From 2d86a573cb43581d637cac573ac381abebcc012a Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: May 16 2023 06:12:19 +0000 Subject: import python38-3.8.16-1.module+el8.8.0+17624+9a09af5a --- diff --git a/.gitignore b/.gitignore index 89f470f..65d9de8 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/Python-3.8.13-noexe.tar.xz +SOURCES/Python-3.8.16-noexe.tar.xz diff --git a/.python38.metadata b/.python38.metadata index f972c8f..596d6f6 100644 --- a/.python38.metadata +++ b/.python38.metadata @@ -1 +1 @@ -b1558d21c10c88078e11d74168b06ae8a49df19f SOURCES/Python-3.8.13-noexe.tar.xz +ec97523b167d5b0e915b37e58f03da6384b15caa SOURCES/Python-3.8.16-noexe.tar.xz diff --git a/SOURCES/00329-fips.patch b/SOURCES/00329-fips.patch index d955f73..590bda6 100644 --- a/SOURCES/00329-fips.patch +++ b/SOURCES/00329-fips.patch @@ -1,4 +1,4 @@ -From 9e1da6c093529d7b314f3703158a213824c3521e Mon Sep 17 00:00:00 2001 +From 31ae5d3189a0b8ec07c55df3785d27d769bc90a5 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Thu, 25 Jul 2019 16:19:52 +0200 Subject: [PATCH 01/36] Expose OpenSSL FIPS_mode() as hashlib.get_fips_mode() @@ -123,10 +123,10 @@ index 9aaea47..30fd8a9 100644 -/*[clinic end generated code: output=38c2637f67e9bb79 input=a9049054013a1b77]*/ +/*[clinic end generated code: output=5467006d93e7479e input=a9049054013a1b77]*/ -- -2.31.1 +2.38.1 -From 5a8faeb61d7acd6c7036efe24efe269c683dc1a0 Mon Sep 17 00:00:00 2001 +From 9e12b2fdecca4fba5d777923f7742fffb7b6240d Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Thu, 25 Jul 2019 17:04:06 +0200 Subject: [PATCH 02/36] Use python's fall backs for the crypto it implements @@ -410,10 +410,10 @@ index 63ae836..1bcfdf9 100644 +if not get_fips_mode(): + del __py_new diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index 8b53d23..e9abcbb 100644 +index e6cec4e..f40cc83 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py -@@ -945,6 +945,7 @@ class KDFTests(unittest.TestCase): +@@ -954,6 +954,7 @@ class KDFTests(unittest.TestCase): iterations=1, dklen=None) self.assertEqual(out, self.pbkdf2_results['sha1'][0][0]) @@ -422,10 +422,10 @@ index 8b53d23..e9abcbb 100644 self._test_pbkdf2_hmac(py_hashlib.pbkdf2_hmac) -- -2.31.1 +2.38.1 -From d21c5a098dda889de21985e57f12852ce9fbbcf1 Mon Sep 17 00:00:00 2001 +From a7711c418ea72f9ea18bbb70a2d52ab44489066b Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Thu, 25 Jul 2019 17:19:06 +0200 Subject: [PATCH 03/36] Disable Python's hash implementations in FIPS mode, @@ -695,10 +695,10 @@ index c1fb618..34d09b4 100644 return NULL; } diff --git a/setup.py b/setup.py -index c28c096..a11bbda 100644 +index 0b24dd6..f7c4be1 100644 --- a/setup.py +++ b/setup.py -@@ -1673,7 +1673,6 @@ class PyBuildExt(build_ext): +@@ -1677,7 +1677,6 @@ class PyBuildExt(build_ext): def detect_modules(self): self.configure_compiler() self.init_inc_lib_dirs() @@ -706,7 +706,7 @@ index c28c096..a11bbda 100644 self.detect_simple_extensions() if TEST_EXTENSIONS: self.detect_test_extensions() -@@ -2161,7 +2160,7 @@ class PyBuildExt(build_ext): +@@ -2165,7 +2164,7 @@ class PyBuildExt(build_ext): sources=sources, depends=depends)) @@ -715,7 +715,7 @@ index c28c096..a11bbda 100644 # Detect SSL support for the socket module (via _ssl) config_vars = sysconfig.get_config_vars() -@@ -2182,7 +2181,7 @@ class PyBuildExt(build_ext): +@@ -2186,7 +2185,7 @@ class PyBuildExt(build_ext): if not openssl_libs: # libssl and libcrypto not found self.missing.extend(['_ssl', '_hashlib']) @@ -724,7 +724,7 @@ index c28c096..a11bbda 100644 # Find OpenSSL includes ssl_incs = find_file( -@@ -2190,7 +2189,7 @@ class PyBuildExt(build_ext): +@@ -2194,7 +2193,7 @@ class PyBuildExt(build_ext): ) if ssl_incs is None: