diff --git a/SPECS/python3/CVE-2026-1502.patch b/SPECS/python3/CVE-2026-1502.patch new file mode 100644 index 00000000000..978a14df77d --- /dev/null +++ b/SPECS/python3/CVE-2026-1502.patch @@ -0,0 +1,116 @@ +From b7ecd4953177333a5992ce6f3294954e48b5153c Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <31488909+miss-islington@users.noreply.github.com> +Date: Tue, 21 Apr 2026 09:49:37 +0200 +Subject: [PATCH] gh-146211: Reject CR/LF in HTTP tunnel request headers + (GH-146212) (#148342) + +gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146212) +(cherry picked from commit 05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69) + +Co-authored-by: Seth Larson +Co-authored-by: Illia Volochii +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2ed.patch +--- + Lib/http/client.py | 11 ++++- + Lib/test/test_httplib.py | 45 +++++++++++++++++++ + ...-03-20-09-29-42.gh-issue-146211.PQVbs7.rst | 2 + + 3 files changed, 57 insertions(+), 1 deletion(-) + create mode 100644 Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst + +diff --git a/Lib/http/client.py b/Lib/http/client.py +index 70451d6..7db4807 100644 +--- a/Lib/http/client.py ++++ b/Lib/http/client.py +@@ -972,13 +972,22 @@ class HTTPConnection: + return ip + + def _tunnel(self): ++ if _contains_disallowed_url_pchar_re.search(self._tunnel_host): ++ raise ValueError('Tunnel host can\'t contain control characters %r' ++ % (self._tunnel_host,)) + connect = b"CONNECT %s:%d %s\r\n" % ( + self._wrap_ipv6(self._tunnel_host.encode("idna")), + self._tunnel_port, + self._http_vsn_str.encode("ascii")) + headers = [connect] + for header, value in self._tunnel_headers.items(): +- headers.append(f"{header}: {value}\r\n".encode("latin-1")) ++ header_bytes = header.encode("latin-1") ++ value_bytes = value.encode("latin-1") ++ if not _is_legal_header_name(header_bytes): ++ raise ValueError('Invalid header name %r' % (header_bytes,)) ++ if _is_illegal_header_value(value_bytes): ++ raise ValueError('Invalid header value %r' % (value_bytes,)) ++ headers.append(b"%s: %s\r\n" % (header_bytes, value_bytes)) + headers.append(b"\r\n") + # Making a single send() call instead of one per line encourages + # the host OS to use a more optimal packet size instead of +diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py +index e46dac0..e027d93 100644 +--- a/Lib/test/test_httplib.py ++++ b/Lib/test/test_httplib.py +@@ -369,6 +369,51 @@ class HeaderTests(TestCase): + with self.assertRaisesRegex(ValueError, 'Invalid header'): + conn.putheader(name, value) + ++ def test_invalid_tunnel_headers(self): ++ cases = ( ++ ('Invalid\r\nName', 'ValidValue'), ++ ('Invalid\rName', 'ValidValue'), ++ ('Invalid\nName', 'ValidValue'), ++ ('\r\nInvalidName', 'ValidValue'), ++ ('\rInvalidName', 'ValidValue'), ++ ('\nInvalidName', 'ValidValue'), ++ (' InvalidName', 'ValidValue'), ++ ('\tInvalidName', 'ValidValue'), ++ ('Invalid:Name', 'ValidValue'), ++ (':InvalidName', 'ValidValue'), ++ ('ValidName', 'Invalid\r\nValue'), ++ ('ValidName', 'Invalid\rValue'), ++ ('ValidName', 'Invalid\nValue'), ++ ('ValidName', 'InvalidValue\r\n'), ++ ('ValidName', 'InvalidValue\r'), ++ ('ValidName', 'InvalidValue\n'), ++ ) ++ for name, value in cases: ++ with self.subTest((name, value)): ++ conn = client.HTTPConnection('example.com') ++ conn.set_tunnel('tunnel', headers={ ++ name: value ++ }) ++ conn.sock = FakeSocket('') ++ with self.assertRaisesRegex(ValueError, 'Invalid header'): ++ conn._tunnel() # Called in .connect() ++ ++ def test_invalid_tunnel_host(self): ++ cases = ( ++ 'invalid\r.host', ++ '\ninvalid.host', ++ 'invalid.host\r\n', ++ 'invalid.host\x00', ++ 'invalid host', ++ ) ++ for tunnel_host in cases: ++ with self.subTest(tunnel_host): ++ conn = client.HTTPConnection('example.com') ++ conn.set_tunnel(tunnel_host) ++ conn.sock = FakeSocket('') ++ with self.assertRaisesRegex(ValueError, 'Tunnel host can\'t contain control characters'): ++ conn._tunnel() # Called in .connect() ++ + def test_headers_debuglevel(self): + body = ( + b'HTTP/1.1 200 OK\r\n' +diff --git a/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst b/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst +new file mode 100644 +index 0000000..4993633 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst +@@ -0,0 +1,2 @@ ++Reject CR/LF characters in tunnel request headers for the ++HTTPConnection.set_tunnel() method. +-- +2.45.4 + diff --git a/SPECS/python3/python3.spec b/SPECS/python3/python3.spec index c93aee1af4c..27eaa219180 100644 --- a/SPECS/python3/python3.spec +++ b/SPECS/python3/python3.spec @@ -6,7 +6,7 @@ Summary: A high-level scripting language Name: python3 Version: 3.12.9 -Release: 10%{?dist} +Release: 11%{?dist} License: PSF Vendor: Microsoft Corporation Distribution: Azure Linux @@ -31,6 +31,7 @@ Patch11: CVE-2026-0672.patch Patch12: CVE-2026-0865.patch Patch13: CVE-2026-1299.patch Patch14: CVE-2026-4519.patch +Patch15: CVE-2026-1502.patch BuildRequires: bzip2-devel BuildRequires: expat-devel >= 2.1.0 @@ -253,6 +254,9 @@ rm -rf %{buildroot}%{_bindir}/__pycache__ %{_libdir}/python%{majmin}/test/* %changelog +* Thu May 14 2026 Azure Linux Security Servicing Account - 3.12.9-11 +- Patch for CVE-2026-1502 + * Wed Mar 25 2026 Azure Linux Security Servicing Account - 3.12.9-10 - Patch for CVE-2026-4519 diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 594c1d5b9c5..983c01b6e7e 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -244,9 +244,9 @@ ca-certificates-base-3.0.0-14.azl3.noarch.rpm ca-certificates-3.0.0-14.azl3.noarch.rpm dwz-0.14-2.azl3.aarch64.rpm unzip-6.0-22.azl3.aarch64.rpm -python3-3.12.9-10.azl3.aarch64.rpm -python3-devel-3.12.9-10.azl3.aarch64.rpm -python3-libs-3.12.9-10.azl3.aarch64.rpm +python3-3.12.9-11.azl3.aarch64.rpm +python3-devel-3.12.9-11.azl3.aarch64.rpm +python3-libs-3.12.9-11.azl3.aarch64.rpm python3-setuptools-69.0.3-5.azl3.noarch.rpm python3-pygments-2.7.4-2.azl3.noarch.rpm which-2.21-8.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index 4752b06361a..ebeece682b9 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -244,9 +244,9 @@ ca-certificates-base-3.0.0-14.azl3.noarch.rpm ca-certificates-3.0.0-14.azl3.noarch.rpm dwz-0.14-2.azl3.x86_64.rpm unzip-6.0-22.azl3.x86_64.rpm -python3-3.12.9-10.azl3.x86_64.rpm -python3-devel-3.12.9-10.azl3.x86_64.rpm -python3-libs-3.12.9-10.azl3.x86_64.rpm +python3-3.12.9-11.azl3.x86_64.rpm +python3-devel-3.12.9-11.azl3.x86_64.rpm +python3-libs-3.12.9-11.azl3.x86_64.rpm python3-setuptools-69.0.3-5.azl3.noarch.rpm python3-pygments-2.7.4-2.azl3.noarch.rpm