Projects
Mega:23.09
python-cryptography
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
Expand all
Collapse all
Changes of Revision 3
View file
_service:tar_scm:python-cryptography.spec
Changed
@@ -1,7 +1,7 @@ %global pypi_name cryptography Name: python-%{pypi_name} Version: 40.0.2 -Release: 2 +Release: 5 Summary: PyCA's cryptography library License: ASL 2.0 or BSD URL: https://cryptography.io/en/latest/ @@ -10,6 +10,9 @@ Patch6002: backport-provide-openssl-apis-related-to-SM-for-python.patch Patch6003: backport-CVE-2023-38325.patch +# CVE-2023-49083 +Patch6004: backport-Fixed-crash-when-loading-a-PKCS-7-bundle-with-no-certificates.patch +Patch6005: backport-raise-an-exception-instead-of-returning-an-empty-list-for-pkcs7-cert-loading.patch BuildRequires: openssl-devel cargo BuildRequires: gcc @@ -86,6 +89,15 @@ %doc README.rst docs %changelog +* Sat Dec 23 2023 shixuanttong <shixuantong1@huawei.com> - 40.0.2-5 +- update author info for Patch6002 + +* Sat Dec 2 2023 liningjie <liningjie@xfusion.com> - 40.0.2-4 +- raise an exception instead of returning an empty list for pkcs7 cert loading + +* Wed Nov 29 2023 liningjie <liningjie@xfusion.com> - 40.0.2-3 +- Fixed crash when loading a PKCS#7 bundle with no certificates + * Tue Jul 25 2023 shixuantong <shixuantong1@huawei.com> - 40.0.2-2 - fix CVE-2023-38325
View file
_service:tar_scm:backport-Fixed-crash-when-loading-a-PKCS-7-bundle-with-no-certificates.patch
Added
@@ -0,0 +1,49 @@ +From 6d71ead8d1910857e8cd778bc34c46c06e870a69 Mon Sep 17 00:00:00 2001 +From: Alex Gaynor <alex.gaynor@gmail.com> +Date: Wed, 29 Nov 2023 11:37:52 +0800 +Subject: PATCH Fixed crash when loading a PKCS#7 bundle with no certificates + (#9926) + +--- + src/cryptography/hazmat/backends/openssl/backend.py | 5 ++++- + tests/hazmat/primitives/test_pkcs7.py | 6 ++++++ + 2 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py +index a3fe1bc..58e7207 100644 +--- a/src/cryptography/hazmat/backends/openssl/backend.py ++++ b/src/cryptography/hazmat/backends/openssl/backend.py +@@ -2383,9 +2383,12 @@ class Backend: + _Reasons.UNSUPPORTED_SERIALIZATION, + ) + ++ certs: listx509.Certificate = ++ if p7.d.sign == self._ffi.NULL: ++ return certs ++ + sk_x509 = p7.d.sign.cert + num = self._lib.sk_X509_num(sk_x509) +- certs = + for i in range(num): + x509 = self._lib.sk_X509_value(sk_x509, i) + self.openssl_assert(x509 != self._ffi.NULL) +diff --git a/tests/hazmat/primitives/test_pkcs7.py b/tests/hazmat/primitives/test_pkcs7.py +index 4e61c5e..d8170bf 100644 +--- a/tests/hazmat/primitives/test_pkcs7.py ++++ b/tests/hazmat/primitives/test_pkcs7.py +@@ -89,6 +89,12 @@ class TestPKCS7Loading: + mode="rb", + ) + ++ def test_load_pkcs7_empty_certificates(self, backend): ++ der = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02" ++ ++ certificates = pkcs7.load_der_pkcs7_certificates(der) ++ assert certificates == ++ + + # We have no public verification API and won't be adding one until we get + # some requirements from users so this function exists to give us basic +-- +2.33.0 +
View file
_service:tar_scm:backport-provide-openssl-apis-related-to-SM-for-python.patch
Changed
