!48 [sync] PR-43: Fix CVE-2024-21506

From: @openeuler-sync-bot 
Reviewed-by: @lyn1001 
Signed-off-by: @lyn1001

0001-PYTHON-2631-Add-missing-error-message-to-InvalidBSON.patch

@@ -0,0 +1,46 @@
+From 9e01a6bf1d081c62ac2173f666234de159397e0c Mon Sep 17 00:00:00 2001
+From: Shane Harvey <shane.harvey@mongodb.com>
+Date: Fri, 2 Apr 2021 10:17:04 -0700
+Subject: [PATCH] PYTHON-2631 Add missing error message to InvalidBSON error
+ (#589)
+
+(cherry picked from commit cc029a1e6208863eaab453777363d3935b927f32)
+---
+ bson/_cbsonmodule.c | 2 +-
+ test/test_bson.py   | 7 +++++++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/bson/_cbsonmodule.c b/bson/_cbsonmodule.c
+index 34f3ab6f..1522bb0a 100644
+--- a/bson/_cbsonmodule.c
++++ b/bson/_cbsonmodule.c
+@@ -2621,7 +2621,7 @@ static int _element_to_dict(PyObject* self, const char* string,
+     if (name_length > BSON_MAX_SIZE || position + name_length >= max) {
+         PyObject* InvalidBSON = _error("InvalidBSON");
+         if (InvalidBSON) {
+-            PyErr_SetNone(InvalidBSON);
++            PyErr_SetString(InvalidBSON, "field name too large");
+             Py_DECREF(InvalidBSON);
+         }
+         return -1;
+diff --git a/test/test_bson.py b/test/test_bson.py
+index ad726f71..f75da3d2 100644
+--- a/test/test_bson.py
++++ b/test/test_bson.py
+@@ -373,6 +373,13 @@ class TestBSON(unittest.TestCase):
+                 with self.assertRaises(InvalidBSON, msg=msg):
+                     list(decode_file_iter(scratch))
+ 
++    def test_invalid_field_name(self):
++        # Decode a truncated field
++        with self.assertRaises(InvalidBSON) as ctx:
++            decode(b'\x0b\x00\x00\x00\x02field\x00')
++        # Assert that the InvalidBSON error message is not empty.
++        self.assertTrue(str(ctx.exception))
++
+     def test_data_timestamp(self):
+         self.assertEqual({"test": Timestamp(4, 20)},
+                          decode(b"\x13\x00\x00\x00\x11\x74\x65\x73\x74\x00\x14"
+-- 
+2.42.0.windows.2
+

0001-Use-ssl.match_hostname-from-the-Python-stdlib.patch

@@ -1,14 +1,13 @@
 diff --git a/pymongo/pool.py b/pymongo/pool.py
-index 859d0e0..f55fd8e 100644
+index 9aed758..be87816 100644
 --- a/pymongo/pool.py
 +++ b/pymongo/pool.py
-@@ -49,8 +49,7 @@ from pymongo.network import (command,
-                              SocketChecker)
- from pymongo.read_preferences import ReadPreference
+@@ -61,7 +61,7 @@ from pymongo.read_preferences import ReadPreference
  from pymongo.server_type import SERVER_TYPE
--# Always use our backport so we always have support for IP address matching
--from pymongo.ssl_match_hostname import match_hostname, CertificateError
-+from ssl import match_hostname, CertificateError
+ from pymongo.socket_checker import SocketChecker
+ # Always use our backport so we always have support for IP address matching
+-from pymongo.ssl_match_hostname import match_hostname
++from ssl import match_hostname
  
