From 8b93a0f296d2554ec85d0f45c95d79254f568068 Mon Sep 17 00:00:00 2001 From: John Eckersberg Date: Mon, 3 Feb 2014 11:31:46 -0500 Subject: [PATCH 1/8] Revert "%{?_isa} goes with the name, not the version" This reverts commit 0c86512e39831abebe9ecb7ad1a5da974a85f420. --- PyYAML.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/PyYAML.spec b/PyYAML.spec index 5b9f486..3d909e7 100644 --- a/PyYAML.spec +++ b/PyYAML.spec @@ -16,7 +16,7 @@ Source0: http://pyyaml.org/download/pyyaml/%{name}-%{version}.tar.gz BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX) BuildRequires: python-devel, python-setuptools, libyaml-devel Provides: python-yaml = %{version}-%{release} -Provides: python-yaml%{?_isa} = %{version}-%{release} +Provides: python-yaml = %{version}-%{release}%{?_isa} %if 0%{?with_python3} BuildRequires: python3-devel BuildRequires: python3-setuptools From 4e53c52640df3e2785f05210e54a7d2bf5dfb026 Mon Sep 17 00:00:00 2001 From: John Eckersberg Date: Mon, 3 Feb 2014 11:32:56 -0500 Subject: [PATCH 2/8] Revert "Add Provides for python-yaml (BZ#740390)" This reverts commit 927b2d9c90e03ed2582fa779c6b6ff30eb1cb182. --- PyYAML.spec | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/PyYAML.spec b/PyYAML.spec index 3d909e7..47d303e 100644 --- a/PyYAML.spec +++ b/PyYAML.spec @@ -6,7 +6,7 @@ Name: PyYAML Version: 3.10 -Release: 3%{?dist} +Release: 2%{?dist} Summary: YAML parser and emitter for Python Group: Development/Libraries @@ -15,8 +15,6 @@ URL: http://pyyaml.org/ Source0: http://pyyaml.org/download/pyyaml/%{name}-%{version}.tar.gz BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX) BuildRequires: python-devel, python-setuptools, libyaml-devel -Provides: python-yaml = %{version}-%{release} -Provides: python-yaml = %{version}-%{release}%{?_isa} %if 0%{?with_python3} BuildRequires: python3-devel BuildRequires: python3-setuptools @@ -104,9 +102,6 @@ rm -rf %{buildroot} %changelog -* Fri Apr 27 2012 John Eckersberg - 3.10-3 -- Add Provides for python-yaml (BZ#740390) - * Thu Jan 12 2012 Fedora Release Engineering - 3.10-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild From aeaf34ced4fdb18144da3a6076653614801e3411 Mon Sep 17 00:00:00 2001 From: John Eckersberg Date: Mon, 3 Feb 2014 11:32:58 -0500 Subject: [PATCH 3/8] Revert "- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild" This reverts commit 5f596a7ff267a375eabec0ed7dc29533c97cf3a1. --- PyYAML.spec | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/PyYAML.spec b/PyYAML.spec index 47d303e..dd00a8f 100644 --- a/PyYAML.spec +++ b/PyYAML.spec @@ -6,7 +6,7 @@ Name: PyYAML Version: 3.10 -Release: 2%{?dist} +Release: 1%{?dist} Summary: YAML parser and emitter for Python Group: Development/Libraries @@ -102,9 +102,6 @@ rm -rf %{buildroot} %changelog -* Thu Jan 12 2012 Fedora Release Engineering - 3.10-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - * Thu Jun 23 2011 John Eckersberg - 3.10-1 - New upstream release 3.10 From 21eb0e0249bc74ea0f81891bac9aff8876f872e6 Mon Sep 17 00:00:00 2001 From: John Eckersberg Date: Mon, 3 Feb 2014 11:32:59 -0500 Subject: [PATCH 4/8] Revert "New upstream release 3.10" This reverts commit 62723716a3c3034e86e5f37c0315f4ad2ef14878. --- .gitignore | 1 - PyYAML.spec | 7 ++----- sources | 1 - 3 files changed, 2 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index 