which-2.21-8.azl3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index 475c5fb72d2..32a8bf7e644 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -531,19 +531,19 @@ pyproject-rpm-macros-1.12.0-2.azl3.noarch.rpm pyproject-srpm-macros-1.12.0-2.azl3.noarch.rpm python-markupsafe-debuginfo-2.1.3-1.azl3.aarch64.rpm python-wheel-wheel-0.43.0-2.azl3.noarch.rpm -python3-3.12.9-10.azl3.aarch64.rpm +python3-3.12.9-11.azl3.aarch64.rpm python3-audit-3.1.2-1.azl3.aarch64.rpm python3-cracklib-2.9.11-1.azl3.aarch64.rpm -python3-curses-3.12.9-10.azl3.aarch64.rpm +python3-curses-3.12.9-11.azl3.aarch64.rpm python3-Cython-3.0.5-3.azl3.aarch64.rpm -python3-debuginfo-3.12.9-10.azl3.aarch64.rpm -python3-devel-3.12.9-10.azl3.aarch64.rpm +python3-debuginfo-3.12.9-11.azl3.aarch64.rpm +python3-devel-3.12.9-11.azl3.aarch64.rpm python3-flit-core-3.9.0-1.azl3.noarch.rpm python3-gpg-1.23.2-2.azl3.aarch64.rpm python3-jinja2-3.1.2-3.azl3.noarch.rpm python3-libcap-ng-0.8.4-1.azl3.aarch64.rpm python3-libmount-2.40.2-4.azl3.aarch64.rpm -python3-libs-3.12.9-10.azl3.aarch64.rpm +python3-libs-3.12.9-11.azl3.aarch64.rpm python3-libxml2-2.11.5-9.azl3.aarch64.rpm python3-lxml-4.9.3-2.azl3.aarch64.rpm python3-magic-5.45-1.azl3.noarch.rpm @@ -555,8 +555,8 @@ python3-pygments-2.7.4-2.azl3.noarch.rpm python3-rpm-4.18.2-1.azl3.aarch64.rpm python3-rpm-generators-14-11.azl3.noarch.rpm python3-setuptools-69.0.3-5.azl3.noarch.rpm -python3-test-3.12.9-10.azl3.aarch64.rpm -python3-tools-3.12.9-10.azl3.aarch64.rpm +python3-test-3.12.9-11.azl3.aarch64.rpm +python3-tools-3.12.9-11.azl3.aarch64.rpm python3-wheel-0.43.0-2.azl3.noarch.rpm readline-8.2-2.azl3.aarch64.rpm readline-debuginfo-8.2-2.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 3d7c2696fd6..87fe342f71f 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -539,19 +539,19 @@ pyproject-rpm-macros-1.12.0-2.azl3.noarch.rpm pyproject-srpm-macros-1.12.0-2.azl3.noarch.rpm python-markupsafe-debuginfo-2.1.3-1.azl3.x86_64.rpm python-wheel-wheel-0.43.0-2.azl3.noarch.rpm -python3-3.12.9-10.azl3.x86_64.rpm +python3-3.12.9-11.azl3.x86_64.rpm python3-audit-3.1.2-1.azl3.x86_64.rpm python3-cracklib-2.9.11-1.azl3.x86_64.rpm -python3-curses-3.12.9-10.azl3.x86_64.rpm +python3-curses-3.12.9-11.azl3.x86_64.rpm python3-Cython-3.0.5-3.azl3.x86_64.rpm -python3-debuginfo-3.12.9-10.azl3.x86_64.rpm -python3-devel-3.12.9-10.azl3.x86_64.rpm +python3-debuginfo-3.12.9-11.azl3.x86_64.rpm +python3-devel-3.12.9-11.azl3.x86_64.rpm python3-flit-core-3.9.0-1.azl3.noarch.rpm python3-gpg-1.23.2-2.azl3.x86_64.rpm python3-jinja2-3.1.2-3.azl3.noarch.rpm python3-libcap-ng-0.8.4-1.azl3.x86_64.rpm python3-libmount-2.40.2-4.azl3.x86_64.rpm -python3-libs-3.12.9-10.azl3.x86_64.rpm +python3-libs-3.12.9-11.azl3.x86_64.rpm python3-libxml2-2.11.5-9.azl3.x86_64.rpm python3-lxml-4.9.3-2.azl3.x86_64.rpm python3-magic-5.45-1.azl3.noarch.rpm @@ -563,8 +563,8 @@ python3-pygments-2.7.4-2.azl3.noarch.rpm python3-rpm-4.18.2-1.azl3.x86_64.rpm python3-rpm-generators-14-11.azl3.noarch.rpm python3-setuptools-69.0.3-5.azl3.noarch.rpm -python3-test-3.12.9-10.azl3.x86_64.rpm -python3-tools-3.12.9-10.azl3.x86_64.rpm +python3-test-3.12.9-11.azl3.x86_64.rpm +python3-tools-3.12.9-11.azl3.x86_64.rpm python3-wheel-0.43.0-2.azl3.noarch.rpm readline-8.2-2.azl3.x86_64.rpm readline-debuginfo-8.2-2.azl3.x86_64.rpm