Skip to content

Commit ad67d53

Browse files
[AUTO-CHERRYPICK] Patch python3 for multiple CVEs in pip bundled wheel [High] - branch main (#13411)
Co-authored-by: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com>
1 parent 09cf8ee commit ad67d53

8 files changed

Lines changed: 160 additions & 27 deletions

File tree

SPECS/python3/CVE-2023-43804.patch

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
From 76d52df7fe49be31a47503a8f77c4b172809fc9b Mon Sep 17 00:00:00 2001
2+
From: Ankita Pareek <ankitapareek@microsoft.com>
3+
Date: Fri, 11 Apr 2025 19:08:28 +0530
4+
Subject: [PATCH] python3: Address CVE-2023-43804 with a patch
5+
6+
Upstream reference: https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d
7+
8+
Signed-off-by: Ankita Pareek <ankitapareek@microsoft.com>
9+
---
10+
_vendor/urllib3/util/retry.py | 2 +-
11+
1 file changed, 1 insertion(+), 1 deletion(-)
12+
13+
diff --git a/pip/_vendor/urllib3/util/retry.py b/pip/_vendor/urllib3/util/retry.py
14+
index 2490d5e..4bc4fb0 100644
15+
--- a/pip/_vendor/urllib3/util/retry.py
16+
+++ b/pip/_vendor/urllib3/util/retry.py
17+
@@ -235,7 +235,7 @@ class Retry(object):
18+
RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503])
19+
20+
#: Default headers to be used for ``remove_headers_on_redirect``
21+
- DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Authorization"])
22+
+ DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Cookie","Authorization"])
23+
24+
#: Maximum backoff time.
25+
DEFAULT_BACKOFF_MAX = 120
26+
--
27+
2.34.1
28+

SPECS/python3/CVE-2024-3651.patch

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
From 9ffbb563891dc0826707dcf9124023b1d9372967 Mon Sep 17 00:00:00 2001
2+
From: Ankita Pareek <ankitapareek@microsoft.com>
3+
Date: Fri, 11 Apr 2025 14:34:28 +0530
4+
Subject: [PATCH] python3: Address CVE-2024-3651
5+
6+
Upstream patch reference: https://github.com/kjd/idna/commit/5beb28b9dd77912c0dd656d8b0fdba3eb80222e7
7+
8+
Signed-off-by: Ankita Pareek <ankitapareek@microsoft.com>
9+
---
10+
_vendor/idna/core.py | 16 ++++++++--------
11+
1 file changed, 8 insertions(+), 8 deletions(-)
12+
13+
diff --git a/pip/_vendor/idna/core.py b/pip/_vendor/idna/core.py
14+
index 4f30037..aea17ac 100644
15+
--- a/pip/_vendor/idna/core.py
16+
+++ b/pip/_vendor/idna/core.py
17+
@@ -150,9 +150,11 @@ def valid_contextj(label: str, pos: int) -> bool:
18+
joining_type = idnadata.joining_types.get(ord(label[i]))
19+
if joining_type == ord('T'):
20+
continue
21+
- if joining_type in [ord('L'), ord('D')]:
22+
+ elif joining_type in [ord('L'), ord('D')]:
23+
ok = True
24+
break
25+
+ else:
26+
+ break
27+
28+
if not ok:
29+
return False
30+
@@ -162,9 +164,11 @@ def valid_contextj(label: str, pos: int) -> bool:
31+
joining_type = idnadata.joining_types.get(ord(label[i]))
32+
if joining_type == ord('T'):
33+
continue
34+
- if joining_type in [ord('R'), ord('D')]:
35+
+ elif joining_type in [ord('R'), ord('D')]:
36+
ok = True
37+
break
38+
+ else:
39+
+ break
40+
return ok
41+
42+
if cp_value == 0x200d:
43+
@@ -236,12 +240,8 @@ def check_label(label: Union[str, bytes, bytearray]) -> None:
44+
if intranges_contain(cp_value, idnadata.codepoint_classes['PVALID']):
45+
continue
46+
elif intranges_contain(cp_value, idnadata.codepoint_classes['CONTEXTJ']):
47+
- try:
48+
- if not valid_contextj(label, pos):
49+
- raise InvalidCodepointContext('Joiner {} not allowed at position {} in {}'.format(
50+
- _unot(cp_value), pos+1, repr(label)))
51+
- except ValueError:
52+
- raise IDNAError('Unknown codepoint adjacent to joiner {} at position {} in {}'.format(
53+
+ if not valid_contextj(label, pos):
54+
+ raise InvalidCodepointContext('Joiner {} not allowed at position {} in {}'.format(
55+
_unot(cp_value), pos+1, repr(label)))
56+
elif intranges_contain(cp_value, idnadata.codepoint_classes['CONTEXTO']):
57+
if not valid_contexto(label, pos):
58+
--
59+
2.34.1
60+