  # For SNI support. According to RFC6066, section 3, IPv4 and IPv6 literals are
  # not permitted for SNI hostname.

backport-CVE-2024-21506.patch

@@ -0,0 +1,47 @@
+From 56b6b6dbc267d365d97c037082369dabf37405d2 Mon Sep 17 00:00:00 2001
+From: Shane Harvey <shnhrv@gmail.com>
+Date: Wed, 27 Mar 2024 16:51:23 -0700
+Subject: [PATCH] PYTHON-4305 Fix bson size check (#1564)
+
+(cherry picked from commit 372b5d68d5a57ccc43b33407cd23f0bc79d99283)
+---
+ bson/_cbsonmodule.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/bson/_cbsonmodule.c b/bson/_cbsonmodule.c
+index 4e1881a275..da86cd8133 100644
+--- a/bson/_cbsonmodule.c
++++ b/bson/_cbsonmodule.c
+@@ -2405,6 +2405,7 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer,
+             uint32_t c_w_s_size;
+             uint32_t code_size;
+             uint32_t scope_size;
++            uint32_t len;
+             PyObject* code;
+             PyObject* scope;
+             PyObject* code_type;
+@@ -2424,7 +2425,8 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer,
+             memcpy(&code_size, buffer + *position, 4);
+             code_size = BSON_UINT32_FROM_LE(code_size);
+             /* code_w_scope length + code length + code + scope length */
+-            if (!code_size || max < code_size || max < 4 + 4 + code_size + 4) {
++            len = 4 + 4 + code_size + 4;
++            if (!code_size || max < code_size || max < len || len < code_size) {
+                 goto invalid;
+             }
+             *position += 4;
+@@ -2442,12 +2444,9 @@ static PyObject* get_value(PyObject* self, PyObject* name, const char* buffer,
+ 
+             memcpy(&scope_size, buffer + *position, 4);
+             scope_size = BSON_UINT32_FROM_LE(scope_size);
+-            if (scope_size < BSON_MIN_SIZE) {
+-                Py_DECREF(code);
+-                goto invalid;
+-            }
+             /* code length + code + scope length + scope */
+-            if ((4 + code_size + 4 + scope_size) != c_w_s_size) {
++            len = 4 + 4 + code_size + scope_size;
++            if (scope_size < BSON_MIN_SIZE || len != c_w_s_size || len < scope_size) {
+                 Py_DECREF(code);
+                 goto invalid;
+             }

python-pymongo.spec

@@ -1,14 +1,17 @@
 Name:           python-pymongo
-Version:        3.9.0
-Release:        4
+Version:        3.11.3
+Release:        3
 License:        Apache License 2.0
 Summary:        PyMongo - the Python driver for MongoDB
 URL:            https://github.com/mongodb/mongo-python-driver
-Source0:        https://github.com/mongodb/mongo-python-driver/archive/%{version}.tar.gz
+Source0:        https://files.pythonhosted.org/packages/72/82/e7196f2f69318dd206db26db68fcfa0ff821d88fbca6d0f0c7b678ba0353/pymongo-3.11.3.tar.gz
 Patch01:        0001-Use-ssl.match_hostname-from-the-Python-stdlib.patch
+Patch02:        0001-PYTHON-2631-Add-missing-error-message-to-InvalidBSON.patch
+# patch source: https://github.com/mongodb/mongo-python-driver/commit/56b6b6dbc267d365d97c037082369dabf37405d2
+Patch03:        backport-CVE-2024-21506.patch
 
 BuildRequires:  python3-devel python3-setuptools
-BuildRequires:  python3-sphinx
+BuildRequires:  python3-sphinx gcc
 
 %global _description \
 The PyMongo distribution contains tools for interacting with \
@@ -46,25 +49,23 @@ BuildArch: noarch
 Summary:   Development documents for python-pymongo
 
 %description help
-%{summary}.
+The PyMongo distribution contains tools for interacting with MongoDB database from Python.
 
 
 %prep
-%autosetup -n mongo-python-driver-%{version} -p1
+%autosetup -n pymongo-3.11.3 -p1
 rm pymongo/ssl_match_hostname.py
 
 %build
 %py3_build
 
-pushd doc
-make %{?_smp_mflags} html
-popd
+PYTHONPATH=${PYTHONPATH}:/usr/local/lib64/python3.8/site-packages:/usr/local/lib/python3.8/site-packages %{__python3} setup.py doc
 
 %install
 %py3_install
 
 install -d -m755 %{buildroot}/%{_pkgdocdir}
-cp -arf  doc/_build/html/* %{buildroot}/%{_pkgdocdir}
+cp -arf  doc/_build/%{version}/* %{buildroot}/%{_pkgdocdir}
 
 %check
 python3 setup.py test
@@ -87,10 +88,22 @@ python3 setup.py test
 %{_pkgdocdir}
 
 %changelog
+* Sun Apr 07 2024 liweigang <liweiganga@uniontech.com> - 3.11.3-3
+- Fix CVE-2024-21506
+
+* Wed Nov 8 2023 liubo <liubo1@xfusion.com> - 3.11.3-2
+- Add missing error message to InvalidBSON error
+
+* Fri Aug 06 2021 OpenStack_SIG <openstack@openeuler.org> - 3.11.3-1
+- Update version to 3.11.3
+
+* Mon May 31 2021 huanghaitao <huanghaitao8@huawei.com> - 3.9.0-5
+- Completing build dependencies
+
 * Wed Oct 21 2020 chengzihan <chengzihan2@huawei.com> - 3.9.0-4
 - Remove subpackage python2-bson, python2-pymongo, python2-pymongo-gridfs
 
-* Thu 10 2020 liuweibo <liuweibo10@huawei.com> - 3.9.0-3
+* Fri Sep 11 2020 liuweibo <liuweibo10@huawei.com> - 3.9.0-3
 - Fix Source0
 
 * Fri Feb 21 2020 shanshishi <shanshishi@huawei.com> - 3.9.0-2