diff -Nru python3.5-3.5.2/debian/changelog python3.5-3.5.2/debian/changelog --- python3.5-3.5.2/debian/changelog 2017-11-23 16:37:41.000000000 +0000 +++ python3.5-3.5.2/debian/changelog 2018-11-12 13:46:44.000000000 +0000 @@ -1,3 +1,18 @@ +python3.5 (3.5.2-2ubuntu0~16.04.5) xenial-security; urgency=medium + + * SECURITY UPDATE: DoS via catastrophic backtracking + - debian/patches/CVE-2018-106x.patch: fix expressions in + Lib/difflib.py, Lib/poplib.py. Added tests to + Lib/test/test_difflib.py, Lib/test/test_poplib.py. + - CVE-2018-1060 + - CVE-2018-1061 + * SECURITY UPDATE: incorrect Expat hash salt initialization + - debian/patches/CVE-2018-14647.patch: call SetHashSalt in + Include/pyexpat.h, Modules/_elementtree.c, Modules/pyexpat.c. + - CVE-2018-14647 + + -- Marc Deslauriers Mon, 12 Nov 2018 08:43:14 -0500 + python3.5 (3.5.2-2ubuntu0~16.04.4) xenial-security; urgency=medium * SECURITY UPDATE: integer overflow in the PyBytes_DecodeEscape diff -Nru python3.5-3.5.2/debian/patches/CVE-2018-106x.patch python3.5-3.5.2/debian/patches/CVE-2018-106x.patch --- python3.5-3.5.2/debian/patches/CVE-2018-106x.patch 1970-01-01 00:00:00.000000000 +0000 +++ python3.5-3.5.2/debian/patches/CVE-2018-106x.patch 2018-11-12 13:43:02.000000000 +0000 @@ -0,0 +1,148 @@ +From 937ac1fe069a4dc8471dff205f553d82e724015b Mon Sep 17 00:00:00 2001 +From: Ned Deily +Date: Sun, 11 Mar 2018 14:29:05 -0400 +Subject: [PATCH] [3.5] bpo-32981: Fix catastrophic backtracking vulns + (GH-5955) (#6034) + +* Prevent low-grade poplib REDOS (CVE-2018-1060) + +The regex to test a mail server's timestamp is susceptible to +catastrophic backtracking on long evil responses from the server. + +Happily, the maximum length of malicious inputs is 2K thanks +to a limit introduced in the fix for CVE-2013-1752. + +A 2KB evil response from the mail server would result in small slowdowns +(milliseconds vs. microseconds) accumulated over many apop calls. +This is a potential DOS vector via accumulated slowdowns. + +Replace it with a similar non-vulnerable regex. + +The new regex is RFC compliant. +The old regex was non-compliant in edge cases. + +* Prevent difflib REDOS (CVE-2018-1061) + +The default regex for IS_LINE_JUNK is susceptible to +catastrophic backtracking. +This is a potential DOS vector. + +Replace it with an equivalent non-vulnerable regex. + +Also introduce unit and REDOS tests for difflib. + +Co-authored-by: Tim Peters +Co-authored-by: Christian Heimes . +(cherry picked from commit 0e6c8ee2358a2e23117501826c008842acb835ac) +--- + Lib/difflib.py | 2 +- + Lib/poplib.py | 2 +- + Lib/test/test_difflib.py | 22 ++++++++++++++++++- + Lib/test/test_poplib.py | 12 +++++++++- + Misc/ACKS | 1 + + .../2018-03-02-10-24-52.bpo-32981.O_qDyj.rst | 4 ++++ + 6 files changed, 39 insertions(+), 4 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2018-03-02-10-24-52.bpo-32981.O_qDyj.rst + +Index: python3.5-3.5.2/Lib/difflib.py +=================================================================== +--- python3.5-3.5.2.orig/Lib/difflib.py 2018-11-12 08:43:00.031849024 -0500 ++++ python3.5-3.5.2/Lib/difflib.py 2018-11-12 08:43:00.027849018 -0500 +@@ -1083,7 +1083,7 @@ class Differ: + + import re + +-def IS_LINE_JUNK(line, pat=re.compile(r"\s*#?\s*$").match): ++def IS_LINE_JUNK(line, pat=re.compile(r"\s*(?:#\s*)?$").match): + r""" + Return 1 for ignorable line: iff `line` is blank or contains a single '#'. + +Index: python3.5-3.5.2/Lib/poplib.py +=================================================================== +--- python3.5-3.5.2.orig/Lib/poplib.py 2018-11-12 08:43:00.031849024 -0500 ++++ python3.5-3.5.2/Lib/poplib.py 2018-11-12 08:43:00.027849018 -0500 +@@ -305,7 +305,7 @@ class POP3: + return self._shortcmd('RPOP %s' % user) + + +- timestamp = re.compile(br'\+OK.