Bug 1215274 - python-python-rpm-spec: DoS on carefully crafted RPM spec files
Summary: python-python-rpm-spec: DoS on carefully crafted RPM spec files
Status: IN_PROGRESS
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Python (show other bugs)
Version: Current
Hardware: x86-64 openSUSE Tumbleweed
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Security Team bot
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-09-13 06:36 UTC by Martin Schreiner
Modified: 2023-11-15 15:50 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
patch file fixing the issue (1.08 KB, patch)
2023-09-13 06:36 UTC, Martin Schreiner 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Schreiner 2023-09-13 06:36:08 UTC 
Created attachment 869468 [details]
patch file fixing the issue

Currently, it's possible to trick replace_macros() to never return, causing a DoS to software using this library with carefully crafted spec files.

The offending code in replace_macros() may be found here:
https://github.com/bkircher/python-rpm-spec/blob/ef0f2daa77d49480446423abefe90c07aa2f9aa8/pyrpm/spec.py#L558

Upstream issue, reported by David Anes, who also contributed the patch we're submitting:
https://github.com/bkircher/python-rpm-spec/issues/61
Comment 1 Markéta Machová 2023-09-14 07:19:52 UTC 
Fixed in Factory with https://build.opensuse.org/request/show/1111023 (thanks!).

Does this affect also the version in Leap?
Comment 2 Matej Cepl 2023-10-30 07:17:05 UTC 
(In reply to Markéta Machová from comment #1)
> Does this affect also the version in Leap?

It doesn’t seem to be outside of Factory at all:

 $ isc se -V python-python-rpm-spec
No matches found for 'python-python-rpm-spec' in projects
####################################################################
matches for 'python-python-rpm-spec' in packages:

# Project          # Package               # Ver   Rev  Srcmd5
SUSE:Factory:Head  python-python-rpm-spec  0.14.1  6    f7b82e06eaa8d47edc8030a73e627249
 $
Comment 3 Matej Cepl 2023-10-30 07:19:45 UTC 
Actually, it is in Leap only:

openSUSE:Leap:15.1                                 python-python-rpm-spec  0.8     2    22c0bbbe9f2eb03417e3914737544183
openSUSE:Leap:15.2                                 python-python-rpm-spec  0.8     3    22c0bbbe9f2eb03417e3914737544183

So, somebody who cares about Leap should probably update that package to something more reasonable.