Skip to content

Commit 4682b0f

Browse files
prashant1221tapakund
prashant1221
authored and
tapakund
committed
python3-requests: Fix functionality break introduced by CVE-2024-35195
CVE-2024-35195 fix in python3-requests breaks docker-py This patch addresses the issue Upstream discussion: requests: psf/requests#6710 docker: docker/docker-py#3256 Update python3-pip as it uses vulnerable requests Change-Id: I1ff994a17c12711e118fd29455adfbe455ef4897 Reviewed-on: http://photon-gerrit.lvn.broadcom.net/c/photon/+/25066 Reviewed-by: Shreenidhi Shedi <shreenidhi.shedi@broadcom.com> Tested-by: Shreenidhi Shedi <shreenidhi.shedi@broadcom.com> Reviewed-by: Tapas Kundu <tapas.kundu@broadcom.com>
1 parent c569cdc commit 4682b0f

17 files changed

Lines changed: 433 additions & 110 deletions

‎SPECS/asciidoc3/asciidoc3.spec‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Summary: AsciiDoc is a human readable text document format
44
Name: asciidoc3
55
Version: 3.2.3
6-
Release: 4%{?dist}
6+
Release: 5%{?dist}
77
URL: https://gitlab.com/asciidoc3/asciidoc3
88
Group: System Environment/Development
99
Vendor: VMware, Inc.
@@ -60,6 +60,8 @@ rm -rf %{buildroot}/*
6060
%{_bindir}/*
6161

6262
%changelog
63+
* Tue Jan 28 2025 Prashant S Chauhan <prashant.singh-chauhan@broadcom.com> 3.2.3-5
64+
- Bump up release as part of python3-pip upgrade
6365
* Wed Dec 11 2024 HarinadhD <harinadh.dommaraju@broadcom.com> 3.2.3-4
6466
- Release bump for SRP compliance
6567
* Tue Jan 09 2024 Prashant S Chauhan <psinghchauha@vmware.com> 3.2.3-3

‎SPECS/docker-py/docker-py.spec‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Name: docker-py3
22
Version: 6.0.0
3-
Release: 5%{?dist}
3+
Release: 6%{?dist}
44
Summary: Python API for docker
55
Group: Development/Languages/Python
66
Vendor: VMware, Inc.
@@ -13,6 +13,8 @@ Source0: https://github.com/docker/docker-py/releases/download/%{version}/docker
1313
Source1: license.txt
1414
%include %{SOURCE1}
1515

16+
Patch0: fix-for-requests.patch
17+
1618
BuildRequires: python3-devel
1719
BuildRequires: python3-ipaddress
1820
BuildRequires: python3-pip
@@ -34,7 +36,7 @@ Requires: python3
3436
Requires: docker-pycreds3
3537
Requires: python3-backports.ssl_match_hostname
3638
Requires: python3-ipaddress
37-
Requires: python3-requests
39+
Requires: python3-requests >= 2.28.1-7
3840
Requires: python3-six
3941
Requires: python3-websocket-client
4042

@@ -65,6 +67,8 @@ rm -rf %{buildroot}/*
6567
%{python3_sitelib}/*
6668

6769
%changelog
70+
* Wed Jan 15 2025 Prashant S Chauhan <prashant.singh-chauhan@broadcom.com> 6.0.0-6
71+
- Fix functionality break introduced by CVE-2024-35195 in python3-requests
6872
* Wed Dec 11 2024 Guruswamy Basavaiah <guruswamy.basavaiah@broadcom.com> 6.0.0-5
6973
- Release bump for SRP compliance
7074
* Fri Nov 22 2024 Prashant S Chauhan <prashant.singh-chauhan@broadcom.com> 6.0.0-4

‎SPECS/docker-py/fix-for-requests.patch‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
From e33e0a437ecd895158c8cb4322a0cdad79312636 Mon Sep 17 00:00:00 2001
2+
From: Felix Fontein <felix@fontein.de>
3+
Date: Mon, 20 May 2024 21:13:41 +0200
4+
Subject: Hotfix for requests 2.32.2+.
5+
6+
diff --git a/docker/transport/basehttpadapter.py b/docker/transport/basehttpadapter.py
7+
index dfbb193..2301b6b 100644
8+
--- a/docker/transport/basehttpadapter.py
9+
+++ b/docker/transport/basehttpadapter.py
10+
@@ -6,3 +6,8 @@ class BaseHTTPAdapter(requests.adapters.HTTPAdapter):
11+
super().close()
12+
if hasattr(self, 'pools'):
13+
self.pools.clear()
14+
+
15+
+ # Fix for requests 2.32.2+:
16+
+ # https://github.com/psf/requests/commit/c98e4d133ef29c46a9b68cd783087218a8075e05
17+
+ def get_connection_with_tls_context(self, request, verify, proxies=None, cert=None):
18+
+ return self.get_connection(request.url, proxies)

