mirror of
https://git.yoctoproject.org/git/poky
synced 2026-01-01 13:58:04 +00:00
d5fa84385a
Requests is a HTTP library. Due to a URL parsing issue, Requests
releases prior to 2.32.4 may leak .netrc credentials to third parties
for specific maliciously-crafted URLs. Users should upgrade to version
2.32.4 to receive a fix. For older versions of Requests, use of the
.netrc file can be disabled with `trust_env=False` on one's Requests
Session.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-47081
Upstream patch:
96ba401c12
(From OE-Core rev: 37d746033710509ffabc244e0130d20fd81d9673)
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
38 lines
1.1 KiB
Diff
38 lines
1.1 KiB
Diff
From c664b4415baf1b237a8d74f5e880179e69ee764c Mon Sep 17 00:00:00 2001
|
|
From: Nate Prewitt <nate.prewitt@gmail.com>
|
|
Date: Wed, 25 Sep 2024 08:03:20 -0700
|
|
Subject: [PATCH] Only use hostname to do netrc lookup instead of netloc
|
|
|
|
CVE: CVE-2024-47081
|
|
|
|
Upstream-Status: Backport
|
|
[https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef]
|
|
|
|
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
|
|
---
|
|
requests/utils.py | 8 +-------
|
|
1 file changed, 1 insertion(+), 7 deletions(-)
|
|
|
|
diff --git a/requests/utils.py b/requests/utils.py
|
|
index 153776c7..eae72959 100644
|
|
--- a/requests/utils.py
|
|
+++ b/requests/utils.py
|
|
@@ -208,13 +208,7 @@ def get_netrc_auth(url, raise_errors=False):
|
|
return
|
|
|
|
ri = urlparse(url)
|
|
-
|
|
- # Strip port numbers from netloc. This weird `if...encode`` dance is
|
|
- # used for Python 3.2, which doesn't support unicode literals.
|
|
- splitstr = b':'
|
|
- if isinstance(url, str):
|
|
- splitstr = splitstr.decode('ascii')
|
|
- host = ri.netloc.split(splitstr)[0]
|
|
+ host = ri.hostname
|
|
|
|
try:
|
|
_netrc = netrc(netrc_path).authenticators(host)
|
|
--
|
|
2.34.1
|
|
|