Compare commits
3 Commits
| Author | SHA256 | Date | |
|---|---|---|---|
| ec9c5bd02b | |||
| 1df9a0dcca | |||
| 29113a5d75 |
190
CVE-2025-6069-quad-complex-HTMLParser.patch
Normal file
190
CVE-2025-6069-quad-complex-HTMLParser.patch
Normal file
@@ -0,0 +1,190 @@
|
||||
From 9043edabc7e2f0dd655146e0a4571e2a0b2906af Mon Sep 17 00:00:00 2001
|
||||
From: Serhiy Storchaka <storchaka@gmail.com>
|
||||
Date: Fri, 13 Jun 2025 19:57:48 +0300
|
||||
Subject: [PATCH] gh-135462: Fix quadratic complexity in processing special
|
||||
input in HTMLParser (GH-135464)
|
||||
|
||||
End-of-file errors are now handled according to the HTML5 specs --
|
||||
comments and declarations are automatically closed, tags are ignored.
|
||||
(cherry picked from commit 6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41)
|
||||
|
||||
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
|
||||
---
|
||||
Lib/html/parser.py | 41 +++++---
|
||||
Lib/test/test_htmlparser.py | 51 +++++++---
|
||||
Misc/NEWS.d/next/Security/2025-06-13-15-55-22.gh-issue-135462.KBeJpc.rst | 4
|
||||
3 files changed, 74 insertions(+), 22 deletions(-)
|
||||
create mode 100644 Misc/NEWS.d/next/Security/2025-06-13-15-55-22.gh-issue-135462.KBeJpc.rst
|
||||
|
||||
Index: Python-3.11.13/Lib/html/parser.py
|
||||
===================================================================
|
||||
--- Python-3.11.13.orig/Lib/html/parser.py 2025-07-02 18:12:07.084569398 +0200
|
||||
+++ Python-3.11.13/Lib/html/parser.py 2025-07-02 18:12:12.582519793 +0200
|
||||
@@ -25,6 +25,7 @@
|
||||
charref = re.compile('&#(?:[0-9]+|[xX][0-9a-fA-F]+)[^0-9a-fA-F]')
|
||||
|
||||
starttagopen = re.compile('<[a-zA-Z]')
|
||||
+endtagopen = re.compile('</[a-zA-Z]')
|
||||
piclose = re.compile('>')
|
||||
commentclose = re.compile(r'--\s*>')
|
||||
# Note:
|
||||
@@ -176,7 +177,7 @@
|
||||
k = self.parse_pi(i)
|
||||
elif startswith("<!", i):
|
||||
k = self.parse_html_declaration(i)
|
||||
- elif (i + 1) < n:
|
||||
+ elif (i + 1) < n or end:
|
||||
self.handle_data("<")
|
||||
k = i + 1
|
||||
else:
|
||||
@@ -184,17 +185,35 @@
|
||||
if k < 0:
|
||||
if not end:
|
||||
break
|
||||
- k = rawdata.find('>', i + 1)
|
||||
- if k < 0:
|
||||
- k = rawdata.find('<', i + 1)
|
||||
- if k < 0:
|
||||
- k = i + 1
|
||||
+ if starttagopen.match(rawdata, i): # < + letter
|
||||
+ pass
|
||||
+ elif startswith("</", i):
|
||||
+ if i + 2 == n:
|
||||
+ self.handle_data("</")
|
||||
+ elif endtagopen.match(rawdata, i): # </ + letter
|
||||
+ pass
|
||||
+ else:
|
||||
+ # bogus comment
|
||||
+ self.handle_comment(rawdata[i+2:])
|
||||
+ elif startswith("<!--", i):
|
||||
+ j = n
|
||||
+ for suffix in ("--!", "--", "-"):
|
||||
+ if rawdata.endswith(suffix, i+4):
|
||||
+ j -= len(suffix)
|
||||
+ break
|
||||
+ self.handle_comment(rawdata[i+4:j])
|
||||
+ elif startswith("<![CDATA[", i):
|
||||
+ self.unknown_decl(rawdata[i+3:])
|
||||
+ elif rawdata[i:i+9].lower() == '<!doctype':
|
||||
+ self.handle_decl(rawdata[i+2:])
|
||||
+ elif startswith("<!", i):
|
||||
+ # bogus comment
|
||||
+ self.handle_comment(rawdata[i+2:])
|
||||
+ elif startswith("<?", i):
|
||||
+ self.handle_pi(rawdata[i+2:])
|
||||
else:
|
||||
- k += 1
|
||||
- if self.convert_charrefs and not self.cdata_elem:
|
||||
- self.handle_data(unescape(rawdata[i:k]))
|
||||
- else:
|
||||
- self.handle_data(rawdata[i:k])
|
||||
+ raise AssertionError("we should not get here!")