SPECS/python3/CVE-2024-37891.patch

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
From b512887b5421844c0e4589e36241da5656b65d1b Mon Sep 17 00:00:00 2001
2+
From: Ankita Pareek <ankitapareek@microsoft.com>
3+
Date: Fri, 11 Apr 2025 19:14:27 +0530
4+
Subject: [PATCH] python3: Address CVE-2024-37891 with a patch
5+
6+
Upstream reference: https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d
7+
8+
Signed-off-by: Ankita Pareek <ankitapareek@microsoft.com>
9+
---
10+
_vendor/urllib3/util/retry.py | 4 +++-
11+
1 file changed, 3 insertions(+), 1 deletion(-)
12+
13+
diff --git a/pip/_vendor/urllib3/util/retry.py b/pip/_vendor/urllib3/util/retry.py
14+
index 4bc4fb0..392553b 100644
15+
--- a/pip/_vendor/urllib3/util/retry.py
16+
+++ b/pip/_vendor/urllib3/util/retry.py
17+
@@ -235,7 +235,9 @@ class Retry(object):
18+
RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503])
19+
20+
#: Default headers to be used for ``remove_headers_on_redirect``
21+
- DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Cookie","Authorization"])
22+
+ DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(
23+
+ ["Cookie","Authorization", "Proxy-Authorization"]
24+
+ )
25+
26+
#: Maximum backoff time.
27+
DEFAULT_BACKOFF_MAX = 120
28+
--
29+
2.34.1
30+

SPECS/python3/python3.spec

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
Summary: A high-level scripting language
1313
Name: python3
1414
Version: 3.9.19
15-
Release: 12%{?dist}
15+
Release: 13%{?dist}
1616
License: PSF
1717
Vendor: Microsoft Corporation
1818
Distribution: Mariner
@@ -36,6 +36,9 @@ Patch12: CVE-2025-1795.patch
3636
# Patch for setuptools, resolved in 65.5.1
3737
Patch1000: CVE-2022-40897.patch
3838
Patch1001: CVE-2024-6345.patch
39+
Patch1002: CVE-2024-3651.patch
40+
Patch1003: CVE-2023-43804.patch
41+
Patch1004: CVE-2024-37891.patch
3942

4043
BuildRequires: bzip2-devel
4144
BuildRequires: expat-devel >= 2.1.0
@@ -238,6 +241,15 @@ patch %{buildroot}%{_libdir}/python%{majmin}/site-packages/setuptools/package_in
238241
echo 'Patching CVE-2024-6345 in bundled wheel file %{_libdir}/python%{majmin}/site-packages/setuptools/package_index.py'
239242
patch -p1 %{buildroot}%{_libdir}/python%{majmin}/site-packages/setuptools/package_index.py < %{PATCH1001}
240243

244+
# Manually patch CVE-2024-3651 which is a bundled wheel for pip. We can only update the source code after install
245+
echo 'Patching CVE-2024-3651 in bundled wheel file %{_libdir}/python%{majmin}/site-packages/pip/_vendor/idna/core.py'
246+
patch -p1 %{buildroot}%{_libdir}/python%{majmin}/site-packages/pip/_vendor/idna/core.py < %{PATCH1002}
247+
echo 'Patching CVE-2023-43804 in bundled wheel file %{_libdir}/python%{majmin}/site-packages/pip/_vendor/urllib3/util/retry.py'
248+
patch -p1 %{buildroot}%{_libdir}/python%{majmin}/site-packages/pip/_vendor/urllib3/util/retry.py < %{PATCH1003}
249+
echo 'Patching CVE-2024-37891 in bundled wheel file %{_libdir}/python%{majmin}/site-packages/pip/_vendor/urllib3/util/retry.py'
250+
patch -p1 %{buildroot}%{_libdir}/python%{majmin}/site-packages/pip/_vendor/urllib3/util/retry.py < %{PATCH1004}
251+
252+
241253
# Windows executables get installed by pip and setuptools- we don't need these.
242254
find %{buildroot}%{_libdir}/python%{majmin}/site-packages -name '*.exe' -delete -print
243255

