mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-20 12:49:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

python3-idna: Fix CVE-2026-45409

Browse Source 
This patch applies the complete upstream fix chain for
CVE-2026-45409. Commit [1] introduces early domain-length rejection
required by [2]. Commit [2] is the v3.14 fix identified by [5], and
commit [3] extends the protection to per-label conversions and codec
support to complete the v3.15 fix described in [4].

[1] https://github.com/kjd/idna/commit/c0dda4501df5
[2] https://github.com/kjd/idna/commit/628fef84d3ed
[3] https://github.com/kjd/idna/commit/e1cb465b6376
[4] https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx
[5] https://security-tracker.debian.org/tracker/CVE-2026-45409

(From OE-Core rev: 09773d9d1b44dfe868913b6bb142a728529f62cb)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Hetvi Thakar
2026-08-19 22:56:04 -07:00
committed by Richard Purdie
parent 3ffe50e092
commit abef4d0701
4 changed files with 200 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
meta/recipes-devtools/python/python3-idna/CVE-2026-45409_p2.patch Normal file
View File

@@ -0,0 +1,48 @@
From fabb538f1885a135e48a60de2e3c656d965e861d Mon Sep 17 00:00:00 2001
From: Kim Davies <kim@cynosure.com.au>
Date: Sun, 10 May 2026 12:44:47 -0700
Subject: [PATCH 2/3] Use valid_string_length() for early oversized-input check
CVE: CVE-2026-45409
Upstream-Status: Backport [https://github.com/kjd/idna/commit/628fef84d3eda59321c21127e73dcd873db23ead]
(cherry picked from commit 628fef84d3eda59321c21127e73dcd873db23ead)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
idna/core.py | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
diff --git a/idna/core.py b/idna/core.py
index a549326..4a9fc75 100644
--- a/idna/core.py
+++ b/idna/core.py
@@ -341,12 +341,9 @@ def encode(s: Union[str, bytes, bytearray], strict: bool = False, uts46: bool =
if uts46:
s = uts46_remap(s, std3_rules, transitional)
- # Reject inputs that exceed the maximum DNS domain length up-front.
- # Each codepoint in a U-label contributes at least one octet to its
- # A-label form, so any input longer than the domain limit cannot
- # produce a valid A-domain. Short-circuiting here prevents per-label
- # validation from being driven into quadratic time
- if len(s) > 254:
+ # Reject inputs that exceed the maximum DNS domain length up-front
+ # to avoid expensive computation on long inputs.
+ if not valid_string_length(s, trailing_dot=True):
raise IDNAError("Domain too long")
trailing_dot = False
@@ -382,10 +379,9 @@ def decode(s: Union[str, bytes, bytearray], strict: bool = False, uts46: bool =
raise IDNAError('Invalid ASCII in A-label')
if uts46:
s = uts46_remap(s, std3_rules, False)
- # See encode() for rationale; the same bound applies because every
- # legal A-domain is at most 254 octets and every codepoint of a
- # legal U-domain contributes at least one octet to its A-form.
- if len(s) > 254:
+ # Reject inputs that exceed the maximum DNS domain length up-front
+ # to avoid expensive computation on long inputs.
+ if not valid_string_length(s, trailing_dot=True):
raise IDNAError("Domain too long")
trailing_dot = False
result = []