self.missing.extend(['_ssl', '_hashlib']) @@ -733,7 +733,7 @@ index c28c096..a11bbda 100644 # OpenSSL 1.0.2 uses Kerberos for KRB5 ciphers krb5_h = find_file( -@@ -2200,12 +2199,24 @@ class PyBuildExt(build_ext): +@@ -2204,12 +2203,24 @@ class PyBuildExt(build_ext): if krb5_h: ssl_incs.extend(krb5_h) @@ -761,7 +761,7 @@ index c28c096..a11bbda 100644 depends=[ 'socketmodule.h', '_ssl/debughelpers.c', -@@ -2218,22 +2229,12 @@ class PyBuildExt(build_ext): +@@ -2222,22 +2233,12 @@ class PyBuildExt(build_ext): self.add(Extension('_hashlib', ['_hashopenssl.c'], depends=['hashlib.h'], @@ -788,7 +788,7 @@ index c28c096..a11bbda 100644 blake2_deps = glob(os.path.join(escape(self.srcdir), 'Modules/_blake2/impl/*')) -@@ -2243,6 +2244,7 @@ class PyBuildExt(build_ext): +@@ -2247,6 +2248,7 @@ class PyBuildExt(build_ext): ['_blake2/blake2module.c', '_blake2/blake2b_impl.c', '_blake2/blake2s_impl.c'], @@ -796,7 +796,7 @@ index c28c096..a11bbda 100644 depends=blake2_deps)) sha3_deps = glob(os.path.join(escape(self.srcdir), -@@ -2250,7 +2252,9 @@ class PyBuildExt(build_ext): +@@ -2254,7 +2256,9 @@ class PyBuildExt(build_ext): sha3_deps.append('hashlib.h') self.add(Extension('_sha3', ['_sha3/sha3module.c'], @@ -808,10 +808,10 @@ index c28c096..a11bbda 100644 def detect_nis(self): if MS_WINDOWS or CYGWIN or HOST_PLATFORM == 'qnx6': -- -2.31.1 +2.38.1 -From 668177d86702b10da881f76cf17bda44d8823be9 Mon Sep 17 00:00:00 2001 +From 5928affee1e8306877918efc417090512faea14d Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Thu, 12 Dec 2019 16:58:31 +0100 Subject: [PATCH 04/36] Expose all hashes available to OpenSSL @@ -1310,10 +1310,10 @@ index 30fd8a9..e96a752 100644 -/*[clinic end generated code: output=5467006d93e7479e input=a9049054013a1b77]*/ +/*[clinic end generated code: output=be8e21a10dff71e7 input=a9049054013a1b77]*/ -- -2.31.1 +2.38.1 -From 7137c003853b8672eed4d28fe8703756b75ab790 Mon Sep 17 00:00:00 2001 +From eb264b74a2a6fc820813edbfa611b782edcda088 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Thu, 25 Jul 2019 18:13:45 +0200 Subject: [PATCH 05/36] Fix tests @@ -1323,7 +1323,7 @@ Subject: [PATCH 05/36] Fix tests 1 file changed, 45 insertions(+), 13 deletions(-) diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index e9abcbb..2a55fd4 100644 +index f40cc83..972eda1 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py @@ -190,7 +190,9 @@ class HashLibTestCase(unittest.TestCase): @@ -1442,10 +1442,10 @@ index e9abcbb..2a55fd4 100644 @requires_sha3 def test_extra_sha3(self): -- -2.31.1 +2.38.1 -From 94f13c68d2a4845e58d4c7b7adf01e64f993c4f5 Mon Sep 17 00:00:00 2001 +From 7c34172f398cdea804e8a4671f996e9b3706ec7d Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Fri, 26 Jul 2019 11:27:57 +0200 Subject: [PATCH 06/36] Change FIPS exceptions from _blake2, _sha3 module init @@ -1584,10 +1584,10 @@ index 34d09b4..3079e1e 100644 if ((m = PyModule_Create(&_SHA3module)) == NULL) { return NULL; -- -2.31.1 +2.38.1 -From 805af2c3dcbe1855a9fb8eb534b985aed338c2ba Mon Sep 17 00:00:00 2001 +From c968e85d077123510f8b6441b169b46f6e0e9d26 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Fri, 26 Jul 2019 11:24:09 +0200 Subject: [PATCH 07/36] Make hashlib importable under FIPS mode @@ -1619,10 +1619,10 @@ index 1bcfdf9..898e6dc 100644 -- -2.31.1 +2.38.1 -From bc3f033f0a832e6b7ddf50e1059de8fc5df08d3f Mon Sep 17 00:00:00 2001 +From ea2a87a494c36eae2cc2cf343074ff0214e37517 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Fri, 26 Jul 2019 15:41:10 +0200 Subject: [PATCH 08/36] Implement hmac.new using new built-in module, @@ -2250,10 +2250,10 @@ index 0000000..b472a6e +} +/*[clinic end generated code: output=10b6e8cac6d7a2c9 input=a9049054013a1b77]*/ diff --git a/setup.py b/setup.py -index