diff mbox series

[wrynose,2/3] python3: fix CVE-2025-15367

Message ID 20261016053944.3835603-3-dkelaiya@cisco.com
State New
Delegated to: Yoann Congal
Headers show
Series python3: upgrade to 3.14.8 and backport security fixes | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 16, 2026, 5:39 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix shown in [1].
The advisory identifying the fix is referenced in [2].

CPython kept this change on main and deferred maintenance-branch
backports [3] because passwords containing control characters
such as tab or backspace could previously work. Wrynose takes the
compatibility change to prevent user-controlled POP3 arguments from
injecting extra commands. The new validation rejects C0 and DEL bytes
before sending a command.

Clients with affected stored credentials must replace those credentials
with ones free of control characters and handle the new ValueError with
a clear credential error. They must not silently strip password
characters or retry by bypassing the check.

[1] https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7
[2] https://nvd.nist.gov/vuln/detail/cve-2025-15367
[3] https://github.com/python/cpython/pull/143924

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../python/python3/CVE-2025-15367.patch       | 66 +++++++++++++++++++
 .../recipes-devtools/python/python3_3.14.8.bb |  1 +
 2 files changed, 67 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-15367.patch
diff mbox series

Patch

diff --git a/meta/recipes-devtools/python/python3/CVE-2025-15367.patch b/meta/recipes-devtools/python/python3/CVE-2025-15367.patch
new file mode 100644
index 0000000000..21f2dfa7ed
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2025-15367.patch
@@ -0,0 +1,66 @@ 
+From cf799923a7a039d52432629c45ae7c603cc0b2d6 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Tue, 20 Jan 2026 14:46:32 -0600
+Subject: [PATCH] gh-143923: Reject control characters in POP3 commands
+
+CVE: CVE-2025-15367
+Upstream-Status: Backport [https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7]
+
+(cherry picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ Lib/poplib.py                                             | 2 ++
+ Lib/test/test_poplib.py                                   | 8 ++++++++
+ .../2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst        | 1 +
+ 3 files changed, 11 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+
+diff --git a/Lib/poplib.py b/Lib/poplib.py
+index 4469bff..b97274c 100644
+--- a/Lib/poplib.py
++++ b/Lib/poplib.py
+@@ -122,6 +122,8 @@ class POP3:
+     def _putcmd(self, line):
+         if self._debugging: print('*cmd*', repr(line))
+         line = bytes(line, self.encoding)
++        if re.search(b'[\x00-\x1F\x7F]', line):
++            raise ValueError('Control characters not allowed in commands')
+         self._putline(line)
+ 
+ 
+diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py
+index ef2da97..18ca7cb 100644
+--- a/Lib/test/test_poplib.py
++++ b/Lib/test/test_poplib.py
+@@ -17,6 +17,7 @@ from test.support import socket_helper
+ from test.support import threading_helper
+ from test.support import asynchat
+ from test.support import asyncore
++from test.support import control_characters_c0
+ 
+ 
+ test_support.requires_working_socket(module=True)
+@@ -395,6 +396,13 @@ class TestPOP3Class(TestCase):
+         self.assertIsNone(self.client.sock)
+         self.assertIsNone(self.client.file)
+ 
++    def test_control_characters(self):
++        for c0 in control_characters_c0():
++            with self.assertRaises(ValueError):
++                self.client.user(f'user{c0}')
++            with self.assertRaises(ValueError):
++                self.client.pass_(f'{c0}pass')
++
+     @requires_ssl
+     def test_stls_capa(self):
+         capa = self.client.capa()
+diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+new file mode 100644
+index 0000000..3cde4df
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+@@ -0,0 +1 @@
++Reject control characters in POP3 commands.
+-- 
+2.35.6
+
diff --git a/meta/recipes-devtools/python/python3_3.14.8.bb b/meta/recipes-devtools/python/python3_3.14.8.bb
index f10d6a5f4d..6aa5514246 100644
--- a/meta/recipes-devtools/python/python3_3.14.8.bb
+++ b/meta/recipes-devtools/python/python3_3.14.8.bb
@@ -35,6 +35,7 @@  SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
            file://0001-Skip-flaky-test_default_timeout-tests.patch \
            file://0001-test_only_active_thread-skip-problematic-test.patch \
            file://0001-prefer-valid-entrypoints.patch \
+           file://CVE-2025-15367.patch \
            "
 SRC_URI:append:class-native = " \
            file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \