From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mail.openembedded.org (Postfix) with ESMTP id C0AA27F96F for ; Mon, 18 Nov 2019 14:31:16 +0000 (UTC) Received: by mail-wm1-f48.google.com with SMTP id a17so38584wmb.0 for ; Mon, 18 Nov 2019 06:31:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=5or5Bp/unsYKkesprG0hJHH72g/pZX+5BnP0NGtJ/ww=; b=DcX7bgUaaA9NHwdqJNgnrmTwZkcOynjh003KajPpkMKZmxcVSTRYBOuJMQviEu3JRo AmZtplymCXQm7lF82GLc11kVMGihnwlMWB1vzL9nk9nWL2Dpe/weIil+y1JJdAV3Epsc /MvDi+z+LwWDdVkbgV3ke0TWZgNmKys6ypDlBKnY7nFtcxi8pqIJi29592JKgQWOzny0 OGhObqoeVFrLw8ywxbJ5dvlZy9I9WPU3ok5AePHllGl25W8WLEhoryrdty5qlNSmAIeV LvZbLf5K2svMfmLkwafPJ+d3sbz+cFnQ5JEEankjCLjYGXO7jht3aFLID6gpmyTunD4F dZjw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=5or5Bp/unsYKkesprG0hJHH72g/pZX+5BnP0NGtJ/ww=; b=OtDGl3i1QYQx3KtJ5zjiUJZIjIBt3NdHeZVBD1Wbf07bLENIZgzv3hrPHjUrUfgk/3 oR7IzJubPZe9TxSDzHWLVEnYAPZLVuvvUA1DGIRPSxaTLUugyRFXricWKGOnh4KxIwh4 CLp9N7EK4RN47Px3xkiETU71IUSw88SajpRNZ7koTQznR3MU+hQ1OTGruwIci7fFG2LE pQQOE9zYAZNeJ+3sTIjLMn8U5LX277JmPVJBfF1kwYsYzcNa2erh4DaVUNokg76JznBk b8xlblq5BzanH2usecykidIl5V7p6rr0+26HNp2qyYbwQa3W7lHaQmoqC7n8qJqUdoGA wrjA== X-Gm-Message-State: APjAAAWtm2oQ4mvl6gXQs/4iGz7IYZHZ36C2TKSIOUH0ZqdWVu/rQ7bj RGBpfY5Oqe53EeFQjwizvzqfSsx5 X-Google-Smtp-Source: APXvYqxDN1Jalrh29GN/mNWM1wujWCcFlrMd3tt1+bYgR8C60IK5h4esNXP/tk+yKmnr84bT1+8gSA== X-Received: by 2002:a05:600c:2911:: with SMTP id i17mr28908790wmd.83.1574087476758; Mon, 18 Nov 2019 06:31:16 -0800 (PST) Received: from alexander-box.rd.corpintra.net ([141.113.66.202]) by smtp.gmail.com with ESMTPSA id f24sm20097324wmb.37.2019.11.18.06.29.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 Nov 2019 06:31:16 -0800 (PST) From: Alexander Kanavin To: openembedded-core@lists.openembedded.org Date: Mon, 18 Nov 2019 15:28:40 +0100 Message-Id: <20191118142852.22981-1-alex.kanavin@gmail.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 Subject: [PATCH 01/13] python: update to 2.7.17 X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Nov 2019 14:31:17 -0000 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Drop backports, rebase a couple of patches. This is the second last release of py 2.x; upstream support ends on 1 January 2020, there will be one final 2.x afterwards. Note that the only thing that still needs python 2.x in oe-core is u-boot; when the next u-boot update arrives, we should find out where the py3 migration is for that component before merging the update. Signed-off-by: Alexander Kanavin --- ...-fix-one-do_populate_sysroot-warning.patch | 25 +- ...tive_2.7.16.bb => python-native_2.7.17.bb} | 2 +- meta/recipes-devtools/python/python.inc | 10 +- ...nt-parse-domains-containing-GH-13079.patch | 90 -------- ...cape-the-server-title-of-DocXMLRPCSe.patch | 101 -------- ...Resolve-intermediate-staging-issues.patch} | 53 +++-- .../python/python/CVE-2018-20852.patch | 123 ---------- .../python/python/CVE-2019-9740.patch | 216 ------------------ .../python/bpo-35907-cve-2019-9948-fix.patch | 55 ----- .../python/bpo-35907-cve-2019-9948.patch | 55 ----- .../python/bpo-36216-cve-2019-9636-fix.patch | 28 --- .../python/bpo-36216-cve-2019-9636.patch | 111 --------- .../python/bpo-36742-cve-2019-10160.patch | 81 ------- .../{python_2.7.16.bb => python_2.7.17.bb} | 3 - 14 files changed, 49 insertions(+), 904 deletions(-) rename meta/recipes-devtools/python/{python-native_2.7.16.bb => python-native_2.7.17.bb} (97%) delete mode 100644 meta/recipes-devtools/python/python/0001-2.7-bpo-34155-Dont-parse-domains-containing-GH-13079.patch delete mode 