mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-05-07 05:10:20 +00:00
python3-werkzeug: fix for patch-fuzz
Modified the CVE-2023-23934.patch to fix the patch-fuzz. Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
committed by
Armin Kuster
parent
297bc1cc64
commit
d8acec2e84
@@ -1,4 +1,4 @@
|
|||||||
From b070a40ebbd89d88f4d8144a6ece017d33604d00 Mon Sep 17 00:00:00 2001
|
From db1457abec7fe27148673f5f8bfdf5c52eb7f29f Mon Sep 17 00:00:00 2001
|
||||||
From: David Lord <davidism@gmail.com>
|
From: David Lord <davidism@gmail.com>
|
||||||
Date: Wed, 10 May 2023 11:33:18 +0000
|
Date: Wed, 10 May 2023 11:33:18 +0000
|
||||||
Subject: [PATCH] Merge pull request from GHSA-px8h-6qxv-m22q
|
Subject: [PATCH] Merge pull request from GHSA-px8h-6qxv-m22q
|
||||||
@@ -17,26 +17,26 @@ Upstream-Status: Backport [https://github.com/pallets/werkzeug/commit/cf275f42ac
|
|||||||
|
|
||||||
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
|
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
|
||||||
---
|
---
|
||||||
CHANGES.rst | 4 ++++
|
CHANGES.rst | 3 +++
|
||||||
src/werkzeug/_internal.py | 13 +++++++++----
|
src/werkzeug/_internal.py | 13 +++++++++----
|
||||||
src/werkzeug/http.py | 4 ----
|
src/werkzeug/http.py | 4 ----
|
||||||
tests/test_http.py | 4 +++-
|
tests/test_http.py | 4 +++-
|
||||||
4 files changed, 16 insertions(+), 9 deletions(-)
|
4 files changed, 15 insertions(+), 9 deletions(-)
|
||||||
|
|
||||||
diff --git a/CHANGES.rst b/CHANGES.rst
|
diff --git a/CHANGES.rst b/CHANGES.rst
|
||||||
index a351d7c..23505d3 100644
|
index 6e809ba..13ef75b 100644
|
||||||
--- a/CHANGES.rst
|
--- a/CHANGES.rst
|
||||||
+++ b/CHANGES.rst
|
+++ b/CHANGES.rst
|
||||||
@@ -1,5 +1,9 @@
|
@@ -4,6 +4,9 @@
|
||||||
.. currentmodule:: werkzeug
|
``RequestEntityTooLarge`` exception is raised on parsing. This mitigates a DoS
|
||||||
|
attack where a larger number of form/file parts would result in disproportionate
|
||||||
|
resource use.
|
||||||
+- A cookie header that starts with ``=`` is treated as an empty key and discarded,
|
+- A cookie header that starts with ``=`` is treated as an empty key and discarded,
|
||||||
+ rather than stripping the leading ``==``.
|
+ rather than stripping the leading ``==``.
|
||||||
+
|
+
|
||||||
+
|
|
||||||
Version 2.1.1
|
Version 2.1.1
|
||||||
-------------
|
-------------
|
||||||
|
|
||||||
diff --git a/src/werkzeug/_internal.py b/src/werkzeug/_internal.py
|
diff --git a/src/werkzeug/_internal.py b/src/werkzeug/_internal.py
|
||||||
index a8b3523..d6290ba 100644
|
index a8b3523..d6290ba 100644
|
||||||
--- a/src/werkzeug/_internal.py
|
--- a/src/werkzeug/_internal.py
|
||||||
@@ -114,3 +114,4 @@ index 5936bfa..59cc179 100644
|
|||||||
def test_dump_cookie(self):
|
def test_dump_cookie(self):
|
||||||
--
|
--
|
||||||
2.40.0
|
2.40.0
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user