@@ -1,8 +1,9 @@ -From 71b6df9392d424efcdc422b175e3737f33c36c6e Mon Sep 17 00:00:00 2001 -From: desert-sailor <dxwangk@isoftstone.com> -Date: Mon, 22 May 2023 03:47:32 +0800 +From 52325495900f1bd9e1f228f24c81c0746520dc85 Mon Sep 17 00:00:00 2001 +From: hanxinke <hanxinke@huawei.com> +Date: Tue, 3 Aug 2021 10:45:22 +0800 Subject: PATCH provide openssl apis related to SM for python +Signed-off-by: hanxinke <hanxinke@huawei.com> --- src/_cffi_src/openssl/evp.py | 7 +++++++ 1 file changed, 7 insertions(+)
View file
_service:tar_scm:backport-raise-an-exception-instead-of-returning-an-empty-list-for-pkcs7-cert-loading.patch
Added
@@ -0,0 +1,70 @@ +From 6e9dc67ed5d8151d5b7604ad1a97b57cd367e028 Mon Sep 17 00:00:00 2001 +From: Paul Kehrer <paul.l.kehrer@gmail.com> +Date: Sun, 5 Nov 2023 19:36:55 +0800 +Subject: PATCH raise an exception instead of returning an empty list for + pkcs7 cert loading (#9947) + +* raise an exception instead of returning an empty list + +as davidben points out in #9926 we are calling a specific load +certificates function and an empty value doesn't necessarily mean empty +because PKCS7 contains multitudes. erroring is more correct. + +* changelog + +* Update CHANGELOG.rst + +Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com> + +--------- + +Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com> +--- + src/cryptography/hazmat/backends/openssl/backend.py | 7 +++++-- + tests/hazmat/primitives/test_pkcs7.py | 6 +++--- + 2 files changed, 8 insertions(+), 5 deletions(-) + +diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py +index 58e7207..d42220f 100644 +--- a/src/cryptography/hazmat/backends/openssl/backend.py ++++ b/src/cryptography/hazmat/backends/openssl/backend.py +@@ -2383,12 +2383,15 @@ class Backend: + _Reasons.UNSUPPORTED_SERIALIZATION, + ) + +- certs: listx509.Certificate = + if p7.d.sign == self._ffi.NULL: +- return certs ++ raise ValueError( ++ "The provided PKCS7 has no certificate data, but a cert " ++ "loading method was called." ++ ) + + sk_x509 = p7.d.sign.cert + num = self._lib.sk_X509_num(sk_x509) ++ certs: listx509.Certificate = + for i in range(num): + x509 = self._lib.sk_X509_value(sk_x509, i) + self.openssl_assert(x509 != self._ffi.NULL) +diff --git a/tests/hazmat/primitives/test_pkcs7.py b/tests/hazmat/primitives/test_pkcs7.py +index d8170bf..44c1d8d 100644 +--- a/tests/hazmat/primitives/test_pkcs7.py ++++ b/tests/hazmat/primitives/test_pkcs7.py +@@ -89,11 +89,11 @@ class TestPKCS7Loading: + mode="rb", + ) + +- def test_load_pkcs7_empty_certificates(self, backend): ++ def test_load_pkcs7_empty_certificates(self): + der = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02" + +- certificates = pkcs7.load_der_pkcs7_certificates(der) +- assert certificates == ++ with pytest.raises(ValueError): ++ pkcs7.load_der_pkcs7_certificates(der) + + + # We have no public verification API and won't be adding one until we get +-- +2.33.0 +
View file
_service
Changed
@@ -2,7 +2,7 @@ <service name="tar_scm"> <param name="url">git@gitee.com:src-openeuler/python-cryptography.git</param> <param name="scm">git</param> - <param name="revision">openEuler-23.09</param> + <param name="revision">master</param> <param name="exclude">*</param> <param name="extract">*</param> </service>
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.
浙ICP备2022010568号-2