324f00f..89555f4 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1 @@ PyYAML-3.09.tar.gz -/PyYAML-3.10.tar.gz diff --git a/PyYAML.spec b/PyYAML.spec index dd00a8f..f5e85a9 100644 --- a/PyYAML.spec +++ b/PyYAML.spec @@ -5,8 +5,8 @@ %endif Name: PyYAML -Version: 3.10 -Release: 1%{?dist} +Version: 3.09 +Release: 8%{?dist} Summary: YAML parser and emitter for Python Group: Development/Libraries @@ -102,9 +102,6 @@ rm -rf %{buildroot} %changelog -* Thu Jun 23 2011 John Eckersberg - 3.10-1 -- New upstream release 3.10 - * Mon Feb 07 2011 Fedora Release Engineering - 3.09-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild diff --git a/sources b/sources index 738a6e6..c484ace 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ f219af2361e87fdc5e85e95b84c11d87 PyYAML-3.09.tar.gz -74c94a383886519e9e7b3dd1ee540247 PyYAML-3.10.tar.gz From 879638bc9c665b33e0d1ccac956f25031358b84f Mon Sep 17 00:00:00 2001 From: John Eckersberg Date: Mon, 3 Feb 2014 13:31:10 -0500 Subject: [PATCH 5/8] Add check section and run test suite --- PyYAML.spec | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/PyYAML.spec b/PyYAML.spec index f5e85a9..d13cc0d 100644 --- a/PyYAML.spec +++ b/PyYAML.spec @@ -6,7 +6,7 @@ Name: PyYAML Version: 3.09 -Release: 8%{?dist} +Release: 9%{?dist} Summary: YAML parser and emitter for Python Group: Development/Libraries @@ -84,6 +84,16 @@ popd %endif +%check +%{__python} setup.py test + +%if 0%{?with_python3} +pushd %{py3dir} +%{__python3} setup.py test +popd +%endif + + %clean rm -rf %{buildroot} @@ -102,6 +112,9 @@ rm -rf %{buildroot} %changelog +* Mon Feb 3 2014 John Eckersberg - 3.09-9 +- Add check section and run test suite + * Mon Feb 07 2011 Fedora Release Engineering - 3.09-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild From 225bcf66fe04c9e1dc578b2b9cd8b41d7ac4335c Mon Sep 17 00:00:00 2001 From: John Eckersberg Date: Fri, 27 Apr 2012 14:04:52 -0400 Subject: [PATCH 6/8] Add Provides for python-yaml (BZ#740390) --- PyYAML.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/PyYAML.spec b/PyYAML.spec index d13cc0d..d59162f 100644 --- a/PyYAML.spec +++ b/PyYAML.spec @@ -6,7 +6,7 @@ Name: PyYAML Version: 3.09 -Release: 9%{?dist} +Release: 10%{?dist} Summary: YAML parser and emitter for Python Group: Development/Libraries @@ -15,6 +15,8 @@ URL: http://pyyaml.org/ Source0: http://pyyaml.org/download/pyyaml/%{name}-%{version}.tar.gz BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX) BuildRequires: python-devel, python-setuptools, libyaml-devel +Provides: python-yaml = %{version}-%{release} +Provides: python-yaml = %{version}-%{release}%{?_isa} %if 0%{?with_python3} BuildRequires: python3-devel BuildRequires: python3-setuptools @@ -112,6 +114,9 @@ rm -rf %{buildroot} %changelog +* Mon Feb 3 2014 John Eckersberg - 3.09-10 +- Add Provides for python-yaml (BZ#740390) + * Mon Feb 3 2014 John Eckersberg - 3.09-9 - Add check section and run test suite From bb316bff0fb541cb71512dc8631f60c923123657 Mon Sep 17 00:00:00 2001 From: John Eckersberg Date: Fri, 27 Apr 2012 14:38:38 -0400 Subject: [PATCH 7/8] %{?_isa} goes with the name, not the version --- PyYAML.