a11bbda..ca30105 100644 +index f7c4be1..6fc7e72 100644 --- a/setup.py +++ b/setup.py -@@ -2231,6 +2231,10 @@ class PyBuildExt(build_ext): +@@ -2235,6 +2235,10 @@ class PyBuildExt(build_ext): depends=['hashlib.h'], **self.detect_openssl_args()) ) @@ -2265,10 +2265,10 @@ index a11bbda..ca30105 100644 # RHEL: Always force OpenSSL for md5, sha1, sha256, sha512; # don't build Python's implementations. -- -2.31.1 +2.38.1 -From da75615e1f3e6b8f44a16e5113a4a6fd55e48629 Mon Sep 17 00:00:00 2001 +From 03ac0fc03e418f73ed76b203f779a083312aaff9 Mon Sep 17 00:00:00 2001 From: Marcel Plch Date: Mon, 29 Jul 2019 12:45:11 +0200 Subject: [PATCH 09/36] FIPS review @@ -2480,10 +2480,10 @@ index ca95d72..216ed04 100644 + return PyModuleDef_Init(&_hmacopenssl_def); } -- -2.31.1 +2.38.1 -From f48fab4946308008e989d845ce0dbc2cff6ce9ff Mon Sep 17 00:00:00 2001 +From f130424124b4cbd4b61f1dd84b69f1f4f9e766f6 Mon Sep 17 00:00:00 2001 From: Marcel Plch Date: Mon, 29 Jul 2019 13:05:04 +0200 Subject: [PATCH 10/36] revert cosmetic nitpick and remove trailing whitespace @@ -2529,10 +2529,10 @@ index 216ed04..221714c 100644 .m_methods = hmacopenssl_functions, .m_slots = hmacopenssl_slots, -- -2.31.1 +2.38.1 -From dc55436077250ba791ee67692fdc8704a900987b Mon Sep 17 00:00:00 2001 +From 5259a4c7bd3d1ce2f0bdbcd0c95583c95d7d0d23 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Wed, 31 Jul 2019 15:43:43 +0200 Subject: [PATCH 11/36] Add initial tests for various hashes under FIPS mode @@ -2613,10 +2613,10 @@ index 0000000..bee911e +if __name__ == "__main__": + unittest.main() -- -2.31.1 +2.38.1 -From 446c6a790ef878bda6137ebfc570f36dee01c380 Mon Sep 17 00:00:00 2001 +From c2b7ebc17d79f8c91572a790d425f9106d4dd70e Mon Sep 17 00:00:00 2001 From: Marcel Plch Date: Thu, 1 Aug 2019 16:39:37 +0200 Subject: [PATCH 12/36] Initialize HMAC type. @@ -2682,10 +2682,10 @@ index 221714c..239445a 100644 fail: -- -2.31.1 +2.38.1 -From 357007a6034cc3409ad2e2fe9fc77974ea6de626 Mon Sep 17 00:00:00 2001 +From 931784f1a431538486905ef1d3958dfefd5478e6 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Thu, 1 Aug 2019 17:57:05 +0200 Subject: [PATCH 13/36] Use a stronger hash in multiprocessing handshake @@ -2730,10 +2730,10 @@ index 8e2facf..bb4acb6 100644 response = connection.recv_bytes(256) # reject large message if response != WELCOME: -- -2.31.1 +2.38.1 -From fddd82fedc5ea8b49ceab49296c7bddb9f3f1204 Mon Sep 17 00:00:00 2001 +From 8a68ba81a66181d9a4b6c7b1e77f944efada2aae Mon Sep 17 00:00:00 2001 From: Marcel Plch Date: Fri, 2 Aug 2019 17:36:01 +0200 Subject: [PATCH 14/36] Fix refcounting @@ -2804,10 +2804,10 @@ index 239445a..9c28828 100644 -- -2.31.1 +2.38.1 -From 42f7d2fbefe161607ad146f44d2abd19fe804810 Mon Sep 17 00:00:00 2001 +From 5d835c236b392e8741fabe9b9d83d5482842dd87 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 13:37:05 +0200 Subject: [PATCH 15/36] hmac: Don't default to md5 in FIPS mode @@ -2830,10 +2830,10 @@ index daabc8c..0302364 100644 result = _hmacopenssl.new(key, digestmod=name) if msg: -- -2.31.1 +2.38.1 -From e285342c3b17de9b13ccbf2dbdb68cce5b4df86c Mon Sep 17 00:00:00 2001 +From d865fb5a73ffaf39de68b69c9ccb81ca17b6c430 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 14:20:58 +0200 Subject: [PATCH 16/36] Make _hmacopenssl.HMAC subclassable; subclass it as @@ -3121,10 +3121,10 @@ index b472a6e..861acc1 100644 -/*[clinic end generated code: output=10b6e8cac6d7a2c9 input=a9049054013a1b77]*/ +/*[clinic end generated code: output=d93ad460795d49b5 input=a9049054013a1b77]*/ -- -2.31.1 +2.38.1 -From 5dab92e1f96fc0940a2d5d365708329e8c282587 Mon Sep 17 00:00:00 2001 +From 0a75e9886721aa076542a40159b02fbd18bd8cd3 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 16:10:36 +0200 