Fix CVE-2016-0772 and CVE-2016-5699 (rhbz#1348973, rhbz#1348982)

CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
  Raise an error when STARTTLS fails (upstream patch)
CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
  Disabled HTTP header injections in http.client (upstream patch)

3 files changed, 223 insertions, 1 deletions

diff --git a/00237-CVE-2016-0772-smtplib.patch b/00237-CVE-2016-0772-smtplib.patch
new file mode 100644
index 0000000..d3213bd
--- /dev/null
+++ b/00237-CVE-2016-0772-smtplib.patch
@@ -0,0 +1,34 @@
+From 5b67aca6fb4246e84981d6361ba218bd52e73ac2 Mon Sep 17 00:00:00 2001
+From: Tomas Orsava <torsava@redhat.com>
+Date: Tue, 21 Jun 2016 15:52:03 +0200
+Subject: [PATCH] Raise an error when STARTTLS fails
+
+CVE-2016-0772 python: smtplib StartTLS stripping attack
+rhbz#1303647: https://bugzilla.redhat.com/show_bug.cgi?id=1303647
+
+Based on an upstream change by Benjamin Peterson <benjamin@python.org>
+- in changeset 101887:d590114c2394 3.4
+- https://hg.python.org/cpython/rev/d590114c2394
+---
+ Lib/smtplib.py | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/Lib/smtplib.py b/Lib/smtplib.py
+index dc16ef6..8bc806b 100755
+--- a/Lib/smtplib.py
++++ b/Lib/smtplib.py
+@@ -655,6 +655,11 @@ class SMTP:
+             self.ehlo_resp = None
+             self.esmtp_features = {}
+             self.does_esmtp = 0
++        else:
++            # RFC 3207:
++            # 501 Syntax error (no parameters allowed)
++            # 454 TLS not available due to temporary reason
++            raise SMTPResponseException(resp, reply)
+         return (resp, reply)
+ 
+     def sendmail(self, from_addr, to_addrs, msg, mail_options=[],
+-- 
+2.5.5
+
diff --git a/00238-CVE-2016-5699-http-client.patch b/00238-CVE-2016-5699-http-client.patch
new file mode 100644
index 0000000..c4ae1ee
--- /dev/null
+++ b/00238-CVE-2016-5699-http-client.patch
@@ -0,0 +1,162 @@
+From e30667f3442e7561e765401be048eba9b444a360 Mon Sep 17 00:00:00 2001
+From: Tomas Orsava <torsava@redhat.com>
+Date: Fri, 8 Jul 2016 12:18:50 +0200
+Subject: [PATCH] Disabled HTTP header injections in http.client.
+
+CVE-2016-5699 python: http protocol steam injection attack
+rhbz#1303699 : https://bugzilla.redhat.com/show_bug.cgi?id=1303699
+
+Based on an upstream change by Demian Brecht and Serhiy Storchaka
+- in changeset 94952:bf3e1c9b80e9 3.4
+- https://hg.python.org/cpython/rev/bf3e1c9b80e9
+---
+ Lib/http/client.py       | 37 +++++++++++++++++++++++++++++++
+ Lib/test/test_httplib.py | 57 ++++++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 94 insertions(+)
+
+diff --git a/Lib/http/client.py b/Lib/http/client.py
+index 6de4b0e..7ec5899 100644
+--- a/Lib/http/client.py
++++ b/Lib/http/client.py
+@@ -70,6 +70,7 @@ import email.parser
+ import email.message
+ import io
+ import os
++import re
+ import socket
+ import collections
+ from urllib.parse import urlsplit
+@@ -215,6 +216,34 @@ MAXAMOUNT = 1048576
+ _MAXLINE = 65536
+ _MAXHEADERS = 100
+ 
++# Header name/value ABNF (http://tools.ietf.org/html/rfc7230#section-3.2)
++#
++# VCHAR          = %x21-7E
++# obs-text       = %x80-FF
++# header-field   = field-name ":" OWS field-value OWS
++# field-name     = token
++# field-value    = *( field-content / obs-fold )
++# field-content  = field-vchar [ 1*( SP / HTAB ) field-vchar ]
++# field-vchar    = VCHAR / obs-text
++#
++# obs-fold       = CRLF 1*( SP / HTAB )
++#                ; obsolete line folding
++#                ; see Section 3.2.4
++
++# token          = 1*tchar
++#
++# tchar          = "!" / "#" / "$" / "%" / "&" / "'" / "*"
++#                / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~"
++#                / DIGIT / ALPHA
++#                ; any VCHAR, except delimiters
++#
++# VCHAR defined in http://tools.ietf.org/html/rfc5234#appendix-B.1
++
++# the patterns for both name and value are more leniant than RFC
++# definitions to allow for backwards compatibility
++_is_legal_header_name = re.compile(rb'[^:\s][^:\r\n]*').fullmatch
++_is_illegal_header_value = re.compile(rb'\n(?![ \t])|\r(?![ \t\n])').search
++
+ 
+ class HTTPMessage(email.message.Message):
+     # XXX The only usage of this method is in
+@@ -1058,12 +1087,20 @@ class HTTPConnection:
+ 
+         if hasattr(header, 'encode'):
+             header = header.encode('ascii')
++
++        if not _is_legal_header_name(header):
++            raise ValueError('Invalid header name %r' % (header,))
++
+         values = list(values)