@@ -338,6 +350,9 @@ rm -rf %{buildroot}%{_bindir}/__pycache__
338350
%{_libdir}/python%{majmin}/test/*
339351

340352
%changelog
353+
* Fri Apr 11 2025 Ankita Pareek <ankitapareek@microsoft.com> - 3.9.19-13
354+
- Add patch for CVE-2024-3651, CVE-2023-43804 and CVE-2024-37891 in the bundled pip wheel
355+
341356
* Fri Mar 07 2025 Sreeniavsulu Malavathula <v-smalavathu@microsoft.com> - 3.9.19-12
342357
- Add patch for CVE-2025-1795
343358

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -237,10 +237,10 @@ ca-certificates-base-2.0.0-19.cm2.noarch.rpm
237237
ca-certificates-2.0.0-19.cm2.noarch.rpm
238238
dwz-0.14-2.cm2.aarch64.rpm
239239
unzip-6.0-22.cm2.aarch64.rpm
240-
python3-3.9.19-12.cm2.aarch64.rpm
241-
python3-devel-3.9.19-12.cm2.aarch64.rpm
242-
python3-libs-3.9.19-12.cm2.aarch64.rpm
243-
python3-setuptools-3.9.19-12.cm2.noarch.rpm
240+
python3-3.9.19-13.cm2.aarch64.rpm
241+
python3-devel-3.9.19-13.cm2.aarch64.rpm
242+
python3-libs-3.9.19-13.cm2.aarch64.rpm
243+
python3-setuptools-3.9.19-13.cm2.noarch.rpm
244244
python3-pygments-2.4.2-7.cm2.noarch.rpm
245245
which-2.21-8.cm2.aarch64.rpm
246246
libselinux-3.2-1.cm2.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -237,10 +237,10 @@ ca-certificates-base-2.0.0-19.cm2.noarch.rpm
237237
ca-certificates-2.0.0-19.cm2.noarch.rpm
238238
dwz-0.14-2.cm2.x86_64.rpm
239239
unzip-6.0-22.cm2.x86_64.rpm
240-
python3-3.9.19-12.cm2.x86_64.rpm
241-
python3-devel-3.9.19-12.cm2.x86_64.rpm
242-
python3-libs-3.9.19-12.cm2.x86_64.rpm
243-
python3-setuptools-3.9.19-12.cm2.noarch.rpm
240+
python3-3.9.19-13.cm2.x86_64.rpm
241+
python3-devel-3.9.19-13.cm2.x86_64.rpm
242+
python3-libs-3.9.19-13.cm2.x86_64.rpm
243+
python3-setuptools-3.9.19-13.cm2.noarch.rpm
244244
python3-pygments-2.4.2-7.cm2.noarch.rpm
245245
which-2.21-8.cm2.x86_64.rpm
246246
libselinux-3.2-1.cm2.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -510,28 +510,28 @@ procps-ng-devel-3.3.17-2.cm2.aarch64.rpm
510510
procps-ng-lang-3.3.17-2.cm2.aarch64.rpm
511511
pyproject-rpm-macros-1.0.0~rc1-4.cm2.noarch.rpm
512512
python-markupsafe-debuginfo-2.1.0-1.cm2.aarch64.rpm
513-
python3-3.9.19-12.cm2.aarch64.rpm
513+
python3-3.9.19-13.cm2.aarch64.rpm
514514
python3-audit-3.0.6-8.cm2.aarch64.rpm
515515
python3-cracklib-2.9.7-5.cm2.aarch64.rpm
516-
python3-curses-3.9.19-12.cm2.aarch64.rpm
516+
python3-curses-3.9.19-13.cm2.aarch64.rpm
517517
python3-Cython-0.29.33-2.cm2.aarch64.rpm
518-
python3-debuginfo-3.9.19-12.cm2.aarch64.rpm
519-
python3-devel-3.9.19-12.cm2.aarch64.rpm
518+
python3-debuginfo-3.9.19-13.cm2.aarch64.rpm
519+
python3-devel-3.9.19-13.cm2.aarch64.rpm
520520
python3-gpg-1.16.0-2.cm2.aarch64.rpm
521521
python3-jinja2-3.0.3-7.cm2.noarch.rpm
522522