100644 meta/recipes-devtools/python/python/0001-2.7-bpo-38243-Escape-the-server-title-of-DocXMLRPCSe.patch rename meta/recipes-devtools/python/python/{builddir.patch => 0001-python-Resolve-intermediate-staging-issues.patch} (58%) delete mode 100644 meta/recipes-devtools/python/python/CVE-2018-20852.patch delete mode 100644 meta/recipes-devtools/python/python/CVE-2019-9740.patch delete mode 100644 meta/recipes-devtools/python/python/bpo-35907-cve-2019-9948-fix.patch delete mode 100644 meta/recipes-devtools/python/python/bpo-35907-cve-2019-9948.patch delete mode 100644 meta/recipes-devtools/python/python/bpo-36216-cve-2019-9636-fix.patch delete mode 100644 meta/recipes-devtools/python/python/bpo-36216-cve-2019-9636.patch delete mode 100644 meta/recipes-devtools/python/python/bpo-36742-cve-2019-10160.patch rename meta/recipes-devtools/python/{python_2.7.16.bb => python_2.7.17.bb} (97%) diff --git a/meta/recipes-devtools/python/python-native/0001-python-native-fix-one-do_populate_sysroot-warning.patch b/meta/recipes-devtools/python/python-native/0001-python-native-fix-one-do_populate_sysroot-warning.patch index 989818927d4..707ee596fa4 100644 --- a/meta/recipes-devtools/python/python-native/0001-python-native-fix-one-do_populate_sysroot-warning.patch +++ b/meta/recipes-devtools/python/python-native/0001-python-native-fix-one-do_populate_sysroot-warning.patch @@ -1,4 +1,4 @@ -From 12292444e1b3662b994bc223d92b8338fb0895ff Mon Sep 17 00:00:00 2001 +From 6cbb7529cf7ff0da3ca649fb3486facd9620d625 Mon Sep 17 00:00:00 2001 From: Changqing Li Date: Thu, 25 Oct 2018 07:32:14 +0000 Subject: [PATCH] python-native: fix one do_populate_sysroot warning @@ -17,23 +17,24 @@ when do_populate_sysroot. use append to fix it. Upstream-Status: Inappropriate [oe-specific] Signed-off-by: Changqing Li + --- setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py -index 7bf13ed..6c0f29b 100644 +index a2c8127..22f9e23 100644 --- a/setup.py +++ b/setup.py -@@ -40,7 +40,7 @@ def add_dir_to_list(dirlist, dir): - 1) 'dir' is not already in 'dirlist' - 2) 'dir' actually exists, and is a directory.""" - if dir is not None and os.path.isdir(dir) and dir not in dirlist: -- dirlist.insert(0, dir) -+ dirlist.append(dir) - - def macosx_sdk_root(): - """ +@@ -47,7 +47,7 @@ def add_dir_to_list(dirlist, dir): + else: + dir_exists = os.path.isdir(dir) + if dir_exists: +- dirlist.insert(0, dir) ++ dirlist.append(dir) + + MACOS_SDK_ROOT = None + -- -2.18.0 +2.17.1 diff --git a/meta/recipes-devtools/python/python-native_2.7.16.bb b/meta/recipes-devtools/python/python-native_2.7.17.bb similarity index 97% rename from meta/recipes-devtools/python/python-native_2.7.16.bb rename to meta/recipes-devtools/python/python-native_2.7.17.bb index 90103af8be5..936810d9806 100644 --- a/meta/recipes-devtools/python/python-native_2.7.16.bb +++ b/meta/recipes-devtools/python/python-native_2.7.17.bb @@ -11,7 +11,7 @@ SRC_URI += "\ file://nohostlibs.patch \ file://multilib.patch \ file://add-md5module-support.patch \ - file://builddir.patch \ + file://0001-python-Resolve-intermediate-staging-issues.patch \ file://parallel-makeinst-create-bindir.patch \ file://revert_use_of_sysconfigdata.patch \ file://0001-python-native-fix-one-do_populate_sysroot-warning.patch \ diff --git a/meta/recipes-devtools/python/python.inc b/meta/recipes-devtools/python/python.inc index 1462b779e93..a630c26e898 100644 --- a/meta/recipes-devtools/python/python.inc +++ b/meta/recipes-devtools/python/python.inc @@ -8,16 +8,10 @@ INC_PR = "r1" LIC_FILES_CHKSUM = "file://LICENSE;md5=e466242989bd33c1bd2b6a526a742498" SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ - file://bpo-35907-cve-2019-9948.patch \ - file://bpo-35907-cve-2019-9948-fix.patch \ - file://bpo-36216-cve-2019-9636.patch \ - file://bpo-36216-cve-2019-9636-fix.patch \ - file://CVE-2019-9740.patch \ - file://CVE-2018-20852.patch \ " -SRC_URI[md5sum] = "30157d85a2c0479c09ea2cbe61f2aaf5" -SRC_URI[sha256sum] = "f222ef602647eecb6853681156d32de4450a2c39f4de93bd5b20235f2e660ed7" +SRC_URI[md5sum] = "b3b6d2c92f42a60667814358ab9f0cfd" +SRC_URI[sha256sum] = "4d43f033cdbd0aa7b7023c81b0e986fd11e653b5248dac9144d508f11812ba41" # python recipe is actually python 2.x # also, exclude pre-releases for both python 2.x and 3.x diff --git a/meta/recipes-devtools/python/python/0001-2.7-bpo-34155-Dont-parse-domains-containing-GH-13079.patch b/meta/recipes-devtools/python/python/0001-2.7-bpo-34155-Dont-parse-domains-containing-GH-13079.patch deleted file mode 100644 index 5415472a358..00000000000 --- a/meta/recipes-devtools/python/python/0001-2.7-bpo-34155-Dont-parse-domains-containing-GH-13079.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 532ed09c5454bb789a301bb6f1339a0818255610 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Roberto=20C=2E=20S=C3=A1nchez?= -Date: Sat, 14 Sep 2019 13:26:38 -0400 -Subject: [PATCH] [2.7] bpo-34155: Dont parse domains containing @ (GH-13079) - (GH-16006) - -This change skips parsing of email addresses where domains include a "@" character, which can be maliciously used since the local part is returned as a complete address. - -(cherry picked from commit 8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9) - -Excludes changes to Lib/email/_header_value_parser.py, which did not -exist in 2.7. - -Co-authored-by: jpic - -https://bugs.python.org/issue34155 - -Upstream-Status: Backport [https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9] - -CVE: CVE-2019-16056 - -Signed-off-by: Chen Qi ---- - Lib/email/_parseaddr.py | 11 ++++++++++- - Lib/email/test/test_email.py | 14 ++++++++++++++ - .../2019-05-04-13-33-37.bpo-34155.MJll68.rst | 1 + - 3 files changed, 25 insertions(+), 1 deletion(-) - create mode 100644 Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst - -diff --git a/Lib/email/_parseaddr.py b/Lib/email/_parseaddr.py -index 690db2c22d..dc49d2e45a 100644 ---- a/Lib/email/_parseaddr.py -+++ b/Lib/email/_parseaddr.py -@@ -336,7 +336,12 @@ class AddrlistClass: - aslist.append('@') - self.pos += 1 - self.gotonext() -- return EMPTYSTRING.join(aslist) + self.getdomain() -+ domain = self.getdomain() -+ if not domain: -+ # Invalid domain, return an empty address instead of returning a -+ # local part to denote failed parsing. -+ return EMPTYSTRING -+ return EMPTYSTRING.join(aslist) + domain - - def getdomain(self): - """Get the complete domain name from an address.""" -@@ -351,6 +356,10 @@ class AddrlistClass: - elif self.field[self.pos] == '.': - self.pos += 1 - sdlist.append('.') -+ elif self.field[self.pos] == '@': -+ # bpo-34155: Don't parse domains with two `@` like -+ # `a@malicious.org@important.com`. -+ return EMPTYSTRING - elif self.field[self.pos] in self.atomends: - break - else: -diff --git a/Lib/email/test/test_email.py b/Lib/email/test/test_email.py -index 4b4dee3d34..2efe44ac5a 100644 ---- a/Lib/email/test/test_email.py -+++ b/Lib/email/test/test_email.py -@@ -2306,6 +2306,20 @@ class TestMiscellaneous(TestEmailBase): - self.assertEqual(Utils.parseaddr('<>'), ('', '')) - self.assertEqual(Utils.formataddr(Utils.parseaddr('<>')), '') - -+ def test_parseaddr_multiple_domains(self): -+ self.assertEqual( -+ Utils.parseaddr('a@b@c'), -+ ('', '') -+ ) -+ self.assertEqual( -+ Utils.parseaddr('a@b.c@c'), -+ ('', '') -+ ) -+ self.assertEqual( -+ Utils.parseaddr('a@172.17.0.1@c'), -+ ('', '') -+ ) -+ - def test_noquote_dump(self): - self.assertEqual( - Utils.formataddr(('A Silly Person', 'person@dom.ain')), -diff --git a/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst b/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst -new file mode 100644 -index 0000000000..50292e29ed ---- /dev/null -+++ b/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst -@@ -0,0 +1 @@ -+Fix parsing of invalid email addresses with more than one ``@`` (e.g. a@b@c.com.) to not return the part before 2nd ``@`` as valid email address. Patch by maxking & jpic. diff --git a/meta/recipes-devtools/python/python/0001-2.7-bpo-38243-Escape-the-server-title-of-DocXMLRPCSe.patch b/meta/recipes-devtools/python/python/0001-2.7-bpo-38243-Escape-the-server-title-of-DocXMLRPCSe.patch deleted file mode 100644 index 3025cf7bc8f..00000000000 --- a/meta/recipes-devtools/python/python/0001-2.7-bpo-38243-Escape-the-server-title-of-DocXMLRPCSe.patch +++ /dev/null @@ -1,101 +0,0 @@ -From b161c89c8bd66fe928192e21364678c8e9b8fcc0 Mon Sep 17 00:00:00 2001 -From: Dong-hee Na -Date: Tue, 1 Oct 2019 19:58:01 +0900 -Subject: [PATCH] [2.7] bpo-38243: Escape the server title of DocXMLRPCServer - (GH-16447) - -Escape the server title of DocXMLRPCServer.DocXMLRPCServer -when rendering the document page as HTML. - -CVE: CVE-2019-16935 - -Upstream-Status: Backport [https://github.com/python/cpython/pull/16447/commits/b41cde823d026f2adc21ef14b1c2e92b1006de06] - -Signed-off-by: Chen Qi ---- - Lib/DocXMLRPCServer.py | 13 +++++++++++- - Lib/test/test_docxmlrpc.py | 20 +++++++++++++++++++ - .../2019-09-25-13-21-09.bpo-38243.1pfz24.rst | 3 +++ - 3 files changed, 35 insertions(+), 1 deletion(-) - create mode 100644 Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst - -diff --git a/Lib/DocXMLRPCServer.py b/Lib/DocXMLRPCServer.py -index 4064ec2e48..90b037dd35 100644 ---- a/Lib/DocXMLRPCServer.py -+++ b/Lib/DocXMLRPCServer.py -@@ -20,6 +20,16 @@ from SimpleXMLRPCServer import (SimpleXMLRPCServer, - CGIXMLRPCRequestHandler, - resolve_dotted_attribute) - -+ -+def _html_escape_quote(s): -+ s = s.replace("&", "&") # Must be done first! -+ s = s.replace("<", "<") -+ s = s.replace(">", ">") -+ s = s.replace('"', """) -+ s = s.replace('\'', "'") -+ return s -+ -+ - class ServerHTMLDoc(pydoc.HTMLDoc): - """Class used to generate pydoc HTML document for a server""" - -@@ -210,7 +220,8 @@ class XMLRPCDocGenerator: - methods - ) - -- return documenter.page(self.server_title, documentation) -+ title = _html_escape_quote(self.server_title) -+ return documenter.page(title, documentation) - - class DocXMLRPCRequestHandler(SimpleXMLRPCRequestHandler): - """XML-RPC and documentation request handler class. -diff --git a/Lib/test/test_docxmlrpc.py b/Lib/test/test_docxmlrpc.py -index 4dff4159e2..c45b892b8b 100644 ---- a/Lib/test/test_docxmlrpc.py -+++ b/Lib/test/test_docxmlrpc.py -@@ -1,5 +1,6 @@ - from DocXMLRPCServer import DocXMLRPCServer - import httplib -+import re - import sys - from test import test_support - threading = test_support.import_module('threading') -@@ -176,6 +177,25 @@ class DocXMLRPCHTTPGETServer(unittest.TestCase): - self.assertIn("""Try self.add, too.""", - response.read()) - -+ def test_server_title_escape(self): -+ """Test that the server title and documentation -+ are escaped for HTML. -+ """ -+ self.serv.set_server_title('test_title