + + /* export using capsule */ + capi_object = PyCapsule_New(&capi, PyExpat_CAPSULE_NAME, NULL); diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm index 8261fefd93..3e39866087 100644 --- a/gnu/packages/python.scm +++ b/gnu/packages/python.scm @@ -357,6 +357,7 @@ data types.") (package (inherit python-2) (name "python") (version "3.6.5") + (replacement python-3/fixed) (source (origin (method url-fetch) (uri (string-append "https://www.python.org/ftp/python/" @@ -456,6 +457,24 @@ data types.") ;; Current 3.x version. (define-public python-3 python-3.6) +(define python-3/fixed + (package + (inherit python-3) + (source (origin + (inherit (package-source python-3)) + (patches (append (origin-patches (package-source python-3)) + (search-patches "python-CVE-2018-14647.patch"))))) + (arguments + (substitute-keyword-arguments (package-arguments python-3) + ((#:phases phases) + `(modify-phases ,phases + (add-after 'unpack 'delete-broken-test + (lambda _ + ;; Delete test which fails on recent kernels: + ;; <https://bugs.python.org/issue34587>. + (delete-file "Lib/test/test_socket.py") + #t)))))))) + ;; Current major version. (define-public python python-3) @@ -474,7 +493,7 @@ data types.") ("zlib" ,zlib))))) (define-public python-minimal - (package (inherit python) + (package/inherit python (name "python-minimal") (outputs '("out")) @@ -486,8 +505,7 @@ data types.") ("zlib" ,zlib))))) (define-public python-debug - (package - (inherit python) + (package/inherit python (name "python-debug") (outputs '("out" "debug")) (build-system gnu-build-system) @@ -506,7 +524,7 @@ for more information."))) (define* (wrap-python3 python #:optional (name (string-append (package-name python) "-wrapper"))) - (package (inherit python) + (package/inherit python (name name) (source #f) (build-system trivial-build-system) |