diff --git a/CVE-2023-5752.patch b/CVE-2023-5752.patch new file mode 100644 index 0000000..c2199da --- /dev/null +++ b/CVE-2023-5752.patch @@ -0,0 +1,115 @@ +From 018b129371db152450cbf1ac7bff401707de94ef Mon Sep 17 00:00:00 2001 +From: Pradyun Gedam +Date: Sun, 1 Oct 2023 14:10:25 +0100 +Subject: [PATCH 1/3] Use `-r=...` instead of `-r ...` for hg + +This ensures that the resulting revision can not be misinterpreted as an +option. +--- + src/pip/_internal/vcs/mercurial.py | 2 +- + tests/unit/test_vcs.py | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/pip/_internal/vcs/mercurial.py b/src/pip/_internal/vcs/mercurial.py +index 4595960..e440c12 100644 +--- a/src/pip/_internal/vcs/mercurial.py ++++ b/src/pip/_internal/vcs/mercurial.py +@@ -31,7 +31,7 @@ class Mercurial(VersionControl): + + @staticmethod + def get_base_rev_args(rev: str) -> List[str]: +- return ["-r", rev] ++ return [f"-r={rev}"] + + def fetch_new( + self, dest: str, url: HiddenText, rev_options: RevOptions, verbosity: int +diff --git a/tests/unit/test_vcs.py b/tests/unit/test_vcs.py +index 38daaa0..9afd022 100644 +--- a/tests/unit/test_vcs.py ++++ b/tests/unit/test_vcs.py +@@ -66,7 +66,7 @@ def test_rev_options_repr() -> None: + # First check VCS-specific RevOptions behavior. + (Bazaar, [], ["-r", "123"], {}), + (Git, ["HEAD"], ["123"], {}), +- (Mercurial, [], ["-r", "123"], {}), ++ (Mercurial, [], ["-r=123"], {}), + (Subversion, [], ["-r", "123"], {}), + # Test extra_args. For this, test using a single VersionControl class. + ( +-- +2.44.0 + + +From d5bbf9df3672bc5c4ed4cfddcbf05e9286324443 Mon Sep 17 00:00:00 2001 +From: Pradyun Gedam +Date: Sun, 1 Oct 2023 13:49:06 +0100 +Subject: [PATCH 2/3] newspaper: + +--- + news/12306.bugfix.rst | 1 + + 1 file changed, 1 insertion(+) + create mode 100644 news/12306.bugfix.rst + +diff --git a/news/12306.bugfix.rst b/news/12306.bugfix.rst +new file mode 100644 +index 0000000..eb6eeca +--- /dev/null ++++ b/news/12306.bugfix.rst +@@ -0,0 +1 @@ ++Use ``-r=...`` instead of ``-r ...`` to specify references with Mercurial. +-- +2.44.0 + + +From 27c8f2a8cdaf4580e2b0f3010ebaf0471ccd5197 Mon Sep 17 00:00:00 2001 +From: efflamlemaillet <6533295+efflamlemaillet@users.noreply.github.com> +Date: Fri, 27 Oct 2023 11:08:17 +0200 +Subject: [PATCH 3/3] Fix hg: "parse error at 0: not a prefix:" (#12373) + +Use two hypen argument `--rev=` instead of `-r=` + +Co-authored-by: Efflam Lemaillet +Co-authored-by: Pradyun Gedam +--- + news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst | 1 + + src/pip/_internal/vcs/mercurial.py | 2 +- + tests/unit/test_vcs.py | 2 +- + 3 files changed, 3 insertions(+), 2 deletions(-) + create mode 100644 news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst + +diff --git a/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst b/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst +new file mode 100644 +index 0000000..76a8e6b +--- /dev/null ++++ b/news/370392cf-52cd-402c-b402-06d2ff398f89.bugfix.rst +@@ -0,0 +1 @@ ++Fix mercurial revision "parse error": use ``--rev={ref}`` instead of ``-r={ref}`` +diff --git a/src/pip/_internal/vcs/mercurial.py b/src/pip/_internal/vcs/mercurial.py +index e440c12..c183d41 100644 +--- a/src/pip/_internal/vcs/mercurial.py ++++ b/src/pip/_internal/vcs/mercurial.py +@@ -31,7 +31,7 @@ class Mercurial(VersionControl): + + @staticmethod + def get_base_rev_args(rev: str) -> List[str]: +- return [f"-r={rev}"] ++ return [f"--rev={rev}"] + + def fetch_new( + self, dest: str, url: HiddenText, rev_options: RevOptions, verbosity: int +diff --git a/tests/unit/test_vcs.py b/tests/unit/test_vcs.py +index 9afd022..8512357 100644 +--- a/tests/unit/test_vcs.py ++++ b/tests/unit/test_vcs.py +@@ -66,7 +66,7 @@ def test_rev_options_repr() -> None: + # First check VCS-specific RevOptions behavior. + (Bazaar, [], ["-r", "123"], {}), + (Git, ["HEAD"], ["123"], {}), +- (Mercurial, [], ["-r=123"], {}), ++ (Mercurial, [], ["--rev=123"], {}), + (Subversion, [], ["-r", "123"], {}), + # Test extra_args. For this, test using a single VersionControl class. + ( +-- +2.44.0 + diff --git a/python-pip.spec b/python-pip.spec index fb0e399..3e1e867 100644 --- a/python-pip.spec +++ b/python-pip.spec @@ -14,7 +14,7 @@ Name: python-%{srcname} Version: %{base_version}%{?prerel:~%{prerel}} -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for installing and managing Python packages # We bundle a lot of libraries with pip, which itself is under MIT license. @@ -83,6 +83,13 @@ Patch: nowarn-pip._internal.main.patch # Upstream issue: https://github.com/pypa/packaging/issues/368 Patch: no-version-warning.patch +# Security fix for CVE-2023-5752: +# Mercurial configuration injectable in repo revision when installing via pip +# Resolved upstream: +# https://github.com/pypa/pip/commit/1082eb12622b20d101d2864111dd9a591dd6c2f5 +# https://github.com/pypa/pip/commit/6dbd9c68f085c5bf304247bf7c7933842092efb2 +Patch: CVE-2023-5752.patch + %description pip is a package management system used to install and manage software packages written in Python. Many packages can be found in the Python Package Index @@ -361,6 +368,10 @@ pytest_k='not completion' %{python_wheel_dir}/%{python_wheel_name} %changelog +* Wed Apr 17 2024 Charalampos Stratakis - 23.2.1-2 +- Security fix for CVE-2023-5752 +Resolves: rhbz#2263291 + * Fri Aug 04 2023 Miro Hrončok - 23.2.1-1 - Update to 23.2.1 Resolves: rhbz#2223082