[meta-virtualization][scarthgap][PATCH 2/2] python3-webob: fix CVE-2026-44889
"Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" <[email protected]>
| Newsgroups | org.yoctoproject.lists.meta-virtualization |
|---|---|
| Message-ID | <[email protected]> |
From: Darsh Kelaiya <[email protected]> This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/Pylons/webob/commit/21c1c582bff83dc6f95fdb055e31a36db6d26e89 [2] https://github.com/Pylons/webob/security/advisories/GHSA-fh3h-vg37-cc95 Signed-off-by: Darsh Kelaiya <[email protected]> --- .../python/python3-webob/CVE-2026-44889.patch | 124 ++++++++++++++++++ .../python/python3-webob_1.8.7.bb | 1 + 2 files changed, 125 insertions(+) create mode 100644 recipes-devtools/python/python3-webob/CVE-2026-44889.patch diff --git a/recipes-devtools/python/python3-webob/CVE-2026-44889.patch b/recipes-devtools/python/python3-webob/CVE-2026-44889.patch new file mode 100644 index 00000000..6100301d --- /dev/null +++ b/recipes-devtools/python/python3-webob/CVE-2026-44889.patch @@ -0,0 +1,124 @@ +From 24a7763bdb5f391bb520d5b79ca0e5b13af7bbbe Mon Sep 17 00:00:00 2001 +From: Delta Regeer <[email protected]> +Date: Wed, 6 May 2026 00:38:51 -0600 +Subject: [PATCH] Fix open redirect issue due to changes made in cPython >=3.10 + +CVE: CVE-2026-44889 +Upstream-Status: Backport [https://github.com/Pylons/webob/commit/21c1c582bff83dc6f95fdb055e31a36db6d26e89] + +(cherry picked from commit 21c1c582bff83dc6f95fdb055e31a36db6d26e89) +Signed-off-by: Darsh Kelaiya <[email protected]> +--- + CHANGES.txt | 15 ++++++++++++++ + src/webob/response.py | 11 +++++++--- + tests/test_response.py | 46 ++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 69 insertions(+), 3 deletions(-) + +diff --git a/CHANGES.txt b/CHANGES.txt +index ca33450..056031f 100644 +--- a/CHANGES.txt ++++ b/CHANGES.txt +@@ -1,3 +1,18 @@ ++Unreleased ++---------- ++ ++Security Fix ++~~~~~~~~~~~~ ++ ++- The fix for CVE-2024-42353 was incomplete: a Location value containing ++ ASCII tab, carriage return, or line feed characters between consecutive ++ slashes could still be interpreted as a protocol-relative URL by ++ ``urllib.parse.urljoin`` on Python 3.10+, allowing an open redirect. ++ ++ See https://github.com/Pylons/webob/security/advisories/GHSA-fh3h-vg37-cc95 ++ ++ Thanks to Caleb Brown of Google for the report. ++ + 1.8.7 (2021-02-17) + ------------------ + +diff --git a/src/webob/response.py b/src/webob/response.py +index efc38ec..91b801c 100644 +--- a/src/webob/response.py ++++ b/src/webob/response.py +@@ -1281,12 +1281,17 @@ class Response(object): + + @staticmethod + def _make_location_absolute(environ, value): ++ # urllib.parse.urlsplit() (called internally by urljoin) strips ++ # ASCII tab, CR, and LF from the URL on Python 3.10+. Strip them ++ # ourselves first so they cannot be used to bypass the SCHEME_RE ++ # or protocol-relative ("//") checks below. See CVE-2024-42353, ++ # https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3, ++ # and the follow-up advisory GHSA-fh3h-vg37-cc95. ++ value = value.replace("\t", "").replace("\r", "").replace("\n", "") ++ + if SCHEME_RE.search(value): + return value + +- # This is to fix an open redirect issue due to the way that +- # urlparse.urljoin works. See CVE-2024-42353 and +- # https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3 + if value.startswith("//"): + value = "/%2f{}".format(value[2:]) + new_location = urlparse.urljoin(_request_uri(environ), value) +diff --git a/tests/test_response.py b/tests/test_response.py +index 8a6ac06..2cdd981 100644 +--- a/tests/test_response.py ++++ b/tests/test_response.py +@@ -1042,6 +1042,52 @@ def test_location_no_open_redirect(): + assert req.get_response(res).location == "http://localhost/%2fwww.example.com/test" + + [email protected]("payload", [ ++ "/\t/www.example.com/test", ++ "\t//www.example.com/test", ++ "//\twww.example.com/test", ++ "/\t\t/www.example.com/test", ++]) ++def test_location_no_open_redirect_tab_bypass(payload): ++ # Follow-up to CVE-2024-42353. urllib.parse.urlsplit() (used internally ++ # by urljoin) strips ASCII tab on Python 3.10+, which allowed a ++ # Location value to bypass the "//" check and be parsed as ++ # protocol-relative. See GHSA-fh3h-vg37-cc95. (CR and LF are already ++ # rejected by the location header setter, so only tab is reachable ++ # via the public API.) ++ res = Response() ++ res.status = "301" ++ res.location = payload ++ req = Request.blank("/") ++ assert req.get_response(res).location == ( ++ "http://localhost/%2fwww.example.com/test" ++ ) ++ ++ [email protected]("payload", [ ++ "/\t/www.example.com/test", ++ "/\n/www.example.com/test", ++ "/\r/www.example.com/test", ++ "\t//www.example.com/test", ++ "\n//www.example.com/test", ++ "\r//www.example.com/test", ++ "//\twww.example.com/test", ++ "//\nwww.example.com/test", ++ "//\rwww.example.com/test", ++ "//\tw\nww.example.com/test", ++]) ++def test__make_location_absolute_strips_url_whitespace(payload): ++ # Defense in depth for GHSA-fh3h-vg37-cc95: even when called with a ++ # Location value that bypasses the descriptor's CR/LF check (e.g. via ++ # direct manipulation of _headerlist), tab/CR/LF must not be usable to ++ # turn a relative path into a protocol-relative redirect. ++ result = Response._make_location_absolute( ++ {"wsgi.url_scheme": "http", "HTTP_HOST": "example.com:80"}, ++ payload, ++ ) ++ assert result == "http://example.com/%2fwww.example.com/test" ++ ++ + @pytest.mark.xfail(sys.version_info < (3,0), + reason="Python 2.x unicode != str, WSGI requires str. Test " + "added due to https://github.com/Pylons/webob/issues/247. " +-- +2.35.6 + diff --git a/recipes-devtools/python/python3-webob_1.8.7.bb b/recipes-devtools/python/python3-webob_1.8.7.bb index 5d7f74c8..b5e40c06 100644 --- a/recipes-devtools/python/python3-webob_1.8.7.bb +++ b/recipes-devtools/python/python3-webob_1.8.7.bb @@ -15,4 +15,5 @@ RDEPENDS:${PN} += " \ " SRC_URI += "file://CVE-2024-42353.patch \ + file://CVE-2026-44889.patch \ " -- 2.35.6