Subject: [PATCH 17/36] Fix _hmacopenssl.HMAC.block_size @@ -3147,10 +3147,10 @@ index 7d3d973..a24c8ba 100644 static PyMethodDef Hmac_methods[] = { -- -2.31.1 +2.38.1 -From d39cc2e44d6debffce096b82d30909e2662379ab Mon Sep 17 00:00:00 2001 +From 68b4ee700ed23422472c9b96cf0631cb5a5dab6e Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 15:02:08 +0200 Subject: [PATCH 18/36] distutils upload: Skip md5 checksum in FIPS mode @@ -3229,10 +3229,10 @@ index c17d8e7..b4b64e9 100644 def test_upload_fails(self): -- -2.31.1 +2.38.1 -From 124f7e862bdbf6615e64fedfa73a76e199d68644 Mon Sep 17 00:00:00 2001 +From 62c8250c2996af8e4d112676c0995616583fafa7 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 15:32:25 +0200 Subject: [PATCH 19/36] Fix HMAC tests on FIPS mode @@ -3322,10 +3322,10 @@ index 23c108f..0a85981 100644 def test_equality(self): # Testing if the copy has the same digests. -- -2.31.1 +2.38.1 -From 6bc6c745da5c2d860de9f76402ccf554e398bbbc Mon Sep 17 00:00:00 2001 +From a7f5d3a4712694e6b74295ba6980c554b56d7227 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 16:37:12 +0200 Subject: [PATCH 20/36] test_tools: Skip md5sum tests in FIPS mode @@ -3355,10 +3355,10 @@ index fb565b7..7028a4d 100644 @classmethod def setUpClass(cls): -- -2.31.1 +2.38.1 -From 22f2476f2a19dfc4e4c25e5df2f059bf8e15d397 Mon Sep 17 00:00:00 2001 +From 9e6cfe34f7377761f758d57a1b68a62fd4d0f2d1 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 18:23:57 +0200 Subject: [PATCH 21/36] Make hashlib tests pass in FIPS mode @@ -3368,7 +3368,7 @@ Subject: [PATCH 21/36] Make hashlib tests pass in FIPS mode 1 file changed, 48 insertions(+), 19 deletions(-) diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index 2a55fd4..9ae5efc 100644 +index 972eda1..19a9868 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py @@ -28,6 +28,11 @@ COMPILED_WITH_PYDEBUG = hasattr(sys, 'gettotalrefcount') @@ -3528,7 +3528,7 @@ index 2a55fd4..9ae5efc 100644 @unittest.skipIf(sys.maxsize < _4G - 1, 'test cannot run on 32-bit systems') @bigmemtest(size=_4G - 1, memuse=1, dry_run=False) def test_case_md5_uintmax(self, size): -@@ -842,14 +869,16 @@ class HashLibTestCase(unittest.TestCase): +@@ -851,14 +878,16 @@ class HashLibTestCase(unittest.TestCase): m = cons(b'x' * gil_minsize) m.update(b'1') @@ -3550,10 +3550,10 @@ index 2a55fd4..9ae5efc 100644 @support.reap_threads def test_threaded_hashing(self): -- -2.31.1 +2.38.1 -From ca8655cc0f8c1bcfb5ae970d33a826c092746203 Mon Sep 17 00:00:00 2001 +From 22b6dcc045d87d130852bc4f017cfb6305b329dd Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Wed, 14 Aug 2019 14:43:07 +0200 Subject: [PATCH 22/36] distutils upload: only add md5 if available, but @@ -3620,10 +3620,10 @@ index b4b64e9..f720a79 100644 def test_upload_fails(self): -- -2.31.1 +2.38.1 -From 12f506902ee04749565485bb60f0b927b2895e71 Mon Sep 17 00:00:00 2001 +From b02daa9dbf4fcd2d1e067d63873d276bd7bf132f Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Fri, 13 Sep 2019 02:30:00 +0200 Subject: [PATCH 23/36] bpo-9216: Add usedforsecurity to hashlib constructors @@ -3709,7 +3709,7 @@ index f5da6ec..86b9f65 100644 These functions return the corresponding hash objects for calculating diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index 9ae5efc..08bb91f 100644 +index 19a9868..3ee9b14 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py @@ -226,6 +226,15 @@ class HashLibTestCase(unittest.TestCase): @@ -5854,10 +5854,10 @@ index 4167fd3..504d40a 100644 SHAobject *new; Py_buffer buf; -- -2.31.1 +2.38.1 -From 041f34e22d7c458b611a72e3927deb85f20d1a85 Mon Sep 17 00:00:00 2001 +From 0ee86826a425528d1f129788ad3e9e144e81da83 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 26 Aug 2019 19:09:39 +0200 