|
||||
+ k = n
|
||||
i = self.updatepos(i, k)
|
||||
elif startswith("&#", i):
|
||||
match = charref.match(rawdata, i)
|
||||
Index: Python-3.11.13/Lib/test/test_htmlparser.py
|
||||
===================================================================
|
||||
--- Python-3.11.13.orig/Lib/test/test_htmlparser.py 2025-07-02 18:12:08.523658593 +0200
|
||||
+++ Python-3.11.13/Lib/test/test_htmlparser.py 2025-07-02 18:13:32.674943007 +0200
|
||||
@@ -4,6 +4,8 @@
|
||||
import pprint
|
||||
import unittest
|
||||
|
||||
+from test import support
|
||||
+
|
||||
|
||||
class EventCollector(html.parser.HTMLParser):
|
||||
|
||||
@@ -391,28 +393,34 @@
|
||||
('data', '<'),
|
||||
('starttag', 'bc<', [('a', None)]),
|
||||
('endtag', 'html'),
|
||||
- ('data', '\n<img src="URL>'),
|
||||
- ('comment', '/img'),
|
||||
- ('endtag', 'html<')])
|
||||
+ ('data', '\n')])
|
||||
|
||||
def test_starttag_junk_chars(self):
|
||||
+ self._run_check("<", [('data', '<')])
|
||||
+ self._run_check("<>", [('data', '<>')])
|
||||
+ self._run_check("< >", [('data', '< >')])
|
||||
+ self._run_check("< ", [('data', '< ')])
|
||||
self._run_check("</>", [])
|
||||
+ self._run_check("<$>", [('data', '<$>')])
|
||||
self._run_check("</$>", [('comment', '$')])
|
||||
self._run_check("</", [('data', '</')])
|
||||
- self._run_check("</a", [('data', '</a')])
|
||||
+ self._run_check("</a", [])
|
||||
+ self._run_check("</ a>", [('endtag', 'a')])
|
||||
+ self._run_check("</ a", [('comment', ' a')])
|
||||
self._run_check("<a<a>", [('starttag', 'a<a', [])])
|
||||
self._run_check("</a<a>", [('endtag', 'a<a')])
|
||||
- self._run_check("<!", [('data', '<!')])
|
||||
- self._run_check("<a", [('data', '<a')])
|
||||
- self._run_check("<a foo='bar'", [('data', "<a foo='bar'")])
|
||||
- self._run_check("<a foo='bar", [('data', "<a foo='bar")])
|
||||
- self._run_check("<a foo='>'", [('data', "<a foo='>'")])
|
||||
- self._run_check("<a foo='>", [('data', "<a foo='>")])
|
||||
+ self._run_check("<!", [('comment', '')])
|
||||
+ self._run_check("<a", [])
|
||||
+ self._run_check("<a foo='bar'", [])
|
||||
+ self._run_check("<a foo='bar", [])
|
||||
+ self._run_check("<a foo='>'", [])
|
||||
+ self._run_check("<a foo='>", [])
|
||||
self._run_check("<a$>", [('starttag', 'a$', [])])
|
||||
self._run_check("<a$b>", [('starttag', 'a$b', [])])
|
||||
self._run_check("<a$b/>", [('startendtag', 'a$b', [])])
|
||||
self._run_check("<a$b >", [('starttag', 'a$b', [])])
|
||||
self._run_check("<a$b />", [('startendtag', 'a$b', [])])
|
||||
+ self._run_check("</a$b>", [('endtag', 'a$b')])
|
||||
|
||||
def test_slashes_in_starttag(self):
|
||||
self._run_check('<a foo="var"/>', [('startendtag', 'a', [('foo', 'var')])])
|
||||
@@ -549,8 +557,9 @@
|
||||
('comment', ' -- close enough --'),
|
||||
('comment', ''),
|
||||
('comment', '<-- this was an empty comment'),
|
||||
- ('comment', '!! another bogus comment !!!'),
|
||||
+ ('comment', '!! another bogus comment !!!')