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/PyYAML.spec b/PyYAML.spec index d59162f..57ab575 100644 --- a/PyYAML.spec +++ b/PyYAML.spec @@ -16,7 +16,7 @@ Source0: http://pyyaml.org/download/pyyaml/%{name}-%{version}.tar.gz BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX) BuildRequires: python-devel, python-setuptools, libyaml-devel Provides: python-yaml = %{version}-%{release} -Provides: python-yaml = %{version}-%{release}%{?_isa} +Provides: python-yaml%{?_isa} = %{version}-%{release} %if 0%{?with_python3} BuildRequires: python3-devel BuildRequires: python3-setuptools From 4ef1fd5366a96ddb1d21ccaa536a09317290b3c4 Mon Sep 17 00:00:00 2001 From: John Eckersberg Date: Mon, 23 Mar 2015 12:43:21 -0400 Subject: [PATCH 8/8] Add patch for CVE-2014-9130 (bug 1204829) --- PyYAML-CVE-2014-9130.patch | 35 +++++++++++++++++++++++++++++++++++ PyYAML.spec | 11 ++++++++++- 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 PyYAML-CVE-2014-9130.patch diff --git a/PyYAML-CVE-2014-9130.patch b/PyYAML-CVE-2014-9130.patch new file mode 100644 index 0000000..c47a9b5 --- /dev/null +++ b/PyYAML-CVE-2014-9130.patch @@ -0,0 +1,35 @@ +# HG changeset patch +# User Kirill Simonov +# Date 1417197216 21600 +# Node ID ddf211a41bb231c365fece5599b7e484e6dc33fc +# Parent 263dff6f9664ccdc532283ba5c7b282c0e436a7b +Removed invalid simple key assertion. + +diff --git a/lib/yaml/scanner.py b/lib/yaml/scanner.py +--- a/lib/yaml/scanner.py ++++ b/lib/yaml/scanner.py +@@ -297,10 +297,6 @@ + # Check if a simple key is required at the current position. + required = not self.flow_level and self.indent == self.column + +- # A simple key is required only if it is the first token in the current +- # line. Therefore it is always allowed. +- assert self.allow_simple_key or not required +- + # The next token might be a simple key. Let's save it's number and + # position. + if self.allow_simple_key: +diff --git a/lib3/yaml/scanner.py b/lib3/yaml/scanner.py +--- a/lib3/yaml/scanner.py ++++ b/lib3/yaml/scanner.py +@@ -297,10 +297,6 @@ + # Check if a simple key is required at the current position. + required = not self.flow_level and self.indent == self.column + +- # A simple key is required only if it is the first token in the current +- # line. Therefore it is always allowed. +- assert self.allow_simple_key or not required +- + # The next token might be a simple key. Let's save it's number and + # position. + if self.allow_simple_key: diff --git a/PyYAML.spec b/PyYAML.spec index 57ab575..1fa8a4d 100644 --- a/PyYAML.spec +++ b/PyYAML.spec @@ -6,7 +6,7 @@ Name: PyYAML Version: 3.09 -Release: 10%{?dist} +Release: 11%{?dist} Summary: YAML parser and emitter for Python Group: Development/Libraries @@ -22,6 +22,10 @@ BuildRequires: python3-devel BuildRequires: python3-setuptools %endif +# CVE-2014-9130 assert failure when processing wrapped strings +# https://bugzilla.redhat.com/show_bug.cgi?id=1204829 +Patch1: PyYAML-CVE-2014-9130.patch + %description YAML is a data serialization format designed for human readability and interaction with scripting languages. PyYAML is a YAML parser and @@ -64,6 +68,8 @@ rm -rf %{py3dir} cp -a . %{py3dir} %endif +%patch1 -p1 + %build CFLAGS="${RPM_OPT_FLAGS}" %{__python} setup.py --with-libyaml build @@ -114,6 +120,9 @@ rm -rf %{buildroot} %changelog +* Mon Mar 23 2015 John Eckersberg - 3.09-11 +- Add patch for CVE-2014-9130 (bug 1204829) + * Mon Feb 3 2014 John Eckersberg - 3.09-10 - Add Provides for python-yaml (BZ#740390)