python3-libcap-ng-0.8.2-2.cm2.aarch64.rpm
523-
python3-libs-3.9.19-12.cm2.aarch64.rpm
523+
python3-libs-3.9.19-13.cm2.aarch64.rpm
524524
python3-libxml2-2.10.4-6.cm2.aarch64.rpm
525525
python3-lxml-4.9.1-1.cm2.aarch64.rpm
526526
python3-magic-5.40-3.cm2.noarch.rpm
527527
python3-markupsafe-2.1.0-1.cm2.aarch64.rpm
528528
python3-newt-0.52.21-5.cm2.aarch64.rpm
529-
python3-pip-3.9.19-12.cm2.noarch.rpm
529+
python3-pip-3.9.19-13.cm2.noarch.rpm
530530
python3-pygments-2.4.2-7.cm2.noarch.rpm
531531
python3-rpm-4.18.0-4.cm2.aarch64.rpm
532-
python3-setuptools-3.9.19-12.cm2.noarch.rpm
533-
python3-test-3.9.19-12.cm2.aarch64.rpm
534-
python3-tools-3.9.19-12.cm2.aarch64.rpm
532+
python3-setuptools-3.9.19-13.cm2.noarch.rpm
533+
python3-test-3.9.19-13.cm2.aarch64.rpm
534+
python3-tools-3.9.19-13.cm2.aarch64.rpm
535535
readline-8.1-1.cm2.aarch64.rpm
536536
readline-debuginfo-8.1-1.cm2.aarch64.rpm
537537
readline-devel-8.1-1.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -516,28 +516,28 @@ procps-ng-devel-3.3.17-2.cm2.x86_64.rpm
516516
procps-ng-lang-3.3.17-2.cm2.x86_64.rpm
517517
pyproject-rpm-macros-1.0.0~rc1-4.cm2.noarch.rpm
518518
python-markupsafe-debuginfo-2.1.0-1.cm2.x86_64.rpm
519-
python3-3.9.19-12.cm2.x86_64.rpm
519+
python3-3.9.19-13.cm2.x86_64.rpm
520520
python3-audit-3.0.6-8.cm2.x86_64.rpm
521521
python3-cracklib-2.9.7-5.cm2.x86_64.rpm
522-
python3-curses-3.9.19-12.cm2.x86_64.rpm
522+
python3-curses-3.9.19-13.cm2.x86_64.rpm
523523
python3-Cython-0.29.33-2.cm2.x86_64.rpm
524-
python3-debuginfo-3.9.19-12.cm2.x86_64.rpm
525-
python3-devel-3.9.19-12.cm2.x86_64.rpm
524+
python3-debuginfo-3.9.19-13.cm2.x86_64.rpm
525+
python3-devel-3.9.19-13.cm2.x86_64.rpm
526526
python3-gpg-1.16.0-2.cm2.x86_64.rpm
527527
python3-jinja2-3.0.3-7.cm2.noarch.rpm
528528
python3-libcap-ng-0.8.2-2.cm2.x86_64.rpm
529-
python3-libs-3.9.19-12.cm2.x86_64.rpm
529+
python3-libs-3.9.19-13.cm2.x86_64.rpm
530530
python3-libxml2-2.10.4-6.cm2.x86_64.rpm
531531
python3-lxml-4.9.1-1.cm2.x86_64.rpm
532532
python3-magic-5.40-3.cm2.noarch.rpm
533533
python3-markupsafe-2.1.0-1.cm2.x86_64.rpm
534534
python3-newt-0.52.21-5.cm2.x86_64.rpm
535-
python3-pip-3.9.19-12.cm2.noarch.rpm
535+
python3-pip-3.9.19-13.cm2.noarch.rpm
536536
python3-pygments-2.4.2-7.cm2.noarch.rpm
537537
python3-rpm-4.18.0-4.cm2.x86_64.rpm
538-
python3-setuptools-3.9.19-12.cm2.noarch.rpm
539-
python3-test-3.9.19-12.cm2.x86_64.rpm
540-
python3-tools-3.9.19-12.cm2.x86_64.rpm
538+
python3-setuptools-3.9.19-13.cm2.noarch.rpm
539+
python3-test-3.9.19-13.cm2.x86_64.rpm
540+
python3-tools-3.9.19-13.cm2.x86_64.rpm
541541
readline-8.1-1.cm2.x86_64.rpm
542542
readline-debuginfo-8.1-1.cm2.x86_64.rpm
543543
readline-devel-8.1-1.cm2.x86_64.rpm

0 commit comments

Comments
 (0)