+         for i, one_value in enumerate(values):
+             if hasattr(one_value, 'encode'):
+                 values[i] = one_value.encode('latin-1')
+             elif isinstance(one_value, int):
+                 values[i] = str(one_value).encode('ascii')
++
++            if _is_illegal_header_value(values[i]):
++                raise ValueError('Invalid header value %r' % (values[i],))
++
+         value = b'\r\n\t'.join(values)
+         header = header + b': ' + value
+         self._output(header)
+diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
+index 3fc3466..d5037f0 100644
+--- a/Lib/test/test_httplib.py
++++ b/Lib/test/test_httplib.py
+@@ -148,6 +148,33 @@ class HeaderTests(TestCase):
+         conn.putheader('Content-length', 42)
+         self.assertIn(b'Content-length: 42', conn._buffer)
+ 
++        conn.putheader('Foo', ' bar ')
++        self.assertIn(b'Foo:  bar ', conn._buffer)
++        conn.putheader('Bar', '\tbaz\t')
++        self.assertIn(b'Bar: \tbaz\t', conn._buffer)
++        conn.putheader('Authorization', 'Bearer mytoken')
++        self.assertIn(b'Authorization: Bearer mytoken', conn._buffer)
++        conn.putheader('IterHeader', 'IterA', 'IterB')
++        self.assertIn(b'IterHeader: IterA\r\n\tIterB', conn._buffer)
++        conn.putheader('LatinHeader', b'\xFF')
++        self.assertIn(b'LatinHeader: \xFF', conn._buffer)
++        conn.putheader('Utf8Header', b'\xc3\x80')
++        self.assertIn(b'Utf8Header: \xc3\x80', conn._buffer)
++        conn.putheader('C1-Control', b'next\x85line')
++        self.assertIn(b'C1-Control: next\x85line', conn._buffer)
++        conn.putheader('Embedded-Fold-Space', 'is\r\n allowed')
++        self.assertIn(b'Embedded-Fold-Space: is\r\n allowed', conn._buffer)
++        conn.putheader('Embedded-Fold-Tab', 'is\r\n\tallowed')
++        self.assertIn(b'Embedded-Fold-Tab: is\r\n\tallowed', conn._buffer)
++        conn.putheader('Key Space', 'value')
++        self.assertIn(b'Key Space: value', conn._buffer)
++        conn.putheader('KeySpace ', 'value')
++        self.assertIn(b'KeySpace : value', conn._buffer)
++        conn.putheader(b'Nonbreak\xa0Space', 'value')
++        self.assertIn(b'Nonbreak\xa0Space: value', conn._buffer)
++        conn.putheader(b'\xa0NonbreakSpace', 'value')
++        self.assertIn(b'\xa0NonbreakSpace: value', conn._buffer)
++
+     def test_ipv6host_header(self):
+         # Default host header on IPv6 transaction should wrapped by [] if
+         # its actual IPv6 address
+@@ -177,6 +204,36 @@ class HeaderTests(TestCase):
+         self.assertEqual(resp.getheader('First'), 'val')
+         self.assertEqual(resp.getheader('Second'), 'val')
+ 
++    def test_invalid_headers(self):
++        conn = client.HTTPConnection('example.com')
++        conn.sock = FakeSocket('')
++        conn.putrequest('GET', '/')
++
++        # http://tools.ietf.org/html/rfc7230#section-3.2.4, whitespace is no
++        # longer allowed in header names
++        cases = (
++            (b'Invalid\r\nName', b'ValidValue'),
++            (b'Invalid\rName', b'ValidValue'),
++            (b'Invalid\nName', b'ValidValue'),
++            (b'\r\nInvalidName', b'ValidValue'),
++            (b'\rInvalidName', b'ValidValue'),
++            (b'\nInvalidName', b'ValidValue'),
++            (b' InvalidName', b'ValidValue'),
++            (b'\tInvalidName', b'ValidValue'),
++            (b'Invalid:Name', b'ValidValue'),
++            (b':InvalidName', b'ValidValue'),
++            (b'ValidName', b'Invalid\r\nValue'),
++            (b'ValidName', b'Invalid\rValue'),
++            (b'ValidName', b'Invalid\nValue'),
++            (b'ValidName', b'InvalidValue\r\n'),
++            (b'ValidName', b'InvalidValue\r'),
++            (b'ValidName', b'InvalidValue\n'),
++        )
++        for name, value in cases:
++            with self.subTest((name, value)):
++                with self.assertRaisesRegex(ValueError, 'Invalid header'):
++                    conn.putheader(name, value)
++
+ 
+ class BasicTest(TestCase):
+     def test_status_lines(self):
+-- 
+2.9.0
+
diff --git a/python34.spec b/python34.spec
index 3136192..b78dc38 100644
--- a/python34.spec
+++ b/python34.spec
@@ -148,7 +148,7 @@
 Summary: Version 3 of the Python programming language aka Python 3000
 Name: python%{pyshortver}
 Version: %{pybasever}.3
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: Python
 Group: Development/Languages
 