Subject: [PATCH 24/36] Test the usedforsecurity flag @@ -5867,7 +5867,7 @@ Subject: [PATCH 24/36] Test the usedforsecurity flag 1 file changed, 54 insertions(+), 34 deletions(-) diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index 08bb91f..1368e91 100644 +index 3ee9b14..a991f0a 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py @@ -21,6 +21,7 @@ from test import support @@ -6080,9 +6080,9 @@ index 08bb91f..1368e91 100644 - self.check('md5', b'A'*size, '28138d306ff1b8281f1a9067e1a1a2b3') + self.check('md5', b'A'*size, '28138d306ff1b8281f1a9067e1a1a2b3', usedforsecurity=False) - # use the three examples from Federal Information Processing Standards - # Publication 180-1, Secure Hash Standard, 1995 April 17 -@@ -925,6 +935,16 @@ class HashLibTestCase(unittest.TestCase): + @unittest.skipIf(sys.maxsize < _4G - 1, 'test cannot run on 32-bit systems') + @bigmemtest(size=_4G - 1, memuse=1, dry_run=False) +@@ -934,6 +944,16 @@ class HashLibTestCase(unittest.TestCase): self.assertEqual(expected_hash, hasher.hexdigest()) @@ -6100,10 +6100,10 @@ index 08bb91f..1368e91 100644 class KDFTests(unittest.TestCase): -- -2.31.1 +2.38.1 -From 6ae69003979add3243d700e1f5154cf83818ea62 Mon Sep 17 00:00:00 2001 +From 7602d70630fa0e736ad518b243079b658893d653 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Thu, 29 Aug 2019 10:25:28 +0200 Subject: [PATCH 25/36] Skip error checking in _hashlib.get_fips_mode @@ -6155,10 +6155,10 @@ index b4d05ab..a48b607 100644 -- -2.31.1 +2.38.1 -From 95b58ae12206c7889e0159a720c1a96fcb2dc050 Mon Sep 17 00:00:00 2001 +From 07552e7758fdc9c9610d773b4100d4686b5353a3 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Thu, 10 Oct 2019 13:04:50 +0200 Subject: [PATCH 26/36] Skip error checking in _Py_hashlib_fips_error @@ -6193,10 +6193,10 @@ index 47ed003..d4cbdef 100644 } PyErr_Format(exc, "%s is not available in FIPS mode", name); -- -2.31.1 +2.38.1 -From ba0462edf8fb3ae3cb04151460002cf687758605 Mon Sep 17 00:00:00 2001 +From 8be15a9faf79a062be4b0f27605737bc34687e68 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 19:12:38 +0200 Subject: [PATCH 27/36] Fixups @@ -6235,10 +6235,10 @@ index 0a85981..0b481ec 100644 h1 = hmac.HMAC(b"key", digestmod="sha1") h2 = h1.copy() -- -2.31.1 +2.38.1 -From d2596ea3fab68d2fc586abaae64323599c2a74c8 Mon Sep 17 00:00:00 2001 +From 112646fbf2af81df1750140f7486b32296518099 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 26 Aug 2019 19:39:48 +0200 Subject: [PATCH 28/36] Don't re-export get_fips_mode from hashlib @@ -6446,7 +6446,7 @@ index 34812e6..86e61e2 100644 self.compare_hashes(hashlib.shake_128(b'abc'), _hashlib.openssl_shake_128(b'abc')) self.compare_hashes(hashlib.shake_256(b'abc'), _hashlib.openssl_shake_256(b'abc')) diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index 1368e91..a4b7840 100644 +index a991f0a..b535059 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py @@ -29,7 +29,9 @@ COMPILED_WITH_PYDEBUG = hasattr(sys, 'gettotalrefcount') @@ -6502,7 +6502,7 @@ index 1368e91..a4b7840 100644 self.check_blocksize_name('md5', 64, 16) self.check_blocksize_name('sha1', 64, 20) self.check_blocksize_name('sha224', 64, 28) -@@ -935,7 +937,7 @@ class HashLibTestCase(unittest.TestCase): +@@ -944,7 +946,7 @@ class HashLibTestCase(unittest.TestCase): self.assertEqual(expected_hash, hasher.hexdigest()) @@ -6551,7 +6551,7 @@ index 0b481ec..cc77928 100644 def test_realcopy(self): # Testing if the copy method created a real copy. diff --git a/Lib/test/test_smtplib.py b/Lib/test/test_smtplib.py -index c9205ae..e4d7fb4 100644 +index d14eb45..af53ec9 100644 --- a/Lib/test/test_smtplib.py +++ b/Lib/test/test_smtplib.py @@ -17,6 +17,8 @@ import select @@ -6563,7 +6563,7 @@ index c9205ae..e4d7fb4 