Subject: python2.6: CVE-2011-1521 - Vulnerability in urllib/urllib2 Package: python2.6-minimal Version: 2.6.6-8+b1 Severity: important
(patch attached) http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-1521 Vulnerability CVE-2011-1521, allowing remote web servers to redirect to a file on the local host, fixed in python 2.6.7, is missing from Debian squeeze and so make all software using urllib/urllib2 to access a remote server vulnerable. An easy way to DOS a system using this is to send it an url redirecting to file:///dev/random that will block even for a few bytes read() calls I've attached an updated patch that applies to the last squeeze source Original patch is available here: http://hg.python.org/cpython/rev/c15ab33017ff -- System Information: Debian Release: 6.0.7 APT prefers stable APT policy: (500, 'stable') Architecture: i386 (i686) Versions of packages python2.6-minimal depends on: ii libc6 2.11.3-4 Embedded GNU C Library: Shared lib ii libssl0.9.8 0.9.8o-4squeeze14 SSL shared libraries ii zlib1g 1:1.2.3.4.dfsg-3 compression library - runtime Versions of packages python2.6-minimal recommends: ii python2.6 2.6.6-8+b1 An interactive high-level object-o Versions of packages python2.6-minimal suggests: pn binfmt-support <none> (no description available) -- no debconf information -- Romuald Brunet Gandi.net
# HG changeset patch
# User gu...@google.com
# Date 1301420903 25200
# Branch 2.6
# Node ID c15ab33017ff1314380c077acc0ea1781cd63ac2
# Parent b99c94261225aa86802aa14918ca64e97969bedd
# Parent 92293101839cc8a0ff34c6b0b9fdd8f7741eecaf
Merge urllib/urllib2 security fix from 2.5 branch.
--- a/Lib/test/test_urllib.py
+++ b/Lib/test/test_urllib.py
@@ -162,6 +162,20 @@
finally:
self.unfakehttp()
+ def test_invalid_redirect(self):
+ # urlopen() should raise IOError for many error codes.
+ self.fakehttp("""HTTP/1.1 302 Found
+Date: Wed, 02 Jan 2008 03:03:54 GMT
+Server: Apache/1.3.33 (Debian GNU/Linux) mod_ssl/2.8.22 OpenSSL/0.9.7e
+Location: file:README
+Connection: close
+Content-Type: text/html; charset=iso-8859-1
+""")
+ try:
+ self.assertRaises(IOError, urllib.urlopen, "http://python.org/";)
+ finally:
+ self.unfakehttp()
+
def test_empty_socket(self):
# urlopen() raises IOError if the underlying socket does not send any
# data. (#1680230)
--- a/Lib/test/test_urllib2.py
+++ b/Lib/test/test_urllib2.py
@@ -942,6 +942,28 @@
self.assertEqual(count,
urllib2.HTTPRedirectHandler.max_redirections)
+ def test_invalid_redirect(self):
+ from_url = "http://example.com/a.html";
+ valid_schemes = ['http', 'https', 'ftp']
+ invalid_schemes = ['file', 'imap', 'ldap']
+ schemeless_url = "example.com/b.html"
+ h = urllib2.HTTPRedirectHandler()
+ o = h.parent = MockOpener()
+ req = Request(from_url)
+ req.timeout = socket._GLOBAL_DEFAULT_TIMEOUT
+
+ for scheme in invalid_schemes:
+ invalid_url = scheme + '://' + schemeless_url
+ self.assertRaises(urllib2.HTTPError, h.http_error_302,
+ req, MockFile(), 302, "Security Loophole",
+ MockHeaders({"location": invalid_url}))
+
+ for scheme in valid_schemes:
+ valid_url = scheme + '://' + schemeless_url
+ h.http_error_302(req, MockFile(), 302, "That's fine",
+ MockHeaders({"location": valid_url}))
+ self.assertEqual(o.req.get_full_url(), valid_url)
+
def test_cookie_redirect(self):
# cookies shouldn't leak into redirected requests
from cookielib import CookieJar
--- a/Lib/urllib.py
+++ b/Lib/urllib.py
@@ -652,6 +652,18 @@
fp.close()
# In case the server sent a relative URL, join with original:
newurl = basejoin(self.type + ":" + url, newurl)
+
+ # For security reasons we do not allow redirects to protocols
+ # other than HTTP, HTTPS or FTP.
+ newurl_lower = newurl.lower()
+ if not (newurl_lower.startswith('http://') or
+ newurl_lower.startswith('https://') or
+ newurl_lower.startswith('ftp://')):
+ raise IOError('redirect error', errcode,
+ errmsg + " - Redirection to url '%s' is not allowed" %
+ newurl,
+ headers)
+
return self.open(newurl)
def http_error_301(self, url, fp, errcode, errmsg, headers, data=None):
--- a/Lib/urllib2.py
+++ b/Lib/urllib2.py
@@ -578,6 +578,17 @@
newurl = urlparse.urljoin(req.get_full_url(), newurl)
+ # For security reasons we do not allow redirects to protocols
+ # other than HTTP, HTTPS or FTP.
+ newurl_lower = newurl.lower()
+ if not (newurl_lower.startswith('http://') or
+ newurl_lower.startswith('https://') or
+ newurl_lower.startswith('ftp://')):
+ raise HTTPError(newurl, code,
+ msg + " - Redirection to url '%s' is not allowed" %
+ newurl,
+ headers, fp)
+
# XXX Probably want to forget about the state of the current
# request, although that might interact poorly with other
# handlers that also use handler-specific request attributes
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -15,6 +15,8 @@
Library
-------
+- Issue #11662: Make urllib and urllib2 ignore redirections if the
+ scheme is not HTTP, HTTPS or FTP (CVE-2011-1521).
What's New in Python 2.6.6 rc 2?
================================
signature.asc
Description: This is a digitally signed message part
