Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

gh-134062: Fix hash collisions in IPv4Network and IPv6Network#134063

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
gpshead merged 2 commits intopython:mainfrommssalvatore:fix-network-hash-collisions
May 22, 2025

Conversation

mssalvatore
Copy link
Contributor

@mssalvatoremssalvatore commentedMay 15, 2025•
edited by bedevere-appbot
Loading

Copy link
Member

@picnixzpicnixz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Ideally, a regression test would be good buthash() is an implementation detail, making it CPython-only (I don't know how PyPy and co implement it), and if we don't already have a test for the similar issue you found, there's no need for one.

@picnixzpicnixz added needs backport to 3.13bugs and security fixes needs backport to 3.14bugs and security fixes labelsMay 15, 2025
@mssalvatore
Copy link
ContributorAuthor

Ideally, a regression test would be good buthash() is an implementation detail, making it CPython-only (I don't know how PyPy and co implement it), and if we don't already have a test for the similar issue you found, there's no need for one.

I can add a regression test.

@picnixz
Copy link
Member

I can add a regression test.

Let's add a test where we manually craft the values that are hashed. I'm however unsure whetherhash((X, Y)) where X and Y are known to be ints is always stable. For strings and bytes, this is not the case due to security reasons, but for ints, Ithink it's stable but I cannot say for sure that it's the case.

If there wasn't a test introduced for the previous CVE, just don't bother with a test.

@mssalvatoremssalvatoreforce-pushed thefix-network-hash-collisions branch fromeeabe2a to264bf69CompareMay 16, 2025 14:08
@mssalvatore
Copy link
ContributorAuthor

If there wasn't a test introduced for the previous CVE, just don't bother with a test.

These tests were introduced for the previous CVE:

# issue41004 Hash collisions in IPv4Interface and IPv6Interface
deftestV4HashIsNotConstant(self):
ipv4_address1=ipaddress.IPv4Interface("1.2.3.4")
ipv4_address2=ipaddress.IPv4Interface("2.3.4.5")
self.assertNotEqual(ipv4_address1.__hash__(),ipv4_address2.__hash__())
# issue41004 Hash collisions in IPv4Interface and IPv6Interface
deftestV6HashIsNotConstant(self):
ipv6_address1=ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:1")
ipv6_address2=ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:2")
self.assertNotEqual(ipv6_address1.__hash__(),ipv6_address2.__hash__())

I added some tests in a separate commit. Feel free to drop it if you don't think the tests are valuable.

@mssalvatoremssalvatoreforce-pushed thefix-network-hash-collisions branch from264bf69 to492c579CompareMay 16, 2025 14:12
@gpsheadgpshead added the type-securityA security issue labelMay 17, 2025
@gpsheadgpshead added needs backport to 3.9only security fixes needs backport to 3.10only security fixes needs backport to 3.11only security fixes needs backport to 3.12only security fixes 🔨 test-with-buildbotsTest PR w/ buildbots; report in status section labelsMay 17, 2025
@bedevere-bot
Copy link

🤖 New build scheduled with the buildbot fleet by@gpshead for commit492c579 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F134063%2Fmerge

If you want to schedule another build, you need to add the🔨 test-with-buildbots label again.

@bedevere-botbedevere-bot removed the 🔨 test-with-buildbotsTest PR w/ buildbots; report in status section labelMay 17, 2025
@gpsheadgpshead self-assigned thisMay 17, 2025
@gpsheadgpshead merged commitf3fc0c1 intopython:mainMay 22, 2025
135 of 136 checks passed
@miss-islington-app
Copy link

Thanks@mssalvatore for the PR, and@gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 22, 2025
…ythonGH-134063)(cherry picked from commitf3fc0c1)Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>pythongh-134062: Fix hash collisions in IPv4Network and IPv6Networkpythongh-134062: Add hash collision regression test
miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 22, 2025
…ythonGH-134063)(cherry picked from commitf3fc0c1)Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>pythongh-134062: Fix hash collisions in IPv4Network and IPv6Networkpythongh-134062: Add hash collision regression test
@bedevere-app
Copy link

GH-134476 is a backport of this pull request to the3.14 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.14bugs and security fixes labelMay 22, 2025
miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 22, 2025
…ythonGH-134063)(cherry picked from commitf3fc0c1)Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>pythongh-134062: Fix hash collisions in IPv4Network and IPv6Networkpythongh-134062: Add hash collision regression test
@bedevere-app
Copy link

GH-134477 is a backport of this pull request to the3.13 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.13bugs and security fixes labelMay 22, 2025
miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 22, 2025
…ythonGH-134063)(cherry picked from commitf3fc0c1)Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>pythongh-134062: Fix hash collisions in IPv4Network and IPv6Networkpythongh-134062: Add hash collision regression test
@bedevere-app
Copy link

GH-134478 is a backport of this pull request to the3.12 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.12only security fixes labelMay 22, 2025
@bedevere-app
Copy link

GH-134479 is a backport of this pull request to the3.11 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 22, 2025
…ythonGH-134063)(cherry picked from commitf3fc0c1)Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>pythongh-134062: Fix hash collisions in IPv4Network and IPv6Networkpythongh-134062: Add hash collision regression test
@bedevere-appbedevere-appbot removed the needs backport to 3.11only security fixes labelMay 22, 2025
miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 22, 2025
…ythonGH-134063)(cherry picked from commitf3fc0c1)Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>pythongh-134062: Fix hash collisions in IPv4Network and IPv6Networkpythongh-134062: Add hash collision regression test
@bedevere-app
Copy link

GH-134480 is a backport of this pull request to the3.10 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.10only security fixes labelMay 22, 2025
@bedevere-app
Copy link

GH-134481 is a backport of this pull request to the3.9 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.9only security fixes labelMay 22, 2025
gpshead pushed a commit that referenced this pull requestMay 22, 2025
…H-134063) (#134477)gh-134062: Fix hash collisions in IPv4Network and IPv6Network (GH-134063)(cherry picked from commitf3fc0c1)gh-134062: Fix hash collisions in IPv4Network and IPv6Networkgh-134062: Add hash collision regression testCo-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>
gpshead pushed a commit that referenced this pull requestMay 22, 2025
…H-134063) (#134476)gh-134062: Fix hash collisions in IPv4Network and IPv6Network (GH-134063)(cherry picked from commitf3fc0c1)gh-134062: Fix hash collisions in IPv4Network and IPv6Networkgh-134062: Add hash collision regression testCo-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@picnixzpicnixzpicnixz left review comments

@gpsheadgpsheadgpshead approved these changes

Assignees

@gpsheadgpshead

Labels
type-securityA security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

4 participants
@mssalvatore@picnixz@bedevere-bot@gpshead
[8]ページ先頭
©2009-2025 Movatter.jp