*(<[^>]+>)') ++ timestamp = re.compile(br'\+OK.[^<]*(<.*>)') + + def apop(self, user, password): + """Authorisation +Index: python3.5-3.5.2/Lib/test/test_difflib.py +=================================================================== +--- python3.5-3.5.2.orig/Lib/test/test_difflib.py 2018-11-12 08:43:00.031849024 -0500 ++++ python3.5-3.5.2/Lib/test/test_difflib.py 2018-11-12 08:43:00.027849018 -0500 +@@ -466,13 +466,33 @@ class TestBytes(unittest.TestCase): + list(generator(*args)) + self.assertEqual(msg, str(ctx.exception)) + ++class TestJunkAPIs(unittest.TestCase): ++ def test_is_line_junk_true(self): ++ for line in ['#', ' ', ' #', '# ', ' # ', '']: ++ self.assertTrue(difflib.IS_LINE_JUNK(line), repr(line)) ++ ++ def test_is_line_junk_false(self): ++ for line in ['##', ' ##', '## ', 'abc ', 'abc #', 'Mr. Moose is up!']: ++ self.assertFalse(difflib.IS_LINE_JUNK(line), repr(line)) ++ ++ def test_is_line_junk_REDOS(self): ++ evil_input = ('\t' * 1000000) + '##' ++ self.assertFalse(difflib.IS_LINE_JUNK(evil_input)) ++ ++ def test_is_character_junk_true(self): ++ for char in [' ', '\t']: ++ self.assertTrue(difflib.IS_CHARACTER_JUNK(char), repr(char)) ++ ++ def test_is_character_junk_false(self): ++ for char in ['a', '#', '\n', '\f', '\r', '\v']: ++ self.assertFalse(difflib.IS_CHARACTER_JUNK(char), repr(char)) + + def test_main(): + difflib.HtmlDiff._default_prefix = 0 + Doctests = doctest.DocTestSuite(difflib) + run_unittest( + TestWithAscii, TestAutojunk, TestSFpatches, TestSFbugs, +- TestOutputFormat, TestBytes, Doctests) ++ TestOutputFormat, TestBytes, TestJunkAPIs, Doctests) + + if __name__ == '__main__': + test_main() +Index: python3.5-3.5.2/Lib/test/test_poplib.py +=================================================================== +--- python3.5-3.5.2.orig/Lib/test/test_poplib.py 2018-11-12 08:43:00.031849024 -0500 ++++ python3.5-3.5.2/Lib/test/test_poplib.py 2018-11-12 08:43:00.027849018 -0500 +@@ -300,9 +300,19 @@ class TestPOP3Class(TestCase): + def test_rpop(self): + self.assertOK(self.client.rpop('foo')) + +- def test_apop(self): ++ def test_apop_normal(self): + self.assertOK(self.client.apop('foo', 'dummypassword')) + ++ def test_apop_REDOS(self): ++ # Replace welcome with very long evil welcome. ++ # NB The upper bound on welcome length is currently 2048. ++ # At this length, evil input makes each apop call take ++ # on the order of milliseconds instead of microseconds. ++ evil_welcome = b'+OK' + (b'<' * 1000000) ++ with test_support.swap_attr(self.client, 'welcome', evil_welcome): ++ # The evil welcome is invalid, so apop should throw. ++ self.assertRaises(poplib.error_proto, self.client.apop, 'a', 'kb') ++ + def test_top(self): + expected = (b'+OK 116 bytes', + [b'From: postmaster@python.org', b'Content-Type: text/plain', +Index: python3.5-3.5.2/Misc/ACKS +=================================================================== +--- python3.5-3.5.2.orig/Misc/ACKS 2018-11-12 08:43:00.031849024 -0500 ++++ python3.5-3.5.2/Misc/ACKS 2018-11-12 08:43:00.031849024 -0500 +@@ -330,6 +330,7 @@ Kushal Das + Jonathan Dasteel + Pierre-Yves David + A. Jesse Jiryu Davis ++Jamie (James C.) Davis + Merlijn van Deen + John DeGood + Ned Deily diff -Nru python3.5-3.5.2/debian/patches/CVE-2018-14647.patch python3.5-3.5.2/debian/patches/CVE-2018-14647.patch --- python3.5-3.5.2/debian/patches/CVE-2018-14647.patch 1970-01-01 00:00:00.000000000 +0000 +++ python3.5-3.5.2/debian/patches/CVE-2018-14647.patch 2018-11-12 13:43:11.000000000 +0000 @@ -0,0 +1,77 @@ +From f7666e828cc3d5873136473ea36ba2013d624fa1 Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <31488909+miss-islington@users.noreply.github.com> +Date: Tue, 18 Sep 2018 06:14:13 -0700 +Subject: [PATCH] bpo-34623: Use XML_SetHashSalt in _elementtree (GH-9146) + +The C accelerated _elementtree module now initializes hash randomization +salt from _Py_HashSecret instead of libexpat's default CPRNG. + +Signed-off-by: Christian Heimes + +https://bugs.python.org/issue34623 +(cherry picked from commit cb5778f00ce48631c7140f33ba242496aaf7102b) + +Co-authored-by: Christian Heimes +--- + Include/pyexpat.h | 4 +++- + .../next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst | 2 ++ + Modules/_elementtree.c | 5 +++++ + Modules/pyexpat.c | 5 +++++ + 4 files changed, 15 insertions(+), 1 deletion(-) + create mode 100644 Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst + +Index: python3.5-3.5.2/Include/pyexpat.h +=================================================================== +--- python3.5-3.5.2.orig/Include/pyexpat.h 2018-11-12 08:43:09.135860757 -0500 ++++ python3.5-3.5.2/Include/pyexpat.h 2018-11-12 08:43:09.131860751 -0500 +@@ -3,7 +3,7 @@ + + /* note: you must import expat.h before importing this module! */ + +-#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.0" ++#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.1" + #define PyExpat_CAPSULE_NAME "pyexpat.expat_CAPI" + + struct PyExpat_CAPI +@@ -48,6 +48,8 @@ struct PyExpat_CAPI + enum XML_Status (*SetEncoding)(XML_Parser parser, const XML_Char *encoding); + int (*DefaultUnknownEncodingHandler)( + void *encodingHandlerData, const XML_Char *name, XML_Encoding *info); ++ /* might be none for expat < 2.1.0 */ ++ int (*SetHashSalt)(XML_Parser parser, unsigned long hash_salt); + /* always add new stuff to the end! */ + }; + +Index: python3.5-3.5.2/Modules/_elementtree.c +=================================================================== +--- python3.5-3.5.2.orig/Modules/_elementtree.c 2018-11-12 08:43:09.135860757 -0500 ++++ python3.5-3.5.2/Modules/_elementtree.c 2018-11-12 08:43:09.131860751 -0500 +@@ -3261,6 +3261,11 @@ _elementtree_XMLParser___init___impl(XML + PyErr_NoMemory(); + return -1; + } ++ /* expat < 2.1.0 has no XML_SetHashSalt() */ ++ if (EXPAT(SetHashSalt) != NULL) { ++ EXPAT(SetHashSalt)(self->parser, ++ (unsigned long)_Py_HashSecret.expat.hashsalt); ++ } + + if (target) { + Py_INCREF(target); +Index: python3.5-3.5.2/Modules/pyexpat.c +=================================================================== +--- python3.5-3.5.2.orig/Modules/pyexpat.c 2018-11-12 08:43:09.135860757 -0500 ++++ python3.5-3.5.2/Modules/pyexpat.c 2018-11-12 08:43:09.131860751 -0500 +@@ -1885,6 +1885,11 @@ MODULE_INITFUNC(void) + capi.SetStartDoctypeDeclHandler = XML_SetStartDoctypeDeclHandler; + capi.SetEncoding = XML_SetEncoding; + capi.DefaultUnknownEncodingHandler = PyUnknownEncodingHandler; ++#if XML_COMBINED_VERSION >= 20100 ++ capi.SetHashSalt = XML_SetHashSalt; ++#else ++ capi.SetHashSalt = NULL; ++#endif + + /* export using capsule */ + capi_object = PyCapsule_New(&capi, PyExpat_CAPSULE_NAME, NULL); diff -Nru python3.5-3.5.2/debian/patches/series python3.5-3.5.2/debian/patches/series --- python3.5-3.5.2/debian/patches/series 2017-11-23 16:36:50.000000000 +0000 +++ python3.5-3.5.2/debian/patches/series 2018-11-12 13:43:07.000000000 +0000 @@ -43,3 +43,5 @@ CVE-2016-1000110.diff bpo-27945.diff CVE-2017-1000158.patch +CVE-2018-106x.patch +CVE-2018-14647.patch