已开启
fix CVE-2026-9375 #206
Liuhuiooo创建于 6月29日
fix CVE-2026-9375 #206
已开启
共 2 个文件变更+89-1
| @@ -0,0 +1,84 @@ | |||
| 1 | +From 2bdcc44d1e163fb5cc48a8662425e35e15adfe6a Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Illia Volochii <illia.volochii@gmail.com> | ||
| 3 | +Date: Thu, 7 May 2026 18:39:03 +0300 | ||
| 4 | +Subject: [PATCH] Merge commit from fork | ||
| 5 | + | ||
| 6 | +* Avoid any decoding in `HTTPResponse.drain_conn` | ||
| 7 | + | ||
| 8 | +* Add a comment | ||
| 9 | + | ||
| 10 | +* Simplify `drain_conn` | ||
| 11 | + | ||
| 12 | +* Add tests | ||
| 13 | + | ||
| 14 | +* Add additional checks to the test | ||
| 15 | + | ||
| 16 | +* Fix full decompression on the 2nd small read from response using Brotli | ||
| 17 | + | ||
| 18 | +* Add a changelog entry | ||
| 19 | + | ||
| 20 | +* Inverse the order in the changelog entry | ||
| 21 | + | ||
| 22 | +* Mention `stream` call | ||
| 23 | + | ||
| 24 | +Conflict:context adapte,test not mergerd because pre-patch not merged | ||
| 25 | +Reference:https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5c | ||
| 26 | +--- | ||
| 27 | + changelog/GHSA-mf9v-mfxr-j63j.bugfix.rst | 7 +++++++ | ||
| 28 | + src/urllib3/response.py | 17 +++++++++++------ | ||
| 29 | + 2 files changed, 18 insertions(+), 6 deletions(-) | ||
| 30 | + create mode 100644 changelog/GHSA-mf9v-mfxr-j63j.bugfix.rst | ||
| 31 | + | ||
| 32 | +diff --git a/changelog/GHSA-mf9v-mfxr-j63j.bugfix.rst b/changelog/GHSA-mf9v-mfxr-j63j.bugfix.rst | ||
| 33 | +new file mode 100644 | ||
| 34 | +index 0000000..ac70af8 | ||
| 35 | +--- /dev/null | ||
| 36 | ++++ b/changelog/GHSA-mf9v-mfxr-j63j.bugfix.rst | ||
| 37 | + | ||
| 38 | ++Fixed two high-severity security issues where decompression-bomb safeguards of the streaming API were bypassed: | ||
| 39 | ++ | ||
| 40 | ++ | ||
| 41 | ++1. When ``HTTPResponse.drain_conn()`` was called after the response had been read and decompressed partially. | ||
| 42 | ++2. During the second ``HTTPResponse.read(amt=N)`` or ``HTTPResponse.stream(amt=N)`` call when the response was decompressed using the official `Brotli <https://pypi.org/project/brotli/>`__ library. | ||
| 43 | ++ | ||
| 44 | ++See `GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>`__ for details. | ||
| 45 | +diff --git a/src/urllib3/response.py b/src/urllib3/response.py | ||
| 46 | +index a654cb2..cd8a254 100644 | ||
| 47 | +--- a/src/urllib3/response.py | ||
| 48 | ++++ b/src/urllib3/response.py | ||
| 49 | + class HTTPResponse(BaseHTTPResponse): | ||
| 50 | + Unread data in the HTTPResponse connection blocks the connection from being released back to the pool. | ||
| 51 | + """ | ||
| 52 | + try: | ||
| 53 | +- self.read( | ||
| 54 | +- # Do not spend resources decoding the content unless | ||
| 55 | +- # decoding has already been initiated. | ||
| 56 | +- decode_content=self._has_decoded_content, | ||
| 57 | +- ) | ||
| 58 | ++ self._raw_read() | ||
| 59 | + except (HTTPError, SocketError, BaseSSLError, HTTPException): | ||
| 60 | + pass | ||
| 61 | ++ if self._has_decoded_content: | ||
| 62 | ++ # `_raw_read` skips decompression, so we should clean up the | ||
| 63 | ++ # decoder to avoid keeping unnecessary data in memory. | ||
| 64 | ++ self._decoded_buffer = BytesQueueBuffer() | ||
| 65 | ++ self._decoder = None | ||
| 66 | + | ||
| 67 | + @property | ||
| 68 | + def data(self): | ||
| 69 | + class HTTPResponse(BaseHTTPResponse): | ||
| 70 | + if amt is not None: | ||
| 71 | + cache_content = False | ||
| 72 | + | ||
| 73 | +- if self._decoder and self._decoder.has_unconsumed_tail: | ||
| 74 | ++ if ( | ||
| 75 | ++ self._decoder | ||
| 76 | ++ and self._decoder.has_unconsumed_tail | ||
| 77 | ++ and len(self._decoded_buffer) < amt | ||
| 78 | ++ ): | ||
| 79 | + decoded_data = self._decode( | ||
| 80 | + b"", | ||
| 81 | + decode_content, | ||
| 82 | +-- | ||
| 83 | +2.43.0 | ||
| 84 | + | ||
| @@ -3,7 +3,7 @@ | |||
| 3 | 3 | ||
| 4 | Name: python-%{srcname} | 4 | Name: python-%{srcname} |
| 5 | Version: 1.26.18 | 5 | Version: 1.26.18 |
| 6 | -Release: 8 | 6 | +Release: 9 |
| 7 | Summary: Sanity-friendly HTTP client for Python | 7 | Summary: Sanity-friendly HTTP client for Python |
| 8 | License: MIT | 8 | License: MIT |
| 9 | URL: https://urllib3.readthedocs.io | 9 | URL: https://urllib3.readthedocs.io |
| @@ -21,6 +21,7 @@ Patch6005: backport-CVE-2025-66471-3.patch | |||
| 21 | Patch6006: backport-CVE-2026-21441.patch | 21 | Patch6006: backport-CVE-2026-21441.patch |
| 22 | Patch6007: backport-Prevent-issue-in-HTTPResponse-.read-when-decoded_con.patch | 22 | Patch6007: backport-Prevent-issue-in-HTTPResponse-.read-when-decoded_con.patch |
| 23 | Patch6008: backport-CVE-2026-44431.patch | 23 | Patch6008: backport-CVE-2026-44431.patch |
| 24 | +Patch6009: backport-CVE-2026-9375.patch | ||
| 24 | 25 | ||
| 25 | BuildArch: noarch | 26 | BuildArch: noarch |
| 26 | 27 | ||
| @@ -86,6 +87,9 @@ PYTHONPATH=%{buildroot}%{python3_sitelib}:%{python3_sitelib} %{__python3} -m pyt | |||
| 86 | %{python3_sitelib}/urllib3-*.egg-info | 87 | %{python3_sitelib}/urllib3-*.egg-info |
| 87 | 88 | ||
| 88 | %changelog | 89 | %changelog |
| 90 | +* Mon Jun 29 2026 刘慧 <2224621664@qq.com> - 1.26.18-9 | ||
| 91 | +- Fix CVE-2026-9375 | ||
| 92 | + | ||
| 89 | * Tue May 12 2026 tangce <tangce1@h-partners.com> - 1.26.18-8 | 93 | * Tue May 12 2026 tangce <tangce1@h-partners.com> - 1.26.18-8 |
| 90 | - Type:CVE | 94 | - Type:CVE |
| 91 | - CVE:CVE-2026-44431 | 95 | - CVE:CVE-2026-44431 |