已开启
[openEuler-22.03-LTS-SP4] backport: Fix decompression-bomb safeguards bypass in streaming API (CVE-2026-9375) #197
刘德华海淀分华创建于 6月21日
[openEuler-22.03-LTS-SP4] backport: Fix decompression-bomb safeguards bypass in streaming API (CVE-2026-9375) #197
已开启
共 2 个文件变更+88-1
| @@ -0,0 +1,80 @@ | |||
| 1 | +From 2bdcc44d1e163fb5cc48a8662425e35e15adfe6a Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Illia Volochii <illia.volochii@gmail.com> | ||
| 3 | +Date: Thu, 7 May 2026 18:39:03 +0300 | ||
| 4 | +Subject: [PATCH] Merge commit from fork | ||
| 5 | + | ||
| 6 | +* Avoid any decoding in `HTTPResponse.drain_conn` | ||
| 7 | + | ||
| 8 | +* Add a comment | ||
| 9 | + | ||
| 10 | +* Simplify `drain_conn` | ||
| 11 | + | ||
| 12 | +* Add tests | ||
| 13 | + | ||
| 14 | +* Add additional checks to the test | ||
| 15 | + | ||
| 16 | +* Fix full decompression on the 2nd small read from response using Brotli | ||
| 17 | + | ||
| 18 | +* Add a changelog entry | ||
| 19 | + | ||
| 20 | +* Inverse the order in the changelog entry | ||
| 21 | + | ||
| 22 | +* Mention `stream` call | ||
| 23 | +--- | ||
| 24 | + changelog/GHSA-mf9v-mfxr-j63j.bugfix.rst | 7 +++++++ | ||
| 25 | + src/urllib3/response.py | 17 +++++++++++------ | ||
| 26 | + test/test_response.py | 24 +++++++++++++++++++++--- | ||
| 27 | + test/with_dummyserver/test_connection.py | 19 +++++++++++++++++++ | ||
| 28 | + 4 files changed, 58 insertions(+), 9 deletions(-) | ||
| 29 | + create mode 100644 changelog/GHSA-mf9v-mfxr-j63j.bugfix.rst | ||
| 30 | + | ||
| 31 | +diff --git a/changelog/GHSA-mf9v-mfxr-j63j.bugfix.rst b/changelog/GHSA-mf9v-mfxr-j63j.bugfix.rst | ||
| 32 | +new file mode 100644 | ||
| 33 | +index 0000000000..ac70af825a | ||
| 34 | +--- /dev/null | ||
| 35 | ++++ b/changelog/GHSA-mf9v-mfxr-j63j.bugfix.rst | ||
| 36 | + | ||
| 37 | ++Fixed two high-severity security issues where decompression-bomb safeguards of the streaming API were bypassed: | ||
| 38 | ++ | ||
| 39 | ++ | ||
| 40 | ++1. When ``HTTPResponse.drain_conn()`` was called after the response had been read and decompressed partially. | ||
| 41 | ++2. During the second ``HTTPResponse.read(amt=N)`` or ``HTTPResponse.stream(amt=N)`` call when the response was decompressed using the official `Brotli <https://pypi.org/project/brotli/>`__ library. | ||
| 42 | ++ | ||
| 43 | ++See `GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>`__ for details. | ||
| 44 | +diff --git a/src/urllib3/response.py b/src/urllib3/response.py | ||
| 45 | +index 521c31b282..e9246b75e3 100644 | ||
| 46 | +--- a/src/urllib3/response.py | ||
| 47 | ++++ b/src/urllib3/response.py | ||
| 48 | + def drain_conn(self): | ||
| 49 | + Unread data in the HTTPResponse connection blocks the connection from being released back to the pool. | ||
| 50 | + """ | ||
| 51 | + try: | ||
| 52 | +- self.read( | ||
