Content-Transfer-Encoding: 7bit
Content-Type: multipart/mixed; boundary="_----------=_1596453093162620"
MIME-Version: 1.0
Date: Mon, 3 Aug 2020 11:11:33 +0000
From: "Thomas Klausner" <wiz@netbsd.org>
Subject: CVS commit: pkgsrc/lang/python37
To: pkgsrc-changes@NetBSD.org
Reply-To: wiz@netbsd.org
Message-Id: <20200803111133.8EBD4FB28@cvs.NetBSD.org>
Sender: pkgsrc-changes-owner@NetBSD.org
Precedence: bulk

This is a multi-part message in MIME format.

--_----------=_1596453093162620
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="US-ASCII"

Module Name:	pkgsrc
Committed By:	wiz
Date:		Mon Aug  3 11:11:33 UTC 2020

Modified Files:
	pkgsrc/lang/python37: Makefile distinfo
Added Files:
	pkgsrc/lang/python37/patches: patch-Lib_ipaddress.py
	    patch-Lib_test_test__ipaddress.py

Log Message:
python37: fix CVE-2020-14422 using upstream patch

Bump PKGREVISION.


To generate a diff of this commit:
cvs rdiff -u -r1.17 -r1.18 pkgsrc/lang/python37/Makefile
cvs rdiff -u -r1.16 -r1.17 pkgsrc/lang/python37/distinfo
cvs rdiff -u -r0 -r1.1 pkgsrc/lang/python37/patches/patch-Lib_ipaddress.py \
    pkgsrc/lang/python37/patches/patch-Lib_test_test__ipaddress.py

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


--_----------=_1596453093162620
Content-Disposition: inline
Content-Length: 4528
Content-Transfer-Encoding: binary
Content-Type: text/x-diff; charset=us-ascii

Modified files:

Index: pkgsrc/lang/python37/Makefile
diff -u pkgsrc/lang/python37/Makefile:1.17 pkgsrc/lang/python37/Makefile:1.18
--- pkgsrc/lang/python37/Makefile:1.17	Thu May 21 17:25:13 2020
+++ pkgsrc/lang/python37/Makefile	Mon Aug  3 11:11:33 2020
@@ -1,8 +1,9 @@
-# $NetBSD: Makefile,v 1.17 2020/05/21 17:25:13 leot Exp $
+# $NetBSD: Makefile,v 1.18 2020/08/03 11:11:33 wiz Exp $
 
 .include "dist.mk"
 
 PKGNAME=	python37-${PY_DISTVERSION}
+PKGREVISION=	1
 CATEGORIES=	lang python
 
 MAINTAINER=	pkgsrc-users@NetBSD.org

Index: pkgsrc/lang/python37/distinfo
diff -u pkgsrc/lang/python37/distinfo:1.16 pkgsrc/lang/python37/distinfo:1.17
--- pkgsrc/lang/python37/distinfo:1.16	Tue Jun 30 05:56:02 2020
+++ pkgsrc/lang/python37/distinfo	Mon Aug  3 11:11:33 2020
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.16 2020/06/30 05:56:02 adam Exp $
+$NetBSD: distinfo,v 1.17 2020/08/03 11:11:33 wiz Exp $
 
 SHA1 (Python-3.7.8.tar.xz) = ecfc1d291ab35bb7cc3a352dd9451450266f5974
 RMD160 (Python-3.7.8.tar.xz) = 67af3c8cbdfbadd49bbbb56690b3da90799dc687
@@ -8,7 +8,9 @@ SHA1 (patch-Lib_ctypes_util.py) = 032cc9
 SHA1 (patch-Lib_distutils_command_install.py) = 6fc6f5d918b7581fc62cd0fe55857ee932c3a341
 SHA1 (patch-Lib_distutils_sysconfig.py) = 6822eafb4dfded86d7f7353831816aeb8119e6cf
 SHA1 (patch-Lib_distutils_unixccompiler.py) = 2e65a8dd5dd3fe25957206c062106fa7a6fc4e69
+SHA1 (patch-Lib_ipaddress.py) = cf3a5f76567875e74461fd87d6089494000611dc
 SHA1 (patch-Lib_sysconfig.py) = a4f009ed73ebbd9d9c4bf7e12b7981182ed8fd7c
+SHA1 (patch-Lib_test_test__ipaddress.py) = b7b5cf9445c5fb1e20d957e7a271802ad4854ab1
 SHA1 (patch-Makefile.pre.in) = 1393dac225c5a7edcb7947eb707b4526ea884f95
 SHA1 (patch-Modules_makesetup) = a06786eebffadecedba5e3a50a9785fb47613567
 SHA1 (patch-Modules_nismodule.c) = 1bafe9b06359586d027a77011b103877590d947d

Added files:

Index: pkgsrc/lang/python37/patches/patch-Lib_ipaddress.py
diff -u /dev/null pkgsrc/lang/python37/patches/patch-Lib_ipaddress.py:1.1
--- /dev/null	Mon Aug  3 11:11:33 2020
+++ pkgsrc/lang/python37/patches/patch-Lib_ipaddress.py	Mon Aug  3 11:11:33 2020
@@ -0,0 +1,26 @@
+$NetBSD: patch-Lib_ipaddress.py,v 1.1 2020/08/03 11:11:33 wiz Exp $
+
+Fix for CVE-2020-14422
+
+https://github.com/python/cpython/commit/b98e7790c77a4378ec4b1c71b84138cb930b69b7
+
+--- Lib/ipaddress.py.orig	2020-06-27 08:35:53.000000000 +0000
++++ Lib/ipaddress.py
+@@ -1442,7 +1442,7 @@ class IPv4Interface(IPv4Address):
+             return False
+ 
+     def __hash__(self):
+-        return self._ip ^ self._prefixlen ^ int(self.network.network_address)
++        return hash((self._ip, self._prefixlen, int(self.network.network_address)))
+ 
+     __reduce__ = _IPAddressBase.__reduce__
+ 
+@@ -2088,7 +2088,7 @@ class IPv6Interface(IPv6Address):
+             return False
+ 
+     def __hash__(self):
+-        return self._ip ^ self._prefixlen ^ int(self.network.network_address)
++        return hash((self._ip, self._prefixlen, int(self.network.network_address)))
+ 
+     __reduce__ = _IPAddressBase.__reduce__
+ 
Index: pkgsrc/lang/python37/patches/patch-Lib_test_test__ipaddress.py
diff -u /dev/null pkgsrc/lang/python37/patches/patch-Lib_test_test__ipaddress.py:1.1
--- /dev/null	Mon Aug  3 11:11:33 2020
+++ pkgsrc/lang/python37/patches/patch-Lib_test_test__ipaddress.py	Mon Aug  3 11:11:33 2020
@@ -0,0 +1,26 @@
+$NetBSD: patch-Lib_test_test__ipaddress.py,v 1.1 2020/08/03 11:11:33 wiz Exp $
+
+Fix for CVE-2020-14422
+
+https://github.com/python/cpython/commit/b98e7790c77a4378ec4b1c71b84138cb930b69b7
+
+--- Lib/test/test_ipaddress.py.orig	2020-06-27 08:35:53.000000000 +0000
++++ Lib/test/test_ipaddress.py
+@@ -2091,6 +2091,17 @@ class IpaddrUnitTest(unittest.TestCase):
+                          sixtofouraddr.sixtofour)
+         self.assertFalse(bad_addr.sixtofour)
+ 
++    # issue41004 Hash collisions in IPv4Interface and IPv6Interface
++    def testV4HashIsNotConstant(self):
++        ipv4_address1 = ipaddress.IPv4Interface("1.2.3.4")
++        ipv4_address2 = ipaddress.IPv4Interface("2.3.4.5")
++        self.assertNotEqual(ipv4_address1.__hash__(), ipv4_address2.__hash__())
++
++    # issue41004 Hash collisions in IPv4Interface and IPv6Interface
++    def testV6HashIsNotConstant(self):
++        ipv6_address1 = ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:1")
++        ipv6_address2 = ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:2")
++        self.assertNotEqual(ipv6_address1.__hash__(), ipv6_address2.__hash__())
+ 
+ if __name__ == '__main__':
+     unittest.main()


--_----------=_1596453093162620--