From 19f646c938c9f41b80828e68db0fecae00edfd47 Mon Sep 17 00:00:00 2001 From: "deepin-community-bot[bot]" <156989552+deepin-community-bot[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 02:08:50 +0000 Subject: [PATCH] feat: update python-ldap to 3.4.4-1+deb13u1 --- debian/changelog | 15 ++++-------- ...-2025-61911.patch => CVE-2025-61911.patch} | 24 +++++++++---------- ...-2025-61912.patch => CVE-2025-61912.patch} | 21 ++++++++-------- debian/patches/series | 4 ++-- 4 files changed, 29 insertions(+), 35 deletions(-) rename debian/patches/{0003-CVE-2025-61911.patch => CVE-2025-61911.patch} (53%) rename debian/patches/{0004-CVE-2025-61912.patch => CVE-2025-61912.patch} (65%) diff --git a/debian/changelog b/debian/changelog index 028b5a6..e4d292f 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,16 +1,9 @@ -python-ldap (3.4.4-1deepin2) unstable; urgency=medium +python-ldap (3.4.4-1+deb13u1) trixie; urgency=medium - * Fix CVE-2025-61912: correctly escape null bytes in escape_dn_chars - according to RFC 4514 to prevent client-side denial of service. + * CVE-2025-61911 (Closes: #1117858) + * CVE-2025-61912 (Closes: #1117859) - -- deepin-ci-robot Thu, 07 May 2026 20:02:44 +0800 - -python-ldap (3.4.4-1deepin1) unstable; urgency=medium - - * Fix CVE-2025-61911: enforce str type for escape_filter_chars to - prevent LDAP injection attacks via crafted list/dict objects. - - -- deepin-ci-robot Thu, 07 May 2026 19:58:16 +0800 + -- Moritz Mühlenhoff Mon, 06 Apr 2026 23:33:25 +0200 python-ldap (3.4.4-1) unstable; urgency=low diff --git a/debian/patches/0003-CVE-2025-61911.patch b/debian/patches/CVE-2025-61911.patch similarity index 53% rename from debian/patches/0003-CVE-2025-61911.patch rename to debian/patches/CVE-2025-61911.patch index 5fdeab6..cbfc982 100644 --- a/debian/patches/0003-CVE-2025-61911.patch +++ b/debian/patches/CVE-2025-61911.patch @@ -1,7 +1,10 @@ -Index: github-python-ldap-scout/Lib/ldap/filter.py -=================================================================== ---- github-python-ldap-scout.orig/Lib/ldap/filter.py -+++ github-python-ldap-scout/Lib/ldap/filter.py +From 464fddacd63092d6e01c62a38316a713c30ca98a Mon Sep 17 00:00:00 2001 +From: lukas-eu <62448426+lukas-eu@users.noreply.github.com> +Date: Fri, 10 Oct 2025 19:47:46 +0200 +Subject: [PATCH] Merge commit from fork + +--- python-ldap-3.4.4.orig/Lib/ldap/filter.py ++++ python-ldap-3.4.4/Lib/ldap/filter.py @@ -24,6 +24,8 @@ def escape_filter_chars(assertion_value, If 1 all NON-ASCII chars are escaped. If 2 all chars are escaped. @@ -11,19 +14,16 @@ Index: github-python-ldap-scout/Lib/ldap/filter.py if escape_mode: r = [] if escape_mode==1: -Index: github-python-ldap-scout/Tests/t_ldap_filter.py -=================================================================== ---- github-python-ldap-scout.orig/Tests/t_ldap_filter.py -+++ github-python-ldap-scout/Tests/t_ldap_filter.py -@@ -50,6 +50,11 @@ class TestDN(unittest.TestCase): +--- python-ldap-3.4.4.orig/Tests/t_ldap_filter.py ++++ python-ldap-3.4.4/Tests/t_ldap_filter.py +@@ -49,6 +49,10 @@ class TestDN(unittest.TestCase): + ), r'\c3\a4\c3\b6\c3\bc\c3\84\c3\96\c3\9c\c3\9f' ) - + with self.assertRaises(TypeError): + escape_filter_chars(["abc@*()/xyz"], escape_mode=1) + with self.assertRaises(TypeError): + escape_filter_chars({"abc@*()/xyz": 1}, escape_mode=1) -+ + def test_escape_filter_chars_mode2(self): """ - test function escape_filter_chars() with escape_mode=2 diff --git a/debian/patches/0004-CVE-2025-61912.patch b/debian/patches/CVE-2025-61912.patch similarity index 65% rename from debian/patches/0004-CVE-2025-61912.patch rename to debian/patches/CVE-2025-61912.patch index fe457e1..80b4714 100644 --- a/debian/patches/0004-CVE-2025-61912.patch +++ b/debian/patches/CVE-2025-61912.patch @@ -1,27 +1,28 @@ -Index: github-python-ldap-scout/Lib/ldap/dn.py -=================================================================== ---- github-python-ldap-scout.orig/Lib/ldap/dn.py -+++ github-python-ldap-scout/Lib/ldap/dn.py +From 9f5b2effbafdf7af0e7064a7aa42d2739d373bd7 Mon Sep 17 00:00:00 2001 +From: Simon Pichugin +Date: Fri, 10 Oct 2025 10:46:45 -0700 +Subject: [PATCH] Merge commit from fork + +--- python-ldap-3.4.4.orig/Lib/ldap/dn.py ++++ python-ldap-3.4.4/Lib/ldap/dn.py @@ -26,7 +26,8 @@ def escape_dn_chars(s): s = s.replace('>' ,'\\>') s = s.replace(';' ,'\\;') s = s.replace('=' ,'\\=') - s = s.replace('\000' ,'\\\000') -+ # RFC 4514 requires NULL (U+0000) to be escaped as hex pair "\\00" ++ # RFC 4514 requires NULL (U+0000) to be escaped as hex pair "\00" + s = s.replace('\x00' ,'\\00') if s[-1]==' ': s = ''.join((s[:-1],'\\ ')) if s[0]=='#' or s[0]==' ': -Index: github-python-ldap-scout/Tests/t_ldap_dn.py -=================================================================== ---- github-python-ldap-scout.orig/Tests/t_ldap_dn.py -+++ github-python-ldap-scout/Tests/t_ldap_dn.py +--- python-ldap-3.4.4.orig/Tests/t_ldap_dn.py ++++ python-ldap-3.4.4/Tests/t_ldap_dn.py @@ -49,7 +49,7 @@ class TestDN(unittest.TestCase): self.assertEqual(ldap.dn.escape_dn_chars(' '), '\\ ') self.assertEqual(ldap.dn.escape_dn_chars(' '), '\\ \\ ') self.assertEqual(ldap.dn.escape_dn_chars('foobar '), 'foobar\\ ') - self.assertEqual(ldap.dn.escape_dn_chars('f+o>o,bo\\,b\\o,bo\,b\o,bo\\,b\\