diff options
| author |   Tapas Kundu <39723251+tapakund@users.noreply.github.com> | 2020-07-01 01:00:22 +0530 |
|---|---|---|
| committer |   GitHub <noreply@github.com> | 2020-06-30 15:30:22 -0400 |
| commit | cfc7ff8d05f7a949a88b8a8dd506fb5c1c30d3e9 (patch) | |
| tree | 0223cd1fa7499f1d8a053e7c8ead0a6b9a0a04eb /Lib | |
| parent | Post release updates (diff) | |
| download | cpython-cfc7ff8d05f7a949a88b8a8dd506fb5c1c30d3e9.tar.gz cpython-cfc7ff8d05f7a949a88b8a8dd506fb5c1c30d3e9.tar.bz2 cpython-cfc7ff8d05f7a949a88b8a8dd506fb5c1c30d3e9.zip | |
[3.6] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) (GH-21232)
CVE-2020-14422
The __hash__() methods of classes IPv4Interface and IPv6Interface had issue
of generating constant hash values of 32 and 128 respectively causing hash collisions.
The fix uses the hash() function to generate hash values for the objects
instead of XOR operation
(cherry picked from commit b30ee26e366bf509b7538d79bfec6c6d38d53f28)
Co-authored-by: Ravi Teja P <rvteja92@gmail.com>
Signed-off-by: Tapas Kundu <tkundu@vmware.com>
Diffstat (limited to 'Lib')
| -rw-r--r-- | Lib/ipaddress.py | 4 | ||||
| -rw-r--r-- | Lib/test/test_ipaddress.py | 11 |
2 files changed, 13 insertions, 2 deletions
diff --git a/Lib/ipaddress.py b/Lib/ipaddress.py index 583f02ad542..98492136ca5 100644 --- a/Lib/ipaddress.py +++ b/Lib/ipaddress.py @@ -1418,7 +1418,7 @@ class IPv4Interface(IPv4Address): return False def __hash__(self): - return self._ip ^ self._prefixlen ^ int(self.network.network_address) + return hash((self._ip, self._prefixlen, int(self.network.network_address))) __reduce__ = _IPAddressBase.__reduce__ @@ -2092,7 +2092,7 @@ class IPv6Interface(IPv6Address): return False def __hash__(self): - return self._ip ^ self._prefixlen ^ int(self.network.network_address) + return hash((self._ip, self._prefixlen, int(self.network.network_address))) __reduce__ = _IPAddressBase.__reduce__ diff --git a/Lib/test/test_ipaddress.py b/Lib/test/test_ipaddress.py index 1cef4217bc8..7de444af4aa 100644 --- a/Lib/test/test_ipaddress.py +++ b/Lib/test/test_ipaddress.py @@ -1990,6 +1990,17 @@ class IpaddrUnitTest(unittest.TestCase): sixtofouraddr.sixtofour) self.assertFalse(bad_addr.sixtofour) + # issue41004 Hash collisions in IPv4Interface and IPv6Interface + def testV4HashIsNotConstant(self): + ipv4_address1 = ipaddress.IPv4Interface("1.2.3.4") + ipv4_address2 = ipaddress.IPv4Interface("2.3.4.5") + self.assertNotEqual(ipv4_address1.__hash__(), ipv4_address2.__hash__()) + + # issue41004 Hash collisions in IPv4Interface and IPv6Interface + def testV6HashIsNotConstant(self): + ipv6_address1 = ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:1") + ipv6_address2 = ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:2") + self.assertNotEqual(ipv6_address1.__hash__(), ipv6_address2.__hash__()) if __name__ == '__main__': unittest.main() |