| 53 | +- # Do not spend resources decoding the content unless | ||
| 54 | +- # decoding has already been initiated. | ||
| 55 | +- decode_content=self._has_decoded_content, | ||
| 56 | +- ) | ||
| 57 | ++ self._raw_read() | ||
| 58 | + except (HTTPError, SocketError, BaseSSLError, HTTPException): | ||
| 59 | + pass | ||
| 60 | ++ if self._has_decoded_content: | ||
| 61 | ++ # `_raw_read` skips decompression, so we should clean up the | ||
| 62 | ++ # decoder to avoid keeping unnecessary data in memory. | ||
| 63 | ++ self._decoded_buffer = BytesQueueBuffer() | ||
| 64 | ++ self._decoder = None | ||
| 65 | + | ||
| 66 | + @property | ||
| 67 | + def data(self): | ||
| 68 | + def read( | ||
| 69 | + if amt is not None: | ||
| 70 | + cache_content = False | ||
| 71 | + | ||
| 72 | +- if self._decoder and self._decoder.has_unconsumed_tail: | ||
| 73 | ++ if ( | ||
| 74 | ++ self._decoder | ||
| 75 | ++ and self._decoder.has_unconsumed_tail | ||
| 76 | ++ and len(self._decoded_buffer) < amt | ||
| 77 | ++ ): | ||
| 78 | + decoded_data = self._decode( | ||
| 79 | + b"", | ||
| 80 | + decode_content, | ||
| @@ -4,7 +4,7 @@ | |||
| 4 | 4 | ||
| 5 | Name: python-%{srcname} | 5 | Name: python-%{srcname} |
| 6 | Version: 1.26.12 | 6 | Version: 1.26.12 |
| 7 | -Release: 13 | 7 | +Release: 14 |
| 8 | Summary: Sanity-friendly HTTP client for Python | 8 | Summary: Sanity-friendly HTTP client for Python |
| 9 | License: MIT | 9 | License: MIT |
| 10 | URL: https://urllib3.readthedocs.io | 10 | URL: https://urllib3.readthedocs.io |
| @@ -30,6 +30,7 @@ Patch6014: backport-CVE-2025-66471-4.patch | |||
| 30 | Patch6015: backport-CVE-2026-21441.patch | 30 | Patch6015: backport-CVE-2026-21441.patch |
| 31 | Patch6016: backport-Prevent-issue-in-HTTPResponse-.read-when-decoded_con.patch | 31 | Patch6016: backport-Prevent-issue-in-HTTPResponse-.read-when-decoded_con.patch |
| 32 | Patch6017: backport-CVE-2026-44431.patch | 32 | Patch6017: backport-CVE-2026-44431.patch |
| 33 | +Patch6018: backport-CVE-2026-9375.patch | ||
| 33 | 34 | ||
| 34 | BuildArch: noarch | 35 | BuildArch: noarch |
| 35 | 36 | ||
| @@ -95,6 +96,12 @@ PYTHONPATH=%{buildroot}%{python3_sitelib}:%{python3_sitelib} %{__python3} -m pyt | |||
| 95 | %{python3_sitelib}/urllib3-*.egg-info | 96 | %{python3_sitelib}/urllib3-*.egg-info |
| 96 | 97 | ||
| 97 | %changelog | 98 | %changelog |
| 99 | +* Sun Jun 21 2026 andy-lau <liuyang01@kylinos.cn> - 1.26.12-14 | ||
| 100 | +- Type:CVE | ||
| 101 | +- CVE:CVE-2026-9375 | ||
| 102 | +- SUG:NA | ||
| 103 | +- DESC:fix CVE-2026-9375, fix decompression-bomb safeguards bypass in streaming API | ||
| 104 | + | ||
| 98 | * Wed May 13 2026 tangce <tangce1@h-partners.com> - 1.26.12-13 | 105 | * Wed May 13 2026 tangce <tangce1@h-partners.com> - 1.26.12-13 |
| 99 | - Type:CVE | 106 | - Type:CVE |
| 100 | - CVE:CVE-2026-44431 | 107 | - CVE:CVE-2026-44431 |