Remove the pydoc getfile feature CVE-2021-3426: Remove the "getfile" feature of the pydoc module which could be abused to read arbitrary files on the disk (directory traversal vulnerability). Moreover, even source code of Python modules can contain sensitive data like passwords. Vulnerability reported by David Schwörer.
reference: https://nvd.nist.gov/vuln/detail/CVE-2021-3426 https://github.com/python/cpython/pull/25015/commits/dc9580949cc82c51022a882ba43dad937ff929a8 --- .../python/python3/CVE-2021-3426.patch | 105 ++++++++++++++++++ meta/recipes-devtools/python/python3_3.8.2.bb | 1 + 2 files changed, 106 insertions(+) create mode 100644 meta/recipes-devtools/python/python3/CVE-2021-3426.patch diff --git a/meta/recipes-devtools/python/python3/CVE-2021-3426.patch b/meta/recipes-devtools/python/python3/CVE-2021-3426.patch new file mode 100644 index 0000000000..68bd7d9296 --- /dev/null +++ b/meta/recipes-devtools/python/python3/CVE-2021-3426.patch @@ -0,0 +1,105 @@ +From 9b999479c0022edfc9835a8a1f06e046f3881048 Mon Sep 17 00:00:00 2001 +From: Victor Stinner <vstin...@python.org> +Date: Mon, 29 Mar 2021 14:40:40 +0200 +Subject: [PATCH] bpo-42988: Remove the pydoc getfile feature (GH-25015) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +CVE-2021-3426: Remove the "getfile" feature of the pydoc module which +could be abused to read arbitrary files on the disk (directory +traversal vulnerability). Moreover, even source code of Python +modules can contain sensitive data like passwords. Vulnerability +reported by David Schwörer. + +Upstream-Status: Acepted +[https://github.com/python/cpython/pull/25015/commits/dc9580949cc82c51022a882ba43dad937ff929a8] +CVE: CVE-2021-3426 +Signed-off-by: Minjae Kim <flower...@gmail.com> + +--- + Lib/pydoc.py | 18 ------------------ + Lib/test/test_pydoc.py | 6 ------ + .../2021-03-24-14-16-56.bpo-42988.P2aNco.rst | 4 ++++ + 3 files changed, 4 insertions(+), 24 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2021-03-24-14-16-56.bpo-42988.P2aNco.rst + +diff --git a/Lib/pydoc.py b/Lib/pydoc.py +index 282a917998..753ea97ba0 100755 +--- a/Lib/pydoc.py ++++ b/Lib/pydoc.py +@@ -2456,9 +2456,6 @@ def page(self, title, contents): + %s</head><body bgcolor="#f0f0f8">%s<div style="clear:both;padding-top:.5em;">%s</div> + </body></html>''' % (title, css_link, html_navbar(), contents) + +- def filelink(self, url, path): +- return '<a href="getfile?key=%s">%s</a>' % (url, path) +- + + html = _HTMLDoc() + +@@ -2544,19 +2541,6 @@ def bltinlink(name): + 'key = %s' % key, '#ffffff', '#ee77aa', '<br>'.join(results)) + return 'Search Results', contents + +- def html_getfile(path): +- """Get and display a source file listing safely.""" +- path = urllib.parse.unquote(path) +- with tokenize.open(path) as fp: +- lines = html.escape(fp.read()) +- body = '<pre>%s</pre>' % lines +- heading = html.heading( +- '<big><big><strong>File Listing</strong></big></big>', +- '#ffffff', '#7799ee') +- contents = heading + html.bigsection( +- 'File: %s' % path, '#ffffff', '#ee77aa', body) +- return 'getfile %s' % path, contents +- + def html_topics(): + """Index of topic texts available.""" + +@@ -2648,8 +2632,6 @@ def get_html_page(url): + op, _, url = url.partition('=') + if op == "search?key": + title, content = html_search(url) +- elif op == "getfile?key": +- title, content = html_getfile(url) + elif op == "topic?key": + # try topics first, then objects. + try: +diff --git a/Lib/test/test_pydoc.py b/Lib/test/test_pydoc.py +index 2f502627f4..3bc0e9e6b5 100644 +--- a/Lib/test/test_pydoc.py ++++ b/Lib/test/test_pydoc.py +@@ -1374,18 +1374,12 @@ def test_url_requests(self): + ("topic?key=def", "Pydoc: KEYWORD def"), + ("topic?key=STRINGS", "Pydoc: TOPIC STRINGS"), + ("foobar", "Pydoc: Error - foobar"), +- ("getfile?key=foobar", "Pydoc: Error - getfile?key=foobar"), + ] + + with self.restrict_walk_packages(): + for url, title in requests: + self.call_url_handler(url, title) + +- path = string.__file__ +- title = "Pydoc: getfile " + path +- url = "getfile?key=" + path +- self.call_url_handler(url, title) +- + + class TestHelper(unittest.TestCase): + def test_keywords(self): +diff --git a/Misc/NEWS.d/next/Security/2021-03-24-14-16-56.bpo-42988.P2aNco.rst b/Misc/NEWS.d/next/Security/2021-03-24-14-16-56.bpo-42988.P2aNco.rst +new file mode 100644 +index 0000000000..4b42dd0530 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2021-03-24-14-16-56.bpo-42988.P2aNco.rst +@@ -0,0 +1,4 @@ ++CVE-2021-3426: Remove the ``getfile`` feature of the :mod:`pydoc` module which ++could be abused to read arbitrary files on the disk (directory traversal ++vulnerability). Moreover, even source code of Python modules can contain ++sensitive data like passwords. Vulnerability reported by David Schwörer. +-- +2.17.1 + diff --git a/meta/recipes-devtools/python/python3_3.8.2.bb b/meta/recipes-devtools/python/python3_3.8.2.bb index 072ce97472..cbeb599705 100644 --- a/meta/recipes-devtools/python/python3_3.8.2.bb +++ b/meta/recipes-devtools/python/python3_3.8.2.bb @@ -39,6 +39,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ file://CVE-2020-26116.patch \ file://CVE-2020-27619.patch \ file://CVE-2021-3177.patch \ + file://CVE-2021-3426.patch \ " SRC_URI_append_class-native = " \ -- 2.24.3 (Apple Git-128)
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#153135): https://lists.openembedded.org/g/openembedded-core/message/153135 Mute This Topic: https://lists.openembedded.org/mt/83690251/21656 Group Owner: openembedded-core+ow...@lists.openembedded.org Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
