Details: https://nvd.nist.gov/vuln/detail/CVE-2021-29063
Pick the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <[email protected]> --- .../python3-mpmath/CVE-2021-29063.patch | 51 +++++++++++++++++++ .../python/python3-mpmath_1.2.1.bb | 1 + 2 files changed, 52 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-mpmath/CVE-2021-29063.patch diff --git a/meta-python/recipes-devtools/python/python3-mpmath/CVE-2021-29063.patch b/meta-python/recipes-devtools/python/python3-mpmath/CVE-2021-29063.patch new file mode 100644 index 0000000000..3674a32ea1 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-mpmath/CVE-2021-29063.patch @@ -0,0 +1,51 @@ +From 2e196ba7e41a46b8cafa5971e559ca55171414dc Mon Sep 17 00:00:00 2001 +From: Vinzent Steinberg <[email protected]> +Date: Wed, 10 Feb 2021 16:45:04 +0100 +Subject: [PATCH] Fix ReDOS vulnerability + +Fixes #548, with the workaround suggested by @yetingli. + +CVE: CVE-2021-29063 +Upstream-Status: Backport [https://github.com/mpmath/mpmath/commit/46d44c3c8f3244017fe1eb102d564eb4ab8ef750] +Signed-off-by: Gyorgy Sarvari <[email protected]> +--- + mpmath/ctx_mp.py | 4 ++-- + mpmath/tests/test_convert.py | 10 ++++++++++ + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/mpmath/ctx_mp.py b/mpmath/ctx_mp.py +index 39fc941..93594dd 100644 +--- a/mpmath/ctx_mp.py ++++ b/mpmath/ctx_mp.py +@@ -42,8 +42,8 @@ + + new = object.__new__ + +-get_complex = re.compile(r'^\(?(?P<re>[\+\-]?\d*\.?\d*(e[\+\-]?\d+)?)??' +- r'(?P<im>[\+\-]?\d*\.?\d*(e[\+\-]?\d+)?j)?\)?$') ++get_complex = re.compile(r'^\(?(?P<re>[\+\-]?\d*(\.\d*)?(e[\+\-]?\d+)?)??' ++ r'(?P<im>[\+\-]?\d*(\.\d*)?(e[\+\-]?\d+)?j)?\)?$') + + if BACKEND == 'sage': + from sage.libs.mpmath.ext_main import Context as BaseMPContext +diff --git a/mpmath/tests/test_convert.py b/mpmath/tests/test_convert.py +index 3e2f555..cf1a91d 100644 +--- a/mpmath/tests/test_convert.py ++++ b/mpmath/tests/test_convert.py +@@ -194,6 +194,16 @@ def test_mpmathify(): + assert mpmathify('(1.2e-10 - 3.4e5j)') == mpc('1.2e-10', '-3.4e5') + assert mpmathify('1j') == mpc(1j) + ++def test_issue548(): ++ try: ++ # This expression is invalid, but may trigger the ReDOS vulnerability ++ # in the regular expression. ++ mpmathify('(' + '1' * 5000 + '!j') ++ except: ++ return ++ # The expression is invalid and should raise an exception. ++ assert False ++ + def test_compatibility(): + try: + import numpy as np diff --git a/meta-python/recipes-devtools/python/python3-mpmath_1.2.1.bb b/meta-python/recipes-devtools/python/python3-mpmath_1.2.1.bb index 3337df4903..bf883e0e9f 100644 --- a/meta-python/recipes-devtools/python/python3-mpmath_1.2.1.bb +++ b/meta-python/recipes-devtools/python/python3-mpmath_1.2.1.bb @@ -6,6 +6,7 @@ HOMEPAGE = "https://pypi.org/project/mpmath/"; LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=71970bd3749eebe1bfef9f1efff5b37a" +SRC_URI += "file://CVE-2021-29063.patch" SRC_URI[sha256sum] = "79ffb45cf9f4b101a807595bcb3e72e0396202e0b1d25d689134b48c4216a81a" inherit pypi setuptools3
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#123167): https://lists.openembedded.org/g/openembedded-devel/message/123167 Mute This Topic: https://lists.openembedded.org/mt/117101980/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
