From 2c05e52e60674a2d9240c05330f11875096c6e71 Mon Sep 17 00:00:00 2001 From: Daniele Tricoli Date: Mon, 20 May 2013 17:47:59 +0000 Subject: * debian/patches/06_fix_abuse_of_match_hostname_for_DoS.patch - Added upstream patch to fix possible abuse of ssl.match_hostname() for denial of service using certificates with many wildcards (CVE-2013-2099) (Closes: #709070) Thanks Henri Salo and Jakub Wilk for the report --- .../06_fix_abuse_of_match_hostname_for_DoS.patch | 26 ++++++++++++++++++++++ debian/patches/series | 1 + 2 files changed, 27 insertions(+) create mode 100644 debian/patches/06_fix_abuse_of_match_hostname_for_DoS.patch (limited to 'debian/patches') diff --git a/debian/patches/06_fix_abuse_of_match_hostname_for_DoS.patch b/debian/patches/06_fix_abuse_of_match_hostname_for_DoS.patch new file mode 100644 index 0000000..57a4c06 --- /dev/null +++ b/debian/patches/06_fix_abuse_of_match_hostname_for_DoS.patch @@ -0,0 +1,26 @@ +Description: Fix possible abuse of ssl.match_hostname() for denial + of service using certificates with many wildcards (CVE-2013-2099) +Origin: http://hg.python.org/cpython/rev/c627638753e2 +Bug: http://bugs.python.org/issue17980 +Bug-Debian: http://bugs.debian.org/709070 + +--- a/urllib3/packages/ssl_match_hostname/__init__.py ++++ b/urllib3/packages/ssl_match_hostname/__init__.py +@@ -7,9 +7,16 @@ + class CertificateError(ValueError): + pass + +-def _dnsname_to_pat(dn): ++def _dnsname_to_pat(dn, max_wildcards=1): + pats = [] + for frag in dn.split(r'.'): ++ if frag.count('*') > max_wildcards: ++ # Issue #17980: avoid denials of service by refusing more ++ # than one wildcard per fragment. A survery of established ++ # policy among SSL implementations showed it to be a ++ # reasonable choice. ++ raise CertificateError( ++ "too many wildcards in certificate DNS name: " + repr(dn)) + if frag == '*': + # When '*' is a fragment by itself, it matches a non-empty dotless + # fragment. diff --git a/debian/patches/series b/debian/patches/series index a8d0b0b..f44758a 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -3,3 +3,4 @@ 03_no-setuptools.patch 04_relax_nosetests_options.patch 05_fix_python3_syntax_error_in_ntlmpool.patch +06_fix_abuse_of_match_hostname_for_DoS.patch -- cgit v1.2.3