‎SPECS/python-pyudev/python-pyudev.spec‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Python binding for libudev
22
Name: python3-pyudev
33
Version: 0.23.2
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
Group: Development/Languages/Python
66
URL: https://pypi.org/project/pyudev
77
Source0: pyudev-%{version}.tar.gz
@@ -19,7 +19,6 @@ BuildRequires: python3-xml
1919
BuildRequires: systemd-devel
2020
Requires: systemd
2121
Requires: python3
22-
Requires: python3-pip
2322
Requires: python3-six
2423
%if 0%{?with_check}
2524
BuildRequires: python3-pip
@@ -60,9 +59,11 @@ python3 setup.py test
6059
%{python3_sitelib}/*
6160

6261
%changelog
63-
* Wed Dec 11 2024 Prashant S Chauhan <prashant.singh-chauhan@broadcom.com> 0.23.2-2
64-
- Release bump for SRP compliance
65-
* Sun Aug 21 2022 Gerrit Photon <photon-checkins@vmware.com> 0.23.2-1
66-
- Automatic Version Bump
67-
* Thu Mar 19 2020 Tapas Kundu <tkundu@vmware.com> 0.22.0-1
68-
- Initial release.
62+
* Tue Feb 04 2025 Prashant S Chauhan <prashant.singh-chauhan@broadcom.com> 0.23.2-3
63+
- Remove pip from Requires
64+
* Wed Dec 11 2024 Prashant S Chauhan <prashant.singh-chauhan@broadcom.com> 0.23.2-2
65+
- Release bump for SRP compliance
66+
* Sun Aug 21 2022 Gerrit Photon <photon-checkins@vmware.com> 0.23.2-1
67+
- Automatic Version Bump
68+
* Thu Mar 19 2020 Tapas Kundu <tkundu@vmware.com> 0.22.0-1
69+
- Initial release.

‎SPECS/python-requests-unixsocket/fix-for-requests.patch‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
From 8b02ed531d8def03b4cf767e8a925be09db43dff Mon Sep 17 00:00:00 2001
2+
From: Simon Deziel <simon.deziel@canonical.com>
3+
Date: Wed, 22 May 2024 12:02:20 -0400
4+
Subject: [PATCH] adapters: fix for requests 2.32.2+
5+
6+
Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
7+
---
8+
requests_unixsocket/adapters.py | 4 ++++
9+
1 file changed, 4 insertions(+)
10+
11+
diff --git a/requests_unixsocket/adapters.py b/requests_unixsocket/adapters.py
12+
index 83e1400..c3c73cc 100644
13+
--- a/requests_unixsocket/adapters.py
14+
+++ b/requests_unixsocket/adapters.py
15+
@@ -63,6 +63,10 @@ def __init__(self, timeout=60, pool_connections=25, *args, **kwargs):
16+
pool_connections, dispose_func=lambda p: p.close()
17+
)
18+
19+
+ # Fix for requests 2.32.2+: https://github.com/psf/requests/pull/6710
20+
+ def get_connection_with_tls_context(self, request, verify, proxies=None, cert=None):
21+
+ return self.get_connection(request.url, proxies)
22+
+
23+
def get_connection(self, url, proxies=None):
24+
proxies = proxies or {}
25+
proxy = proxies.get(urlparse(url.lower()).scheme)

‎SPECS/python-requests-unixsocket/python-requests-unixsocket.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
Name: python3-requests-unixsocket
44
Version: 0.3.0
5-
Release: 3%{?dist}
5+
Release: 4%{?dist}
66
Summary: Use requests to talk HTTP via a UNIX domain socket
77
Url: https://pypi.org/project/requests-unixsocket
88
Group: Development/Languages/Python
@@ -15,6 +15,8 @@ Source0: https://files.pythonhosted.org/packages/c3/ea/0fb87f844d8a35ff0dcc8b941
1515
Source1: license.txt
1616
%include %{SOURCE1}
1717

18+
Patch0: fix-for-requests.patch
19+
1820
BuildRequires: python3-devel
1921
BuildRequires: python3-pbr
2022
BuildRequires: python3-setuptools
@@ -26,6 +28,7 @@ BuildRequires: python3-pytest
2628
%endif
2729

2830
Requires: python3
31+
Requires: python3-requests >= 2.28.1-7
2932

3033
BuildArch: noarch
3134

@@ -56,6 +59,8 @@ rm -rf %{buildroot}/*
5659
%{python3_sitelib}/*
5760

5861
%changelog
62+
* Tue Jan 28 2025 Prashant S Chauhan <prashant.singh-chauhan@broadcom.com> 0.3.0-4
63+
- Fix functionality break introduced by CVE-2024-35195 in python3-requests
5964
* Wed Dec 11 2024 Prashant S Chauhan <prashant.singh-chauhan@broadcom.com> 0.3.0-3
6065
- Release bump for SRP compliance
6166
* Mon Jun 03 2024 Prashant S Chauhan <prashant.singh-chauhan@broadcom.com> 0.3.0-2

0 commit comments

Comments
 (0)