From 3be3b4b2ccea31d30ea15b29ac28bf29a5a4d96d Mon Sep 17 00:00:00 2001
From: catborise <catborise@gmail.com>
Date: Sun, 11 Oct 2026 22:21:49 +0300
Subject: [PATCH] fix(install): openSUSE installs get python-ldap and pyasn1
 without known flaws

The installer's venv sees the system site packages, and pip keeps a
system package that meets a requirement. On openSUSE Leap 15.6 the LDAP
login thus ran on the distro's python-ldap 3.4.4 (CVE-2025-61911, a
filter-escaping bypass, and CVE-2025-61912) and pyasn1 0.5.0
(CVE-2026-30922 and others), which django-auth-ldap loads through
ldap.controls. python-ldap>=3.4.5 and pyasn1>=0.6.4 make pip install
fixed copies in the venv. python-ldap builds there, so openldap2-devel
joins the openSUSE package lists (installer, manual and development
setup) and the update steps. Checked in a fresh Leap 15.6 container
with the installer's package list: 3.4.8 and 0.6.4 from the venv,
ldap.controls imports.
---
 README.md             | 6 +++---
 conf/requirements.txt | 3 +++
 webvirtcloud.sh       | 2 +-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index adfc8190..3c58dbed 100644
--- a/README.md
+++ b/README.md
@@ -179,7 +179,7 @@ nginx -t && systemctl restart nginx supervisord
 
 ```bash
 # 1. System packages (Python 3.11 stack)
-zypper --non-interactive install -y git hostname python311 python311-base python311-devel python311-pip python311-libvirt-python python311-lxml python311-ldap libvirt-devel cyrus-sasl-devel libopenssl-devel gcc pkg-config nginx
+zypper --non-interactive install -y git hostname python311 python311-base python311-devel python311-pip python311-libvirt-python python311-lxml python311-ldap libvirt-devel openldap2-devel cyrus-sasl-devel libopenssl-devel gcc pkg-config nginx
 zypper --non-interactive install -y python3-supervisor || zypper --non-interactive install -y supervisor
 
 # 2. Code
@@ -458,7 +458,7 @@ docker compose up -d
    - a literal `SECRET_KEY = "..."` (older installers wrote it there): put the value into `data/secret_key` instead, or every user is signed out;
    - `SHOW_PROFILE_EDIT_PASSWORD`: keep it for this one `migrate` if you have it (migration `accounts.0008` reads it), then delete it.
 
-3. Install, migrate, and fix ownership and modes (`nginx:nginx` instead of `www-data:www-data` on RHEL / openSUSE):
+3. Install, migrate, and fix ownership and modes (`nginx:nginx` instead of `www-data:www-data` on RHEL / openSUSE). On openSUSE first `zypper --non-interactive install -y openldap2-devel`: pip builds `python-ldap` in the venv:
 
    ```bash
    venv/bin/pip3 install -U -r conf/requirements.txt &&
@@ -595,7 +595,7 @@ Run every step as your normal user, not with `sudo`: if `manage.py` ever runs as
    sudo apt-get update && sudo apt-get -y install git python3-venv python3-dev python3-lxml python3-libvirt python3-ldap libvirt-dev zlib1g-dev libldap2-dev libsasl2-dev gcc pkg-config
 
    # openSUSE Leap 15.x / Tumbleweed / SLES 15 (use python3.11 instead of python3 below)
-   sudo zypper --non-interactive install -y git hostname python311 python311-devel python311-pip python311-libvirt-python python311-lxml python311-ldap libvirt-devel cyrus-sasl-devel libopenssl-devel gcc pkg-config
+   sudo zypper --non-interactive install -y git hostname python311 python311-devel python311-pip python311-libvirt-python python311-lxml python311-ldap libvirt-devel openldap2-devel cyrus-sasl-devel libopenssl-devel gcc pkg-config
    ```
 
 2. Virtualenv and dependencies (`--system-site-packages` is required to see the distro bindings; `dev/requirements.txt` includes `conf/requirements.txt`):
diff --git a/conf/requirements.txt b/conf/requirements.txt
index 7d56e5f1..30575d86 100644
--- a/conf/requirements.txt
+++ b/conf/requirements.txt
@@ -4,6 +4,9 @@ django-bootstrap-icons==0.9.0
 django-otp==1.7.4
 django-qr-code==4.2.0
 django-auth-ldap==5.3.0
+# the installer's venv can otherwise keep older distro copies (openSUSE 15.6)
+python-ldap>=3.4.5
+pyasn1>=0.6.4
 django-axes==8.3.1
 djangorestframework==3.18.3
 drf-nested-routers==0.95.3
diff --git a/webvirtcloud.sh b/webvirtcloud.sh
index 786db083..9b9aa1a8 100755
--- a/webvirtcloud.sh
+++ b/webvirtcloud.sh
@@ -760,7 +760,7 @@ case $distro in
     echo "* Installing OS requirements."
     # On SUSE, install Python 3.11 stack to satisfy Python >= 3.10 requirement along with native libvirt and ldap bindings
     if zypper se -s python311-devel >/dev/null 2>&1; then
-      PACKAGES="git hostname python311 python311-base python311-devel python311-pip python311-libvirt-python python311-lxml python311-ldap libvirt-devel cyrus-sasl-devel libopenssl-devel gcc pkg-config nginx"
+      PACKAGES="git hostname python311 python311-base python311-devel python311-pip python311-libvirt-python python311-lxml python311-ldap libvirt-devel openldap2-devel cyrus-sasl-devel libopenssl-devel gcc pkg-config nginx"
     else
       PACKAGES="git hostname python3-devel python3-pip python3-virtualenv libvirt-devel python3-libvirt python3-lxml openldap2-devel cyrus-sasl-devel libopenssl-devel gcc pkg-config nginx"
     fi