debian/patches/cve-2014-7821_DoS_through_invalid_DNS_configuration_juno.patch

   1 Description: CVE-2014-7821: Fix hostname regex pattern
   2  Current hostname_pattern regex complexity grows exponentially when given a
   3  string of just digits, which can be exploited to cause neutron-server to
   4  freeze.
   5 Author: John Perkins <john.perkins@rackspace.com>
   6 Origin: https://review.openstack.org/#/c/135623/
   7 X-Git-Url: https://review.openstack.org/gitweb?p=openstack%2Fneutron.git;a=commitdiff_plain;h=ad6fefcb4d4068b46b69284e277df6ab2ee30105
   8 Date: Mon, 6 Oct 2014 21:24:57 +0000 (-0500)
   9 Change-Id: I886c6d883a9cb0acd9908495eec50bf0411d8ba8
  10 Bug-Ubuntu:: https://launchpad.net/bugs/1378450
  11 Bug-Debian: https://bugs.debian.org/770431
  12 Last-Update: 2014-11-21
  13
  14 diff --git a/neutron/api/v2/attributes.py b/neutron/api/v2/attributes.py
  15 index 83471f9..21486db 100644
  16 --- a/neutron/api/v2/attributes.py
  17 +++ b/neutron/api/v2/attributes.py
  18 @@ -540,8 +540,8 @@ def convert_to_list(data):
  19          return [data]
  20
  21
  22 -HOSTNAME_PATTERN = ("(?=^.{1,254}$)(^(?:(?!\d+\.|-)[a-zA-Z0-9_\-]"
  23 -                    "{1,63}(?<!-)\.?)+(?:[a-zA-Z]{2,})$)")
  24 +HOSTNAME_PATTERN = ("(?=^.{1,254}$)(^(?:(?!\d+.|-)[a-zA-Z0-9_\-]{1,62}"
  25 +                    "[a-zA-Z0-9]\.?)+(?:[a-zA-Z]{2,})$)")
  26
  27  HEX_ELEM = '[0-9A-Fa-f]'
  28  UUID_PATTERN = '-'.join([HEX_ELEM + '{8}', HEX_ELEM + '{4}',
  29 diff --git a/neutron/tests/unit/test_attributes.py b/neutron/tests/unit/test_attributes.py
  30 index 2fb268d..f8cb462 100644
  31 --- a/neutron/tests/unit/test_attributes.py
  32 +++ b/neutron/tests/unit/test_attributes.py
  33 @@ -281,6 +281,7 @@ class TestAttributes(base.BaseTestCase):
  34                      ['www.hostname.com', 'www.hostname.com'],
  35                      ['77.hostname.com'],
  36                      ['1000.0.0.1'],
  37 +                    ['111111111111111111111111111111111111111111111111111111111111'],  # noqa
  38                      None]
  39
  40          for ns in ns_pools: