Skip to content

[22.05] python3Packages.twisted: Resolve host header injection vulnerability #201257

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
risicle merged 2 commits into from
Nov 22, 2022
Merged

[22.05] python3Packages.twisted: Resolve host header injection vulnerability #201257

risicle merged 2 commits into from
Nov 22, 2022

Conversation

@mweinelt
Copy link
Member

@mweinelt mweinelt commented Nov 14, 2022 •
edited
Loading

GHSA-vg46-2rrj-3647

Fixes: CVE-2022-39348
Fixed on master in #201130

Description of changes

Applied twisted/twisted@f2f5e81, which wouldn't fetchpatch, but worked through git am.

The checkPhase seems to be in a sorry state and I'm not convinced I can get them running quickly.

Things done
  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 22.11 Release Notes (or backporting 22.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
    • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
  • Fits CONTRIBUTING.md.

@mweinelt mweinelt changed the title python3Packages.twisted: Resolve host header injection vulnerability [22.05] python3Packages.twisted: Resolve host header injection vulnerability Nov 14, 2022
@github-actions github-actions bot added the 6.topic: python Python is a high-level, general-purpose programming language. label Nov 14, 2022
@mweinelt mweinelt added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Nov 14, 2022
@ofborg ofborg bot added 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-darwin: 1001-2500 This PR causes many rebuilds on Darwin and should most likely target the staging branches. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 1001-2500 This PR causes many rebuilds on Linux and should target the staging branches. labels Nov 14, 2022
@risicle
Copy link
Contributor

risicle commented Nov 15, 2022

Perhaps we can rely on the checkPhases of depending packages - e.g. those listed in passthru.tests in unstable (added around #168407)

@mweinelt
Copy link
Member Author

mweinelt commented Nov 15, 2022

python3.pkgs.klein is already broken on release-22.05

@mweinelt
Copy link
Member Author

mweinelt commented Nov 15, 2022

Breaks buildbot tests due to deprecation warning.

@risicle
Copy link
Contributor

risicle commented Nov 15, 2022

passthru.tests builds for me, aarch64-linux

@risicle
Copy link
Contributor

risicle commented Nov 16, 2022

Only one of those I couldn't get to build on macos 10.15 was scrapy but that just doesn't like my machine.

@risicle risicle merged commit 6eb6b9a into NixOS:staging-22.05 Nov 22, 2022
@mweinelt mweinelt deleted the 22.05/twisted branch November 22, 2022 20:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@risicle risicle risicle approved these changes

@FRidh FRidh Awaiting requested review from FRidh

@jonringer jonringer Awaiting requested review from jonringer

Assignees

No one assigned

Labels

1.severity: security Issues which raise a security issue, or PRs that fix one 6.topic: python Python is a high-level, general-purpose programming language. 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-darwin: 1001-2500 This PR causes many rebuilds on Darwin and should most likely target the staging branches. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 1001-2500 This PR causes many rebuilds on Linux and should target the staging branches.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mweinelt @risicle