[pkgsrc/trunk]: pkgsrc/lang/python37 python37: fix CVE-2020-14422 using upstr...

[wiz <wiz%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/5bd23e7f3b40
branches:  trunk
changeset: 436449:5bd23e7f3b40
user:      wiz <wiz%pkgsrc.org@localhost>
date:      Mon Aug 03 11:11:33 2020 +0000

description:
python37: fix CVE-2020-14422 using upstream patch

Bump PKGREVISION.

diffstat:

 lang/python37/Makefile                                  |   3 +-
 lang/python37/distinfo                                  |   4 +-
 lang/python37/patches/patch-Lib_ipaddress.py            |  26 +++++++++++++++++
 lang/python37/patches/patch-Lib_test_test__ipaddress.py |  26 +++++++++++++++++
 4 files changed, 57 insertions(+), 2 deletions(-)

diffs (93 lines):

diff -r 5dd186f0e4df -r 5bd23e7f3b40 lang/python37/Makefile
--- a/lang/python37/Makefile    Mon Aug 03 11:11:19 2020 +0000
+++ b/lang/python37/Makefile    Mon Aug 03 11:11:33 2020 +0000
@@ -1,8 +1,9 @@
-# $NetBSD: Makefile,v 1.17 2020/05/21 17:25:13 leot Exp $
+# $NetBSD: Makefile,v 1.18 2020/08/03 11:11:33 wiz Exp $
 
 .include "dist.mk"
 
 PKGNAME=       python37-${PY_DISTVERSION}
+PKGREVISION=   1
 CATEGORIES=    lang python
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
diff -r 5dd186f0e4df -r 5bd23e7f3b40 lang/python37/distinfo
--- a/lang/python37/distinfo    Mon Aug 03 11:11:19 2020 +0000
+++ b/lang/python37/distinfo    Mon Aug 03 11:11:33 2020 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.16 2020/06/30 05:56:02 adam Exp $
+$NetBSD: distinfo,v 1.17 2020/08/03 11:11:33 wiz Exp $
 
 SHA1 (Python-3.7.8.tar.xz) = ecfc1d291ab35bb7cc3a352dd9451450266f5974
 RMD160 (Python-3.7.8.tar.xz) = 67af3c8cbdfbadd49bbbb56690b3da90799dc687
@@ -8,7 +8,9 @@
 SHA1 (patch-Lib_distutils_command_install.py) = 6fc6f5d918b7581fc62cd0fe55857ee932c3a341
 SHA1 (patch-Lib_distutils_sysconfig.py) = 6822eafb4dfded86d7f7353831816aeb8119e6cf
 SHA1 (patch-Lib_distutils_unixccompiler.py) = 2e65a8dd5dd3fe25957206c062106fa7a6fc4e69
+SHA1 (patch-Lib_ipaddress.py) = cf3a5f76567875e74461fd87d6089494000611dc
 SHA1 (patch-Lib_sysconfig.py) = a4f009ed73ebbd9d9c4bf7e12b7981182ed8fd7c
+SHA1 (patch-Lib_test_test__ipaddress.py) = b7b5cf9445c5fb1e20d957e7a271802ad4854ab1
 SHA1 (patch-Makefile.pre.in) = 1393dac225c5a7edcb7947eb707b4526ea884f95
 SHA1 (patch-Modules_makesetup) = a06786eebffadecedba5e3a50a9785fb47613567
 SHA1 (patch-Modules_nismodule.c) = 1bafe9b06359586d027a77011b103877590d947d
diff -r 5dd186f0e4df -r 5bd23e7f3b40 lang/python37/patches/patch-Lib_ipaddress.py
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/lang/python37/patches/patch-Lib_ipaddress.py      Mon Aug 03 11:11:33 2020 +0000
@@ -0,0 +1,26 @@
+$NetBSD: patch-Lib_ipaddress.py,v 1.1 2020/08/03 11:11:33 wiz Exp $
+
+Fix for CVE-2020-14422
+
+https://github.com/python/cpython/commit/b98e7790c77a4378ec4b1c71b84138cb930b69b7
+
+--- Lib/ipaddress.py.orig      2020-06-27 08:35:53.000000000 +0000
++++ Lib/ipaddress.py
+@@ -1442,7 +1442,7 @@ class IPv4Interface(IPv4Address):
+             return False
+ 
+     def __hash__(self):
+-        return self._ip ^ self._prefixlen ^ int(self.network.network_address)
++        return hash((self._ip, self._prefixlen, int(self.network.network_address)))
+ 
+     __reduce__ = _IPAddressBase.__reduce__
+ 
+@@ -2088,7 +2088,7 @@ class IPv6Interface(IPv6Address):
+             return False
+ 
+     def __hash__(self):
+-        return self._ip ^ self._prefixlen ^ int(self.network.network_address)
++        return hash((self._ip, self._prefixlen, int(self.network.network_address)))
+ 
+     __reduce__ = _IPAddressBase.__reduce__
+ 
diff -r 5dd186f0e4df -r 5bd23e7f3b40 lang/python37/patches/patch-Lib_test_test__ipaddress.py
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/lang/python37/patches/patch-Lib_test_test__ipaddress.py   Mon Aug 03 11:11:33 2020 +0000
@@ -0,0 +1,26 @@
+$NetBSD: patch-Lib_test_test__ipaddress.py,v 1.1 2020/08/03 11:11:33 wiz Exp $
+
+Fix for CVE-2020-14422
+
+https://github.com/python/cpython/commit/b98e7790c77a4378ec4b1c71b84138cb930b69b7
+
+--- Lib/test/test_ipaddress.py.orig    2020-06-27 08:35:53.000000000 +0000
++++ Lib/test/test_ipaddress.py
+@@ -2091,6 +2091,17 @@ class IpaddrUnitTest(unittest.TestCase):
+                          sixtofouraddr.sixtofour)
+         self.assertFalse(bad_addr.sixtofour)
+ 
++    # issue41004 Hash collisions in IPv4Interface and IPv6Interface
++    def testV4HashIsNotConstant(self):
++        ipv4_address1 = ipaddress.IPv4Interface("1.2.3.4")
++        ipv4_address2 = ipaddress.IPv4Interface("2.3.4.5")
++        self.assertNotEqual(ipv4_address1.__hash__(), ipv4_address2.__hash__())
++
++    # issue41004 Hash collisions in IPv4Interface and IPv6Interface
++    def testV6HashIsNotConstant(self):
++        ipv6_address1 = ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:1")
++        ipv6_address2 = ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:2")
++        self.assertNotEqual(ipv6_address1.__hash__(), ipv6_address2.__hash__())
+ 
+ if __name__ == '__main__':
+     unittest.main()