mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-06-14 17:59:59 +00:00
python3-twisted: patch CVE-2022-24801
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-24801 Pick the commits from the pull request that is referenced by the NVD report. (The full set is consisting of 13 patches, but the ones that only updated news/readme/typo fixes in comments were not backported) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This commit is contained in:
@@ -0,0 +1,25 @@
|
||||
From 5897923d523b357f93eb844e386bcc52c5490cdc Mon Sep 17 00:00:00 2001
|
||||
From: Tom Most <twm@freecog.net>
|
||||
Date: Mon, 7 Mar 2022 00:03:50 -0800
|
||||
Subject: [PATCH] Strip only spaces and tabs from header values
|
||||
|
||||
Upstream-Status: Backport [https://github.com/twisted/twisted/commit/c3a4e1d015740c1d87a3ec7d57570257e75b0062]
|
||||
CVE: CVE-2022-24801
|
||||
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
|
||||
---
|
||||
src/twisted/web/http.py | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/twisted/web/http.py b/src/twisted/web/http.py
|
||||
index 5491953..262da0b 100644
|
||||
--- a/src/twisted/web/http.py
|
||||
+++ b/src/twisted/web/http.py
|
||||
@@ -2327,7 +2327,7 @@ class HTTPChannel(basic.LineReceiver, policies.TimeoutMixin):
|
||||
return False
|
||||
|
||||
header = header.lower()
|
||||
- data = data.strip()
|
||||
+ data = data.strip(b" \t")
|
||||
|
||||
if not self._maybeChooseTransferDecoder(header, data):
|
||||
return False
|
||||
Reference in New Issue
Block a user