100644 import unittest from test import support, mock_socket -@@ -1059,7 +1061,7 @@ class SMTPSimTests(unittest.TestCase): +@@ -1114,7 +1116,7 @@ class SMTPSimTests(unittest.TestCase): def testAUTH_multiple(self): # Test that multiple authentication methods are tried. @@ -6605,10 +6605,10 @@ index 1cb358f..6f5cb7f 100644 from test import support -- -2.31.1 +2.38.1 -From 7873a4a314732768bc4d11a095ae50f0553bdebd Mon Sep 17 00:00:00 2001 +From 69a0ddba408a9595aa0fc5b3fdfe7e59838acea2 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Wed, 20 Nov 2019 10:59:25 +0100 Subject: [PATCH 29/36] Use FIPS compliant CSPRNG @@ -6773,10 +6773,10 @@ index eb2b6d0..cb38cfe 100644 return win32_urandom((unsigned char *)buffer, size, raise); #else -- -2.31.1 +2.38.1 -From 99ee25369116bf17731502e77a81bd0c5ac59b38 Mon Sep 17 00:00:00 2001 +From 72894033d2c1d29897204c5272d8f2878c17254c Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Thu, 28 Nov 2019 17:26:02 +0100 Subject: [PATCH 30/36] Fixups for FIPS compliant CSPRNG @@ -6872,10 +6872,10 @@ index cb38cfe..08fa29a 100644 return 0; } -- -2.31.1 +2.38.1 -From 3750c8b8b4c09c6bc795721bc353da23b015fe4d Mon Sep 17 00:00:00 2001 +From d8bc6ab755acf0e2feffda802aeed032a2319df8 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Thu, 2 Apr 2020 16:50:37 +0200 Subject: [PATCH 31/36] Do not raise a ValueError if digestmod is missing in @@ -6902,10 +6902,10 @@ index 5055027..ee1ad76 100644 return digestmod.lower() elif callable(digestmod): -- -2.31.1 +2.38.1 -From 737af204f04bb39e5f87d53fe07713137639234e Mon Sep 17 00:00:00 2001 +From 9dd6dc8c11b96ac74abf220ed76d1176041c3711 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Thu, 2 Apr 2020 16:55:36 +0200 Subject: [PATCH 32/36] Regenerate the clinic files @@ -6989,10 +6989,10 @@ index 861acc1..527be83 100644 -/*[clinic end generated code: output=d93ad460795d49b5 input=a9049054013a1b77]*/ +/*[clinic end generated code: output=9b75c31e1116bf6f input=a9049054013a1b77]*/ -- -2.31.1 +2.38.1 -From d0e7edf46ceef6ffb6075bb8b8b966f31df018fc Mon Sep 17 00:00:00 2001 +From f646402958e8d284519ef7f72d0225ace210ffa7 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Tue, 7 Apr 2020 15:16:45 +0200 Subject: [PATCH 33/36] Pass kwargs (like usedforsecurity) through __hash_new @@ -7024,10 +7024,10 @@ index 2fc214e..785858f 100644 try: -- -2.31.1 +2.38.1 -From 0e3f635871d22831cbb5f0bffb9962f2a1ad29eb Mon Sep 17 00:00:00 2001 +From bd206ed69e7c19b62f0174a649b5c2d03f0d9f5b Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Tue, 7 Apr 2020 15:18:48 +0200 Subject: [PATCH 34/36] Adjust new upstream test for failing hashes with @@ -7038,7 +7038,7 @@ Subject: [PATCH 34/36] Adjust new upstream test for failing hashes with 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index a4b7840..a858bf4 100644 +index b535059..6e846c4 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py @@ -239,15 +239,23 @@ class HashLibTestCase(unittest.TestCase): @@ -7070,10 +7070,10 @@ index a4b7840..a858bf4 100644 self.assertRaises(ValueError, hashlib.new, 'spam spam spam spam spam') self.assertRaises(TypeError, hashlib.new, 1) -- -2.31.1 +2.38.1 -From 8145cfd2f71749a9fe844e5abc725f36e9085b22 Mon Sep 17 00:00:00 2001 +From d1ce20110573989382948a901896169eb637b265 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Fri, 24 Apr 2020 19:57:16 +0200 Subject: [PATCH 35/36] Skip the test_with_digestmod_no_default under FIPS @@ -7116,10 +7116,10 @@ index cc77928..fd068e0 100644 class ConstructorTestCase(unittest.TestCase): -- -2.31.1 +2.38.1 -From 969498fda9699b2e9d2df4a78a671e37d578daea Mon Sep 17 00:00:00 2001 +From bff06e176e60200582a42611d4fe3c240da314a3 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Tue, 31 