CaROS/meta-openembedded
3
1
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-01-01 13:58:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

python-urllib3/python3-urllib3: fix CVE-2020-7212

Browse Source 
Optimize _encode_invalid_chars for a denial of service (CPU consumption)

CVE: CVE-2020-7212

Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Harpritkaur Bhandari <Harpritkaur.Bhandari@kpit.com>
[Add CVE: CVE-2020-7212 to the patch itself]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Haiqing Bai 2021-02-04 11:27:43 +05:30 committed by Armin Kuster
parent b1de50b2fc
commit 55f71e0a18
2 changed files with 57 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
meta-python/recipes-devtools/python/python3-urllib3/CVE-2020-7212.patch Normal file
View File

@ -0,0 +1,55 @@
From aff951b7a41eb5b958b32c49eaa00da02adc9c2d Mon Sep 17 00:00:00 2001
From: Quentin Pradet <quentin.pradet@gmail.com>
Date: Tue, 21 Jan 2020 22:32:56 +0400
Subject: [PATCH] Optimize _encode_invalid_chars (#1787)
Co-authored-by: Seth Michael Larson <sethmichaellarson@gmail.com>
Upstream-Status: Backport
[from git://github.com/urllib3/urllib3.git commit:a2697e7c6b]
CVE: CVE-2020-7212
Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>
---
src/urllib3/util/url.py | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/src/urllib3/util/url.py b/src/urllib3/util/url.py
index 9675f74..e353937 100644
--- a/src/urllib3/util/url.py
+++ b/src/urllib3/util/url.py
@@ -216,18 +216,15 @@ def _encode_invalid_chars(component, allowed_chars, encoding="utf-8"):
component = six.ensure_text(component)
+ # Normalize existing percent-encoded bytes.
# Try to see if the component we're encoding is already percent-encoded
# so we can skip all '%' characters but still encode all others.
- percent_encodings = PERCENT_RE.findall(component)
-
- # Normalize existing percent-encoded bytes.
- for enc in percent_encodings:
- if not enc.isupper():
- component = component.replace(enc, enc.upper())
+ component, percent_encodings = PERCENT_RE.subn(
+ lambda match: match.group(0).upper(), component
+ )
uri_bytes = component.encode("utf-8", "surrogatepass")
- is_percent_encoded = len(percent_encodings) == uri_bytes.count(b"%")
-
+ is_percent_encoded = percent_encodings == uri_bytes.count(b"%")
encoded_component = bytearray()
for i in range(0, len(uri_bytes)):
@@ -237,7 +234,7 @@ def _encode_invalid_chars(component, allowed_chars, encoding="utf-8"):
if (is_percent_encoded and byte == b"%") or (
byte_ord < 128 and byte.decode() in allowed_chars
):
- encoded_component.extend(byte)
+ encoded_component += byte
continue
encoded_component.extend(b"%" + (hex(byte_ord)[2:].encode().zfill(2).upper()))
--
2.23.0

2
meta-python/recipes-devtools/python/python3-urllib3_1.25.7.bb
View File

@ -8,6 +8,8 @@ SRC_URI[sha256sum] = "f3c5fd51747d450d4dcf6f923c81f78f811aab8205fda64b0aba34a4e4
inherit pypi setuptools3
SRC_URI += "file://CVE-2020-7212.patch"
RDEPENDS_${PN} += "\
${PYTHON_PN}-certifi \
${PYTHON_PN}-cryptography \