@@ -738,6 +738,23 @@ Patch203: 00203-disable-threading-test-koji.patch
 # openssl requires DH keys to be > 768bits
 Patch204: 00204-increase-dh-keys-size.patch
 
+# 00237 #
+# CVE-2016-0772 python: smtplib StartTLS stripping attack
+#   https://bugzilla.redhat.com/show_bug.cgi?id=1303647
+#   FIXED UPSTREAM: https://hg.python.org/cpython/rev/d590114c2394
+# Raise an error when STARTTLS fails
+# Resolves: rhbz#1348973
+Patch237: 00237-CVE-2016-0772-smtplib.patch
+
+# 00238 #
+# CVE-2016-5699 python: http protocol steam injection attack
+#   https://bugzilla.redhat.com/show_bug.cgi?id=1303699
+#   FIXED UPSTREAM: https://hg.python.org/cpython/rev/bf3e1c9b80e9
+# Disabled HTTP header injections in http.client
+# Resolves: rhbz#1348982
+Patch238: 00238-CVE-2016-5699-http-client.patch
+
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora 17 onwards,
@@ -1028,6 +1045,8 @@ sed -r -i s/'_PIP_VERSION = "[0-9.]+"'/'_PIP_VERSION = "%{pip_version}"'/ Lib/en
 %patch202 -p1
 %patch203 -p1
 %patch204 -p1
+%patch237 -p1
+%patch238 -p1
 
 
 # Currently (2010-01-15), http://docs.python.org/library is for 2.6, and there
@@ -1977,6 +1996,13 @@ rm -fr %{buildroot}
 # ======================================================
 
 %changelog
+* Fri Jul 08 2016 Tomas Orsava <torsava@redhat.com> - 3.4.3-5
+- Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
+  Raise an error when STARTTLS fails (upstream patch)
+- Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
+  Disabled HTTP header injections in http.client (upstream patch)
+Resolves: rhbz#1348973, rhbz#1348982
+
 * Mon Jan 25 2016 Orion Poplawski <orion@cora.nwra.com> - 3.4.3-4
 - Make relocating Python by changing _prefix actually work
 - Disable test_gdb on aarch64 (rhbz#1196181), it joins all other non x86 arches