From 402561ccefd5367ec878461cc088b533993ba0b7 Mon Sep 17 00:00:00 2001 From: Ben Woodcroft Date: Thu, 4 Oct 2018 15:48:04 +1000 Subject: gnu: python2-backports-functools-lru-cache: Update to 1.5. * gnu/packages/python.scm (python2-backports-functools-lru-cache): Update to 1.5. --- gnu/packages/python.scm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'gnu/packages/python.scm') diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm index 4703d95a2d..6a2bd6e8f5 100644 --- a/gnu/packages/python.scm +++ b/gnu/packages/python.scm @@ -11418,7 +11418,7 @@ editors.") (define-public python2-backports-functools-lru-cache (package (name "python2-backports-functools-lru-cache") - (version "1.3") + (version "1.5") (source (origin (method url-fetch) @@ -11426,7 +11426,7 @@ editors.") (uri (pypi-uri "backports.functools_lru_cache" version)) (sha256 (base32 - "158ysf2hb0q4p4695abfiym9x1ywg0dgh8a3apd7gqaaxjy22jj4")))) + "06jgv8gib4fhky0p5cmxdghvsgjyzcdgk48k8pxb1ccf11znk64x")))) (build-system python-build-system) (native-inputs `(("python2-setuptools-scm" ,python2-setuptools-scm))) -- cgit 1.4.1 From 3c4d307e8697c36ebb9df939a5d2f0d905cc5474 Mon Sep 17 00:00:00 2001 From: Leo Famulari Date: Fri, 12 Oct 2018 23:19:20 -0400 Subject: gnu: python-icalendar: Update to 4.0.2. * gnu/packages/python.scm (python-icalendar: Update to 4.0.2. --- gnu/packages/python.scm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'gnu/packages/python.scm') diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm index 6a2bd6e8f5..35262a2c77 100644 --- a/gnu/packages/python.scm +++ b/gnu/packages/python.scm @@ -7576,13 +7576,13 @@ minimal and fast API targeting the following uses: (define-public python-icalendar (package (name "python-icalendar") - (version "4.0.1") + (version "4.0.2") (source (origin (method url-fetch) (uri (pypi-uri "icalendar" version)) (sha256 (base32 - "139y79y6ijl39m5bj771r43vpah9s4ly7d1k76la6hrx7l144ak8")))) + "13003kw2vbas1ha146vv3x2rdg9k7w38rdzxj63vi1i67jgjldl0")))) (build-system python-build-system) (propagated-inputs `(("python-dateutil" ,python-dateutil) -- cgit 1.4.1 From d7814696b884a7c5e4a58f539ece53f4998689a3 Mon Sep 17 00:00:00 2001 From: Leo Famulari Date: Fri, 12 Oct 2018 23:38:01 -0400 Subject: gnu: python-configargparse: Use pypi-uri. * gnu/packages/python.scm (python-configargparse, python2-configargparse)[source]: Use pypi-uri. --- gnu/packages/python.scm | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'gnu/packages/python.scm') diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm index 35262a2c77..29371d0494 100644 --- a/gnu/packages/python.scm +++ b/gnu/packages/python.scm @@ -7353,9 +7353,7 @@ config files.") (version "0.12.0") (source (origin (method url-fetch) - (uri (string-append - "https://pypi.io/packages/source/C/ConfigArgParse/" - "ConfigArgParse-" version ".tar.gz")) + (uri (pypi-uri "ConfigArgParse" version)) (sha256 (base32 "0fgkiqh6r3rbkdq3k8c48m85g52k96686rw3a6jg4lcncrkpvk98")))) -- cgit 1.4.1 From 0731fc1ce7f397724708f4956e6bdeb9c01c6762 Mon Sep 17 00:00:00 2001 From: Maxim Cournoyer Date: Wed, 29 Aug 2018 00:05:07 -0400 Subject: gnu: python-mimeparse: Update to 1.6.0. * gnu/packages/python.scm (python-mimeparse): Update to 1.6.0. [phases]: Enable tests with a custom check phase. --- gnu/packages/python.scm | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'gnu/packages/python.scm') diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm index 29371d0494..8261fefd93 100644 --- a/gnu/packages/python.scm +++ b/gnu/packages/python.scm @@ -1699,7 +1699,7 @@ software.") (define-public python-mimeparse (package (name "python-mimeparse") - (version "0.1.4") + (version "1.6.0") (source (origin (method url-fetch) @@ -1708,10 +1708,14 @@ software.") version ".tar.gz")) (sha256 (base32 - "1hyxg09kaj02ri0rmwjqi86wk4nd1akvv7n0dx77azz76wga4s9w")))) + "0y2g6cl660bpz11srgqyvvm8gmywpgyx8g0xfvbiyr0af0yv1r3n")))) (build-system python-build-system) (arguments - '(#:tests? #f)) ; no setup.py test command + '(#:phases + (modify-phases %standard-phases + (replace 'check + (lambda _ + (invoke "./mimeparse_test.py")))))) (home-page "https://github.com/dbtsai/python-mimeparse") (synopsis "Python library for parsing MIME types") -- cgit 1.4.1 From 90aeaee861845142843a0f988fa4ff016c723cdb Mon Sep 17 00:00:00 2001 From: Marius Bakke Date: Sat, 6 Oct 2018 16:47:05 +0200 Subject: gnu: python: Fix CVE-2018-14647. * gnu/packages/patches/python-CVE-2018-14647.patch: New file. * gnu/local.mk (dist_patch_DATA): Register it. * gnu/packages/python.scm (python-3/fixed): New variable. (python-3.6)[replacement]: New field. (python-minimal, python-debug, wrap-python3): Use PACKAGE/INHERIT instead of standard inheritance. --- gnu/local.mk | 1 + gnu/packages/patches/python-CVE-2018-14647.patch | 61 ++++++++++++++++++++++++ gnu/packages/python.scm | 26 ++++++++-- 3 files changed, 84 insertions(+), 4 deletions(-) create mode 100644 gnu/packages/patches/python-CVE-2018-14647.patch (limited to 'gnu/packages/python.scm') diff --git a/gnu/local.mk b/gnu/local.mk index b8248e8da0..d30bbedee6 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -1076,6 +1076,7 @@ dist_patch_DATA = \ %D%/packages/patches/python-3-deterministic-build-info.patch \ %D%/packages/patches/python-3-search-paths.patch \ %D%/packages/patches/python-3-fix-tests.patch \ + %D%/packages/patches/python-CVE-2018-14647.patch \ %D%/packages/patches/python-axolotl-AES-fix.patch \ %D%/packages/patches/python-cairocffi-dlopen-path.patch \ %D%/packages/patches/python-fix-tests.patch \ diff --git a/gnu/packages/patches/python-CVE-2018-14647.patch b/gnu/packages/patches/python-CVE-2018-14647.patch new file mode 100644 index 0000000000..24f8d21820 --- /dev/null +++ b/gnu/packages/patches/python-CVE-2018-14647.patch @@ -0,0 +1,61 @@ +Fix CVE-2018-14647: +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14647 +https://bugs.python.org/issue34623 + +Taken from upstream: +https://github.com/python/cpython/commit/f7666e828cc3d5873136473ea36ba2013d624fa1 + +diff --git Include/pyexpat.h Include/pyexpat.h +index 44259bf6d7..07020b5dc9 100644 +--- Include/pyexpat.h ++++ Include/pyexpat.h +@@ -3,7 +3,7 @@ + + /* note: you must import expat.h before importing this module! */ + +-#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.0" ++#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.1" + #define PyExpat_CAPSULE_NAME "pyexpat.expat_CAPI" + + struct PyExpat_CAPI +@@ -48,6 +48,8 @@ struct PyExpat_CAPI + enum XML_Status (*SetEncoding)(XML_Parser parser, const XML_Char *encoding); + int (*DefaultUnknownEncodingHandler)( + void *encodingHandlerData, const XML_Char *name, XML_Encoding *info); ++ /* might be none for expat < 2.1.0 */ ++ int (*SetHashSalt)(XML_Parser parser, unsigned long hash_salt); + /* always add new stuff to the end! */ + }; + +diff --git Modules/_elementtree.c Modules/_elementtree.c +index 707ab2912b..53f05f937f 100644 +--- Modules/_elementtree.c ++++ Modules/_elementtree.c +@@ -3261,6 +3261,11 @@ _elementtree_XMLParser___init___impl(XMLParserObject *self, PyObject *html, + PyErr_NoMemory(); + return -1; + } ++ /* expat < 2.1.0 has no XML_SetHashSalt() */ ++ if (EXPAT(SetHashSalt) != NULL) { ++ EXPAT(SetHashSalt)(self->parser, ++ (unsigned long)_Py_HashSecret.expat.hashsalt); ++ } + + if (target) { + Py_INCREF(target); +diff --git Modules/pyexpat.c Modules/pyexpat.c +index 47c3e86c20..aa21d93c11 100644 +--- Modules/pyexpat.c ++++ Modules/pyexpat.c +@@ -1887,6 +1887,11 @@ MODULE_INITFUNC(void) + capi.SetStartDoctypeDeclHandler = XML_SetStartDoctypeDeclHandler; + capi.SetEncoding = XML_SetEncoding; + capi.DefaultUnknownEncodingHandler = PyUnknownEncodingHandler; ++#if XML_COMBINED_VERSION >= 20100 ++ capi.SetHashSalt = XML_SetHashSalt; ++#else ++ capi.SetHashSalt = NULL; ++#endif + + /* export using capsule */ + capi_object = PyCapsule_New(&capi, PyExpat_CAPSULE_NAME, NULL); diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm index 8261fefd93..3e39866087 100644 --- a/gnu/packages/python.scm +++ b/gnu/packages/python.scm @@ -357,6 +357,7 @@ data types.") (package (inherit python-2) (name "python") (version "3.6.5") + (replacement python-3/fixed) (source (origin (method url-fetch) (uri (string-append "https://www.python.org/ftp/python/" @@ -456,6 +457,24 @@ data types.") ;; Current 3.x version. (define-public python-3 python-3.6) +(define python-3/fixed + (package + (inherit python-3) + (source (origin + (inherit (package-source python-3)) + (patches (append (origin-patches (package-source python-3)) + (search-patches "python-CVE-2018-14647.patch"))))) + (arguments + (substitute-keyword-arguments (package-arguments python-3) + ((#:phases phases) + `(modify-phases ,phases + (add-after 'unpack 'delete-broken-test + (lambda _ + ;; Delete test which fails on recent kernels: + ;; . + (delete-file "Lib/test/test_socket.py") + #t)))))))) + ;; Current major version. (define-public python python-3) @@ -474,7 +493,7 @@ data types.") ("zlib" ,zlib))))) (define-public python-minimal - (package (inherit python) + (package/inherit python (name "python-minimal") (outputs '("out")) @@ -486,8 +505,7 @@ data types.") ("zlib" ,zlib))))) (define-public python-debug - (package - (inherit python) + (package/inherit python (name "python-debug") (outputs '("out" "debug")) (build-system gnu-build-system) @@ -506,7 +524,7 @@ for more information."))) (define* (wrap-python3 python #:optional (name (string-append (package-name python) "-wrapper"))) - (package (inherit python) + (package/inherit python (name name) (source #f) (build-system trivial-build-system) -- cgit 1.4.1 From a55ebe2e3a7b438b4eec06c594440d3a0fb06a25 Mon Sep 17 00:00:00 2001 From: Marius Bakke Date: Sat, 6 Oct 2018 18:50:47 +0200 Subject: gnu: python2: Add upstream security fixes. This addresses CVE-2018-{1060,1061,14647,1000802}. * gnu/packages/patches/python2-CVE-2018-1000802.patch, gnu/packages/patches/python2-CVE-2018-1060.patch, gnu/packages/patches/python2-CVE-2018-1061.patch, gnu/packages/patches/python2-CVE-2018-14647.patch: New files. * gnu/local.mk (dist_patch_DATA): Register it. * gnu/packages/python.scm (python-2/fixed): New variable. (python-2.7)[replacement]: New field. (python2-minimal): Use PACKAGE/INHERIT. --- gnu/local.mk | 4 ++ .../patches/python2-CVE-2018-1000802.patch | 47 +++++++++++++++++ gnu/packages/patches/python2-CVE-2018-1060.patch | 20 +++++++ gnu/packages/patches/python2-CVE-2018-1061.patch | 20 +++++++ gnu/packages/patches/python2-CVE-2018-14647.patch | 61 ++++++++++++++++++++++ gnu/packages/python.scm | 15 +++++- 6 files changed, 166 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/python2-CVE-2018-1000802.patch create mode 100644 gnu/packages/patches/python2-CVE-2018-1060.patch create mode 100644 gnu/packages/patches/python2-CVE-2018-1061.patch create mode 100644 gnu/packages/patches/python2-CVE-2018-14647.patch (limited to 'gnu/packages/python.scm') diff --git a/gnu/local.mk b/gnu/local.mk index d30bbedee6..402505e229 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -1068,6 +1068,10 @@ dist_patch_DATA = \ %D%/packages/patches/pygpgme-disable-problematic-tests.patch \ %D%/packages/patches/pyqt-configure.patch \ %D%/packages/patches/pyqt-public-sip.patch \ + %D%/packages/patches/python2-CVE-2018-1060.patch \ + %D%/packages/patches/python2-CVE-2018-1061.patch \ + %D%/packages/patches/python2-CVE-2018-14647.patch \ + %D%/packages/patches/python2-CVE-2018-1000802.patch \ %D%/packages/patches/python-2-deterministic-build-info.patch \ %D%/packages/patches/python-2.7-adjust-tests.patch \ %D%/packages/patches/python-2.7-search-paths.patch \ diff --git a/gnu/packages/patches/python2-CVE-2018-1000802.patch b/gnu/packages/patches/python2-CVE-2018-1000802.patch new file mode 100644 index 0000000000..0d5bc77c84 --- /dev/null +++ b/gnu/packages/patches/python2-CVE-2018-1000802.patch @@ -0,0 +1,47 @@ +Fix CVE-2018-1000802: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000802 + +Taken from upstream commit (sans NEWS): +https://github.com/python/cpython/commit/d8b103b8b3ef9644805341216963a64098642435 + +diff --git a/Lib/shutil.py b/Lib/shutil.py +index 3462f7c5e9..0ab1a06f52 100644 +--- a/Lib/shutil.py ++++ b/Lib/shutil.py +@@ -413,17 +413,21 @@ def _make_tarball(base_name, base_dir, compress="gzip", verbose=0, dry_run=0, + + return archive_name + +-def _call_external_zip(base_dir, zip_filename, verbose=False, dry_run=False): ++def _call_external_zip(base_dir, zip_filename, verbose, dry_run, logger): + # XXX see if we want to keep an external call here + if verbose: + zipoptions = "-r" + else: + zipoptions = "-rq" +- from distutils.errors import DistutilsExecError +- from distutils.spawn import spawn ++ cmd = ["zip", zipoptions, zip_filename, base_dir] ++ if logger is not None: ++ logger.info(' '.join(cmd)) ++ if dry_run: ++ return ++ import subprocess + try: +- spawn(["zip", zipoptions, zip_filename, base_dir], dry_run=dry_run) +- except DistutilsExecError: ++ subprocess.check_call(cmd) ++ except subprocess.CalledProcessError: + # XXX really should distinguish between "couldn't find + # external 'zip' command" and "zip failed". + raise ExecError, \ +@@ -458,7 +462,7 @@ def _make_zipfile(base_name, base_dir, verbose=0, dry_run=0, logger=None): + zipfile = None + + if zipfile is None: +- _call_external_zip(base_dir, zip_filename, verbose, dry_run) ++ _call_external_zip(base_dir, zip_filename, verbose, dry_run, logger) + else: + if logger is not None: + logger.info("creating '%s' and adding '%s' to it", diff --git a/gnu/packages/patches/python2-CVE-2018-1060.patch b/gnu/packages/patches/python2-CVE-2018-1060.patch new file mode 100644 index 0000000000..5eb7ccfbc9 --- /dev/null +++ b/gnu/packages/patches/python2-CVE-2018-1060.patch @@ -0,0 +1,20 @@ +Fix CVE-2018-1060: +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1060 + +Taken from upstream commit (sans test and NEWS): +https://github.com/python/cpython/commit/e052d40cea15f582b50947f7d906b39744dc62a2 + +diff --git a/Lib/poplib.py b/Lib/poplib.py +index b91e5f72d2ca..a238510b38fc 100644 +--- a/Lib/poplib.py ++++ b/Lib/poplib.py +@@ -274,7 +274,7 @@ def rpop(self, user): + return self._shortcmd('RPOP %s' % user) + + +- timestamp = re.compile(r'\+OK.*(<[^>]+>)') ++ timestamp = re.compile(br'\+OK.[^<]*(<.*>)') + + def apop(self, user, secret): + """Authorisation + diff --git a/gnu/packages/patches/python2-CVE-2018-1061.patch b/gnu/packages/patches/python2-CVE-2018-1061.patch new file mode 100644 index 0000000000..6caab24b4d --- /dev/null +++ b/gnu/packages/patches/python2-CVE-2018-1061.patch @@ -0,0 +1,20 @@ +Fix CVE-2018-1061: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1061 + +Taken from upstream commit (sans test and NEWS): +https://github.com/python/cpython/commit/e052d40cea15f582b50947f7d906b39744dc62a2 + +diff --git a/Lib/difflib.py b/Lib/difflib.py +index 1c6fbdbedcb7..788a92df3f89 100644 +--- a/Lib/difflib.py ++++ b/Lib/difflib.py +@@ -1103,7 +1103,7 @@ def _qformat(self, aline, bline, atags, btags): + + import re + +-def IS_LINE_JUNK(line, pat=re.compile(r"\s*#?\s*$").match): ++def IS_LINE_JUNK(line, pat=re.compile(r"\s*(?:#\s*)?$").match): + r""" + Return 1 for ignorable line: iff `line` is blank or contains a single '#'. + diff --git a/gnu/packages/patches/python2-CVE-2018-14647.patch b/gnu/packages/patches/python2-CVE-2018-14647.patch new file mode 100644 index 0000000000..6226b06aca --- /dev/null +++ b/gnu/packages/patches/python2-CVE-2018-14647.patch @@ -0,0 +1,61 @@ +Fix CVE-2018-14647: +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14647 +https://bugs.python.org/issue34623 + +Taken from upstream: +https://github.com/python/cpython/commit/18b20bad75b4ff0486940fba4ec680e96e70f3a2 + +diff --git a/Include/pyexpat.h b/Include/pyexpat.h +index 5340ef5fa3..3fc5fa54da 100644 +--- a/Include/pyexpat.h ++++ b/Include/pyexpat.h +@@ -3,7 +3,7 @@ + + /* note: you must import expat.h before importing this module! */ + +-#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.0" ++#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.1" + #define PyExpat_CAPSULE_NAME "pyexpat.expat_CAPI" + + struct PyExpat_CAPI +@@ -43,6 +43,8 @@ struct PyExpat_CAPI + XML_Parser parser, XML_UnknownEncodingHandler handler, + void *encodingHandlerData); + void (*SetUserData)(XML_Parser parser, void *userData); ++ /* might be none for expat < 2.1.0 */ ++ int (*SetHashSalt)(XML_Parser parser, unsigned long hash_salt); + /* always add new stuff to the end! */ + }; + +diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c +index f7f992dd3a..b38e0ab329 100644 +--- a/Modules/_elementtree.c ++++ b/Modules/_elementtree.c +@@ -2574,6 +2574,11 @@ xmlparser(PyObject* self_, PyObject* args, PyObject* kw) + PyErr_NoMemory(); + return NULL; + } ++ /* expat < 2.1.0 has no XML_SetHashSalt() */ ++ if (EXPAT(SetHashSalt) != NULL) { ++ EXPAT(SetHashSalt)(self->parser, ++ (unsigned long)_Py_HashSecret.prefix); ++ } + + ALLOC(sizeof(XMLParserObject), "create expatparser"); + +diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c +index 2b4d31293c..1f8c0d70a5 100644 +--- a/Modules/pyexpat.c ++++ b/Modules/pyexpat.c +@@ -2042,6 +2042,11 @@ MODULE_INITFUNC(void) + capi.SetProcessingInstructionHandler = XML_SetProcessingInstructionHandler; + capi.SetUnknownEncodingHandler = XML_SetUnknownEncodingHandler; + capi.SetUserData = XML_SetUserData; ++#if XML_COMBINED_VERSION >= 20100 ++ capi.SetHashSalt = XML_SetHashSalt; ++#else ++ capi.SetHashSalt = NULL; ++#endif + + /* export using capsule */ + capi_object = PyCapsule_New(&capi, PyExpat_CAPSULE_NAME, NULL); diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm index 3e39866087..e3a04b0344 100644 --- a/gnu/packages/python.scm +++ b/gnu/packages/python.scm @@ -148,6 +148,7 @@ (package (name "python2") (version "2.7.14") + (replacement python-2/fixed) (source (origin (method url-fetch) @@ -344,6 +345,18 @@ data types.") ;; Current 2.x version. (define-public python-2 python-2.7) +(define python-2/fixed + (package + (inherit python-2) + (source (origin + (inherit (package-source python-2)) + (patches (append + (origin-patches (package-source python-2)) + (search-patches "python2-CVE-2018-1060.patch" + "python2-CVE-2018-1061.patch" + "python2-CVE-2018-14647.patch" + "python2-CVE-2018-1000802.patch"))))))) + (define-public python2-called-python ;; Both 2.x and 3.x used to be called "python". In commit ;; a7714d42de2c3082f3609d1e63c83d703fb39cf9 (March 2018), we renamed the @@ -482,7 +495,7 @@ data types.") ;; Python (Tk -> libxcb -> Python.) (define-public python2-minimal - (package (inherit python-2) + (package/inherit python-2 (name "python2-minimal") (outputs '("out")) -- cgit 1.4.1