From 1bb7fee2bbb30a6f62c9652dc692248fddfff865 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Thu, 1 Aug 2024 18:59:48 +0200 Subject: [PATCH] Security fix for CVE-2024-6345 (in bundled setuptools wheel) --- python3.6.spec | 18 +++++++- setuptools-CVE-2024-6345.patch | 83 ++++++++++++++++++++++++++++++++++ 2 files changed, 100 insertions(+), 1 deletion(-) create mode 100644 setuptools-CVE-2024-6345.patch diff --git a/python3.6.spec b/python3.6.spec index 346dc7c..99e92c6 100644 --- a/python3.6.spec +++ b/python3.6.spec @@ -17,7 +17,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 29%{?dist} +Release: 34%{?dist} # Python is Python # pip MIT is and bundles: # appdirs: MIT @@ -324,6 +324,13 @@ Source11: idle3.appdata.xml # Patch for the bundled pip wheel for CVE-2007-4559 Source101: pip-CVE-2007-4559.patch +# Patch for the bundled setuptools wheel for CVE-2024-6345 +# Remote code execution via download functions in the package_index module +# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=2297771 +# Upstream solution: https://github.com/pypa/setuptools/pull/4332 +# Patch simplified because upstream doesn't support SVN anymore. +Source102: setuptools-CVE-2024-6345.patch + # (Patches taken from github.com/fedora-python/cpython) # 00001 # d06a8853cf4bae9e115f45e1d531d2dc152c5cc8 @@ -1057,6 +1064,12 @@ unzip -qq Lib/ensurepip/_bundled/pip-%{pip_version}-py2.py3-none-any.whl patch -p1 < %{SOURCE101} zip -rq Lib/ensurepip/_bundled/pip-%{pip_version}-py2.py3-none-any.whl pip pip-%{pip_version}.dist-info rm -rf pip/ pip-%{pip_version}.dist-info/ + +# Patch the bundled setuptools wheel for CVE-2024-6345 +unzip -qq Lib/ensurepip/_bundled/setuptools-%{setuptools_version}-py2.py3-none-any.whl +patch -p1 < %{SOURCE102} +zip -rq Lib/ensurepip/_bundled/setuptools-%{setuptools_version}-py2.py3-none-any.whl easy_install.py pkg_resources setuptools setuptools-%{setuptools_version}.dist-info +rm -rf easy_install.py pkg_resources/ setuptools/ setuptools-%{setuptools_version}.dist-info/ %endif # Apply the remaining patches @@ -1971,6 +1984,9 @@ CheckPython optimized # ====================================================== %changelog +* Thu Aug 01 2024 Miro Hrončok - 3.6.15-34 +- Security fix for CVE-2024-6345 (in bundled setuptools wheel) + * Tue Jul 02 2024 Lumír Balhar - 3.6.15-29 - Security fix for CVE-2024-4032 (rhbz#2293394) diff --git a/setuptools-CVE-2024-6345.patch b/setuptools-CVE-2024-6345.patch new file mode 100644 index 0000000..54a856e --- /dev/null +++ b/setuptools-CVE-2024-6345.patch @@ -0,0 +1,83 @@ +From 8af1b3e03edc8a38565558aff3bf1689c1ca3545 Mon Sep 17 00:00:00 2001 +From: Lumir Balhar +Date: Fri, 26 Jul 2024 13:49:11 +0200 +Subject: [PATCH] CVE-2024-6345 + +--- + setuptools/package_index.py | 23 +++++++++-------------- + 1 file changed, 9 insertions(+), 14 deletions(-) + +diff --git a/setuptools/package_index.py b/setuptools/package_index.py +index bdcf4a6..1d3e5b4 100755 +--- a/setuptools/package_index.py ++++ b/setuptools/package_index.py +@@ -1,4 +1,5 @@ + """PyPI and direct package downloading""" ++import subprocess + import sys + import os + import re +@@ -848,7 +849,7 @@ class PackageIndex(Environment): + + def _download_svn(self, url, filename): + url = url.split('#', 1)[0] # remove any fragment for svn's sake +- creds = '' ++ creds = [] + if url.lower().startswith('svn:') and '@' in url: + scheme, netloc, path, p, q, f = urllib.parse.urlparse(url) + if not netloc and path.startswith('//') and '/' in path[2:]: +@@ -857,14 +858,14 @@ class PackageIndex(Environment): + if auth: + if ':' in auth: + user, pw = auth.split(':', 1) +- creds = " --username=%s --password=%s" % (user, pw) ++ creds = ["--username=" + user, "--password=" + pw] + else: +- creds = " --username=" + auth ++ creds = ["--username=" + auth] + netloc = host + parts = scheme, netloc, url, p, q, f + url = urllib.parse.urlunparse(parts) + self.info("Doing subversion checkout from %s to %s", url, filename) +- os.system("svn checkout%s -q %s %s" % (creds, url, filename)) ++ subprocess.check_call(["svn", "checkout"] + creds + ["-q", url, filename]) + return filename + + @staticmethod +@@ -890,14 +891,11 @@ class PackageIndex(Environment): + url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True) + + self.info("Doing git clone from %s to %s", url, filename) +- os.system("git clone --quiet %s %s" % (url, filename)) ++ subprocess.check_call(["git", "clone", "--quiet", url, filename]) + + if rev is not None: + self.info("Checking out %s", rev) +- os.system("(cd %s && git checkout --quiet %s)" % ( +- filename, +- rev, +- )) ++ subprocess.check_call(["git", "-C", filename, "checkout", "--quiet", rev]) + + return filename + +@@ -906,14 +904,11 @@ class PackageIndex(Environment): + url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True) + + self.info("Doing hg clone from %s to %s", url, filename) +- os.system("hg clone --quiet %s %s" % (url, filename)) ++ subprocess.check_call(["hg", "clone", "--quiet", url, filename]) + + if rev is not None: + self.info("Updating to %s", rev) +- os.system("(cd %s && hg up -C -r %s -q)" % ( +- filename, +- rev, +- )) ++ subprocess.check_call(["hg", "--cwd", filename, "up", "-C", "-r", rev, "-q"]) + + return filename + +-- +2.45.2 +