Mar 2020 18:00:42 +0200 Subject: [PATCH 36/36] Add a sentinel value on the Hmac_members table of the @@ -7142,5 +7142,5 @@ index 9577cad..4bd7c15 100644 PyDoc_STRVAR(hmactype_doc, -- -2.31.1 +2.38.1 diff --git a/SOURCES/00382-cve-2015-20107.patch b/SOURCES/00382-cve-2015-20107.patch deleted file mode 100644 index 84fda78..0000000 --- a/SOURCES/00382-cve-2015-20107.patch +++ /dev/null @@ -1,150 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Petr Viktorin -Date: Fri, 3 Jun 2022 11:43:35 +0200 -Subject: [PATCH] 00382: CVE-2015-20107 - -Make mailcap refuse to match unsafe filenames/types/params (GH-91993) - -Upstream: https://github.com/python/cpython/issues/68966 - -Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390 ---- - Doc/library/mailcap.rst | 12 +++++++++ - Lib/mailcap.py | 26 +++++++++++++++++-- - Lib/test/test_mailcap.py | 8 ++++-- - ...2-04-27-18-25-30.gh-issue-68966.gjS8zs.rst | 4 +++ - 4 files changed, 46 insertions(+), 4 deletions(-) - create mode 100644 Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst - -diff --git a/Doc/library/mailcap.rst b/Doc/library/mailcap.rst -index bf9639bdac..a75857be62 100644 ---- a/Doc/library/mailcap.rst -+++ b/Doc/library/mailcap.rst -@@ -54,6 +54,18 @@ standard. However, mailcap files are supported on most Unix systems. - use) to determine whether or not the mailcap line applies. :func:`findmatch` - will automatically check such conditions and skip the entry if the check fails. - -+ .. versionchanged:: 3.11 -+ -+ To prevent security issues with shell metacharacters (symbols that have -+ special effects in a shell command line), ``findmatch`` will refuse -+ to inject ASCII characters other than alphanumerics and ``@+=:,./-_`` -+ into the returned command line. -+ -+ If a disallowed character appears in *filename*, ``findmatch`` will always -+ return ``(None, None)`` as if no entry was found. -+ If such a character appears elsewhere (a value in *plist* or in *MIMEtype*), -+ ``findmatch`` will ignore all mailcap entries which use that value. -+ A :mod:`warning ` will be raised in either case. - - .. function:: getcaps() - -diff --git a/Lib/mailcap.py b/Lib/mailcap.py -index bd0fc0981c..dcd4b449e8 100644 ---- a/Lib/mailcap.py -+++ b/Lib/mailcap.py -@@ -2,6 +2,7 @@ - - import os - import warnings -+import re - - __all__ = ["getcaps","findmatch"] - -@@ -13,6 +14,11 @@ def lineno_sort_key(entry): - else: - return 1, 0 - -+_find_unsafe = re.compile(r'[^\xa1-\U0010FFFF\w@+=:,./-]').search -+ -+class UnsafeMailcapInput(Warning): -+ """Warning raised when refusing unsafe input""" -+ - - # Part 1: top-level interface. - -@@ -165,15 +171,22 @@ def findmatch(caps, MIMEtype, key='view', filename="/dev/null", plist=[]): - entry to use. - - """ -+ if _find_unsafe(filename): -+ msg = "Refusing to use mailcap with filename %r. Use a safe temporary filename." % (filename,) -+ warnings.warn(msg, UnsafeMailcapInput) -+ return None, None - entries = lookup(caps, MIMEtype, key) - # XXX This code should somehow check for the needsterminal flag. - for e in entries: - if 'test' in e: - test = subst(e['test'], filename, plist) -+ if test is None: -+ continue - if test and os.system(test) != 0: - continue - command = subst(e[key], MIMEtype, filename, plist) -- return command, e -+ if command is not None: -+ return command, e - return None, None - - def lookup(caps, MIMEtype, key=None): -@@ -206,6 +219,10 @@ def subst(field, MIMEtype, filename, plist=[]): - elif c == 's': - res = res + filename - elif c == 't': -+ if _find_unsafe(MIMEtype): -+ msg = "Refusing to substitute MIME type %r into a shell command." % (MIMEtype,) -+ warnings.warn(msg, UnsafeMailcapInput) -+ return None - res = res + MIMEtype - elif c == '{': - start = i -@@ -213,7 +230,12 @@ def subst(field, MIMEtype, filename, plist=[]): - i = i+1 - name = field[start:i] - i = i+1 -- res = res + findparam(name, plist) -+ param = findparam(name, plist) -+ if _find_unsafe(param): -+ msg = "Refusing to substitute parameter %r (%s) into a shell command" % (param, name) -+ warnings.warn(msg, UnsafeMailcapInput) -+ return None -+ res = res + param - # XXX To do: - # %n == number of parts if type is multipart/* - # %F == list of alternating type and filename for parts -diff --git a/Lib/test/test_mailcap.py b/Lib/test/test_mailcap.py -index c08423c670..920283d9a2 100644 ---- a/Lib/test/test_mailcap.py -+++ b/Lib/test/test_mailcap.py -@@ -121,7 +121,8 @@ class HelperFunctionTest(unittest.TestCase): - (["", "audio/*", "foo.txt"], ""), - (["echo foo", "audio/*", "foo.txt"], "echo foo"), - (["echo %s", "audio/*", "foo.txt"], "echo foo.txt"), -- (["echo %t", "audio/*", "foo.txt"], "echo audio/*"), -+ (["echo %t", "audio/*", "foo.txt"], None), -+ (["echo %t", "audio/wav", "foo.txt"], "echo audio/wav"), - (["echo \\%t", "audio/*", "foo.txt"], "echo %t"), - (["echo foo", "audio/*", "foo.txt", plist], "echo foo"), - (["echo %{total}", "audio/*", "foo.txt", plist], "echo 3") -@@ -205,7 +206,10 @@ class FindmatchTest(unittest.TestCase): - ('"An audio fragment"', audio_basic_entry)), - ([c, "audio/*"], - {"filename": fname}, -- ("/usr/local/bin/showaudio audio/*", audio_entry)), -+ (None, None)), -+ ([c, "audio/wav"], -+ {"filename": fname}, -+ ("/usr/local/bin/showaudio audio/wav", audio_entry)), - ([c, "message/external-body"], - {"plist": plist}, - ("showexternal /dev/null default john python.org /tmp foo bar", message_entry)) -diff --git a/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst b/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst -new file mode 100644 -index 0000000000..da81a1f699 ---- /dev/null -+++ b/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst -@@ -0,0 +1,4 @@ -+The deprecated mailcap module now refuses to inject unsafe text (filenames, -+MIME types, parameters) into shell commands. Instead of using such text, it -+will warn and act as if a match was not found (or for test commands, as if -+the test failed). diff --git a/SPECS/python38.spec b/SPECS/python38.spec index e5da66e..4a885d2 100644 --- a/SPECS/python38.spec +++ b/SPECS/python38.spec @@ -13,7 +13,7 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.13 +%global general_version %{pybasever}.16 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} @@ -382,16 +382,6 @@ Patch359: 00359-CVE-2021-23336.patch # Upstream: https://bugs.python.org/issue46811 Patch378: 00378-support-expat-2-4-5.patch -# 00382 # -# CVE-2015-20107 -# -# Make mailcap refuse to match unsafe filenames/types/params (GH-91993) -# -# Upstream: https://github.com/python/cpython/issues/68966 -# -# Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390 -Patch382: 00382-cve-2015-20107.patch - # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -749,7 +739,6 @@ rm Lib/ensurepip/_bundled/*.whl %patch353 -p1 %patch359 -p1 %patch378 -p1 -%patch382 -p1 # Remove files that should be generated by the build # (This is after patching, so that we can use patches directly from upstream) @@ -1838,6 +1827,16 @@ fi # ====================================================== %changelog +* Tue Dec 13 2022 Charalampos Stratakis - 3.8.16-1 +- Update to 3.8.16 +- Security fix for CVE-2022-45061 +Resolves: rhbz#2144072 + +* Mon Sep 12 2022 Charalampos Stratakis - 3.8.14-1 +- Rebase to 3.8.14 +- Security fixes for CVE-2020-10735 and CVE-2021-28861 +Resolves: rhbz#1834423, rhbz#2120642 + * Tue Jun 14 2022 Charalampos Stratakis - 3.8.13-1 - Rebase to 3.8.13 - Security fix for CVE-2015-20107