|
||||
]
|
||||
+
|
||||
self._run_check(html, expected)
|
||||
|
||||
def test_broken_condcoms(self):
|
||||
@@ -598,6 +607,26 @@
|
||||
('endtag', 'a'), ('data', ' bar & baz')]
|
||||
)
|
||||
|
||||
+ @support.requires_resource('cpu')
|
||||
+ def test_eof_no_quadratic_complexity(self):
|
||||
+ # Each of these examples used to take about an hour.
|
||||
+ # Now they take a fraction of a second.
|
||||
+ def check(source):
|
||||
+ parser = html.parser.HTMLParser()
|
||||
+ parser.feed(source)
|
||||
+ parser.close()
|
||||
+ n = 120_000
|
||||
+ check("<a " * n)
|
||||
+ check("<a a=" * n)
|
||||
+ check("</a " * 14 * n)
|
||||
+ check("</a a=" * 11 * n)
|
||||
+ check("<!--" * 4 * n)
|
||||
+ check("<!" * 60 * n)
|
||||
+ check("<?" * 19 * n)
|
||||
+ check("</$" * 15 * n)
|
||||
+ check("<![CDATA[" * 9 * n)
|
||||
+ check("<!doctype" * 35 * n)
|
||||
+
|
||||
|
||||
class AttributesTestCase(TestCaseBase):
|
||||
|
||||
Index: Python-3.11.13/Misc/NEWS.d/next/Security/2025-06-13-15-55-22.gh-issue-135462.KBeJpc.rst
|
||||
===================================================================
|
||||
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
|
||||
+++ Python-3.11.13/Misc/NEWS.d/next/Security/2025-06-13-15-55-22.gh-issue-135462.KBeJpc.rst 2025-07-02 18:12:12.583386736 +0200
|
||||
@@ -0,0 +1,4 @@
|
||||
+Fix quadratic complexity in processing specially crafted input in
|
||||
+:class:`html.parser.HTMLParser`. End-of-file errors are now handled according
|
||||
+to the HTML5 specs -- comments and declarations are automatically closed,
|
||||
+tags are ignored.
|
||||
BIN
Python-3.11.12.tar.xz
(Stored with Git LFS)
BIN
Python-3.11.12.tar.xz
(Stored with Git LFS)
Binary file not shown.
@@ -1 +0,0 @@
|
||||
{"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": {"certificate": {"rawBytes": "MIICzDCCAlOgAwIBAgIUdXXo3kfUuTRxhwfBaDz2hbLdc00wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjUwNDA4MTUwMzI1WhcNMjUwNDA4MTUxMzI1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEChWB96w27HEQAug03xOuj5aVvdcEBkLaseC6PKbhc3lq1vL78o96RMSdWdBSmBQ4OrRHKvop8VRwn4SI6KPIN6OCAXIwggFuMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUDQFNdUPu8lJprLgYTWMF//JnS0owHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wIgYDVR0RAQH/BBgwFoEUcGFibG9nc2FsQHB5dGhvbi5vcmcwKQYKKwYBBAGDvzABAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGWFe1zcgAABAMARzBFAiAMLue9b86BfjeZl9ML7LekLskkUPTEhI2ciiZrYgaF/gIhAIt66OYOVpC39L+bRXJd1K+T39IGMxYcKoaDrMk0DX59MAoGCCqGSM49BAMDA2cAMGQCMEJ+IEScHRIlOwToBZxVVJjrSxOVvqRSfUO5hvYNkqhYz97LxxUFWpcB/DMiQJOUbwIwKJRh5d7c30z1XyE5zsjOZZmz37ah6aJtyuHLCn3QKJniWBMxIMy9lbXlRZWZgsf0"}, "tlogEntries": [{"logIndex": "193896942", "logId": {"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}, "kindVersion": {"kind": "hashedrekord", "version": "0.0.1"}, "integratedTime": "1744124605", "inclusionPromise": {"signedEntryTimestamp": "MEUCIQDBvc4N4pmeJKalSbAgT5X5MiHnHfiFJ3q/ifYIUDQORwIgNCMUBexEGM4B8VSSWkSDK8uZDGqzA7bgurZdWE0z/vc="}, "inclusionProof": {"logIndex": "71992680", "rootHash": "jow4GaqK8wgGK0YaQkHyINNk1eJRvrgCUSax5oC+bgc=", "treeSize": "71992683", "hashes": ["V5p0el9OkIku5PMpzeGtSeSQLNkd4d0DVh6qNlixrlk=", "CbJfH60w3vsS3xzOzbMZQaokwVM+6efm7OCLjQ5og/k=", "fJZsSVsDo+dpw5484/+8Rm3EH3JostySBfLMVDBUZOU=", "/C+wK2WU/SrXLMnuHDzeBP4K+Jlt/S0nAvzvcXJPp30=", "m6j5meZeKpBfFqNeI7qiCogWjT2IT5NZkgJYwot9sRo=", "V7VMIiqIq7yvzO+ic8vLqIJr3+iGA6whYAGN7YvWhsQ=", "2ap6N1WIsMWGC/Zrnzsx//K9223/3B9lLpJP87M+rXE=", "2kwW2rqY/EMS68q/rOjagVYsEMybFHgxIfbokSa8yKU=", "QReFEOB9XSZtDKsjRtA0fGnYGMYD2Z7qn50auG1YlWo=", "K26LG80DXyb+bC58c4Nw00WigG52v0PCsZGY3ExGsts=", "WEm5OgPzJpYROv+4CcrieexCYyQKrLUH3hbxmcQQ+DM=", "7v8qPHNDLerpduaMx06eb/MwgoQwczTn/cYGKX/9wZ4="], "checkpoint": {"envelope": "rekor.sigstore.dev - 1193050959916656506\n71992683\njow4GaqK8wgGK0YaQkHyINNk1eJRvrgCUSax5oC+bgc=\n\n\u2014 rekor.sigstore.dev wNI9ajBGAiEA7u1b4P659JpwuXMf6lhvC1RhOj/ZH7CpYcAQbitQSwUCIQDJrflW8FGweaiB88lSuLfpfD/a6l6jWhUyOQB/mIJ9rA==\n"}}, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI4NDlkYTg3YWY0ZGYxMzc3MTBjMTc5NmUyNzZhOTU1ZjdhODVjOWY5NzEwODEwNjdjOGY1NjVkMTVjMzUyYTA5In19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJRnMzQi9oTk9OMVY2TXFaUkxzRmNHNlU2Qjkza2FsL1VLZWsvYkRVb3o2MUFpQWZydmsrWXpjK0hHZGJYemRRQ203cjlKU2RNUCtuR1BOblVCZzFoSnAySVE9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZSRU5EUVd4UFowRjNTVUpCWjBsVlpGaFliek5yWmxWMVZGSjRhSGRtUW1GRWVqSm9Za3hrWXpBd2QwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFZkMDVFUVRSTlZGVjNUWHBKTVZkb1kwNU5hbFYzVGtSQk5FMVVWWGhOZWtreFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZEYUZkQ09UWjNNamRJUlZGQmRXY3dNM2hQZFdvMVlWWjJaR05GUW10TVlYTmxRellLVUV0aWFHTXpiSEV4ZGt3M09HODVObEpOVTJSWFpFSlRiVUpSTkU5eVVraExkbTl3T0ZaU2QyNDBVMGsyUzFCSlRqWlBRMEZZU1hkblowWjFUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZFVVVaT0NtUlZVSFU0YkVwd2NreG5XVlJYVFVZdkwwcHVVekJ2ZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBsbldVUldVakJTUVZGSUwwSkNaM2RHYjBWVlkwZEdhV0pIT1c1ak1rWnpVVWhDTldSSGFIWmlhVFYyWTIxamQwdFJXVXRMZDFsQ1FrRkhSQXAyZWtGQ1FWRlJZbUZJVWpCalNFMDJUSGs1YUZreVRuWmtWelV3WTNrMWJtSXlPVzVpUjFWMVdUSTVkRTFEYzBkRGFYTkhRVkZSUW1jM09IZEJVV2RGQ2toUmQySmhTRkl3WTBoTk5reDVPV2haTWs1MlpGYzFNR041Tlc1aU1qbHVZa2RWZFZreU9YUk5TVWRMUW1kdmNrSm5SVVZCWkZvMVFXZFJRMEpJZDBVS1pXZENORUZJV1VFelZEQjNZWE5pU0VWVVNtcEhValJqYlZkak0wRnhTa3RZY21wbFVFc3pMMmcwY0hsblF6aHdOMjgwUVVGQlIxZEdaVEY2WTJkQlFRcENRVTFCVW5wQ1JrRnBRVTFNZFdVNVlqZzJRbVpxWlZwc09VMU1OMHhsYTB4emEydFZVRlJGYUVreVkybHBXbkpaWjJGR0wyZEphRUZKZERZMlQxbFBDbFp3UXpNNVRDdGlVbGhLWkRGTEsxUXpPVWxIVFhoWlkwdHZZVVJ5VFdzd1JGZzFPVTFCYjBkRFEzRkhVMDAwT1VKQlRVUkJNbU5CVFVkUlEwMUZTaXNLU1VWVFkwaFNTV3hQZDFSdlFscDRWbFpLYW5KVGVFOVdkbkZTVTJaVlR6Vm9kbGxPYTNGb1dYbzVOMHg0ZUZWR1YzQmpRaTlFVFdsUlNrOVZZbmRKZHdwTFNsSm9OV1EzWXpNd2VqRlllVVUxZW5OcVQxcGFiWG96TjJGb05tRktkSGwxU0V4RGJqTlJTMHB1YVZkQ1RYaEpUWGs1YkdKWWJGSmFWMXBuYzJZd0NpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9fX19"}], "timestampVerificationData": {}}, "messageSignature": {"messageDigest": {"algorithm": "SHA2_256", "digest": "hJ2oevTfE3cQwXluJ2qVX3qFyflxCBBnyPVl0Vw1Kgk="}, "signature": "MEQCIFs3B/hNON1V6MqZRLsFcG6U6B93kal/UKek/bDUoz61AiAfrvk+Yzc+HGdbXzdQCm7r9JSdMP+nGPNnUBg1hJp2IQ=="}}
|
||||
BIN
Python-3.11.13.tar.xz
(Stored with Git LFS)
Normal file
BIN
Python-3.11.13.tar.xz
(Stored with Git LFS)
Normal file
Binary file not shown.
1
Python-3.11.13.tar.xz.sigstore
Normal file
1
Python-3.11.13.tar.xz.sigstore
Normal file
@@ -0,0 +1 @@
|
||||
{"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": {"certificate": {"rawBytes": "MIICzjCCAlSgAwIBAgIUfnOGm4U1QCsCXWiDvPy5Tgni2HUwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjUwNjAzMTkyNzM1WhcNMjUwNjAzMTkzNzM1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpTsf/wrCdu4Domf4WOtO4CLkj51wmj4iesYv5N6DYhghPjqQFwGYI9gFc/WX6QMIWh5YHU2NGxrmM7KfbAYzz6OCAXMwggFvMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUkQ2/O4Fivj1bTq7NTQczm1RdtYAwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wIgYDVR0RAQH/BBgwFoEUcGFibG9nc2FsQHB5dGhvbi5vcmcwKQYKKwYBBAGDvzABAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMIGLBgorBgEEAdZ5AgQCBH0EewB5AHcA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGXN0NwGwAABAMASDBGAiEA6pD8PjS+5z2SQre/NS/wOdFSjVMsxvtfF6A1jg+1T3YCIQDC44S/Z3c0dNddM7EkE+A3j7Vft3hqRUoFkNe4U6g5qTAKBggqhkjOPQQDAwNoADBlAjA6lBI2r3KCZFc+2affpH3S3Xj3gMOKh8Lr5Z7TgkGp3Q6QsnExGmJJ0leXhqH6rQkCMQDfxk/6DyhbO7KTrIUfmrbZoa7dV75cresJS69Xk67XN57qsqY52DZj9o4fbUIw4ro="}, "tlogEntries": [{"logIndex": "228953871", "logId": {"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}, "kindVersion": {"kind": "hashedrekord", "version": "0.0.1"}, "integratedTime": "1748978856", "inclusionPromise": {"signedEntryTimestamp": "MEUCIQC9nXmfcRqyOL2Zmw1zI7+kulTbmDE3Yfzew81mXJGU4QIgF8Uhdg2uzttSA6erOuEchX68PCyJ0cVFHE0XJX2+ZfE="}, "inclusionProof": {"logIndex": "107049609", "rootHash": "Ilofw5POqC/C3zqfrdMQP1DyhNW+UfB9fHdjrbK6qaM=", "treeSize": "107049610", "hashes": ["AcD1iyjU7nuIPqAq29ynz7PEdq6zPXglj6e2tkH+/do=", "1BNDCN01B3dbUo/TfLaQgKIYTvPyrkcrHKd69GxuF2E=", "t59A0CV2pHM2S9AgZgcEA6FbXhgNZGo0jMRIXHiqsJ0=", "bCrkgWpJ8MBic+mIfCRsKi+5XAMqgM8Lc6G0LLfzZ7M=", "4iwdOrGkcqdN0qqZUx/gv8a8qpLMqVj8aXRVmhQ558c=", "mAX/zvx1jR0ujLtDApsQpHyxmoDGidClHMOn0BX1aQA=", "u5LKLBPTYgXZg0fBi6/8LuEeNy3EBAxJF0AkkB4Co6E=", "SPUVncwJRVX/n/RICCYqLpAzraqx7S0eMdXRr1RLRgg=", "uEJFtwcGQJMd9kjQhkXb7gl2WD3WMElCc15uDFvFGxs=", "VdOKzpQhJlpXgijzXANf/hNlje1G/N1kUuVnKNskkso=", "mta5fH/gFwxJ/0fT8yGpn3sFCY0G1RY555Iflm0LInM=", "7v8qPHNDLerpduaMx06eb/MwgoQwczTn/cYGKX/9wZ4="], "checkpoint": {"envelope": "rekor.sigstore.dev - 1193050959916656506\n107049610\nIlofw5POqC/C3zqfrdMQP1DyhNW+UfB9fHdjrbK6qaM=\n\n\u2014 rekor.sigstore.dev wNI9ajBGAiEAjtzTnsnrGx0G3Dg99s89cPUh6EA+cxkicQ9j4qYU60wCIQCKcAL4kdakbq2JrBVgk7bRNf3FoJRrEI6SCjv16f7Crg==\n"}}, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI4ZmI1ZjlmYmM3NjA5ZmE4MjJjYjMxNTQ5ODg0NTc1ZGI3ZmQ5NjU3Y2JmZmI4OTUxMGI1ZDc5NzU5NjNhODNhIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJUUM5Q1JZRjNSWGUzdDNxQlBJd2UrR3pMMTJCOXVLTjIrRFpWa2JjZW1FTS93SWdPMDFKaVhnbUJxZEN5RVhoM05JUEt5QlRBb2hpcjZHTkhZdXhiSUxKNDlRPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZha05EUVd4VFowRjNTVUpCWjBsVlptNVBSMjAwVlRGUlEzTkRXRmRwUkhaUWVUVlVaMjVwTWtoVmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFZkMDVxUVhwTlZHdDVUbnBOTVZkb1kwNU5hbFYzVG1wQmVrMVVhM3BPZWsweFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZ3VkhObUwzZHlRMlIxTkVSdmJXWTBWMDkwVHpSRFRHdHFOVEYzYldvMGFXVnpXWFlLTlU0MlJGbG9aMmhRYW5GUlJuZEhXVWs1WjBaakwxZFlObEZOU1Zkb05WbElWVEpPUjNoeWJVMDNTMlppUVZsNmVqWlBRMEZZVFhkblowWjJUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZyVVRJdkNrODBSbWwyYWpGaVZIRTNUbFJSWTNwdE1WSmtkRmxCZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBsbldVUldVakJTUVZGSUwwSkNaM2RHYjBWVlkwZEdhV0pIT1c1ak1rWnpVVWhDTldSSGFIWmlhVFYyWTIxamQwdFJXVXRMZDFsQ1FrRkhSQXAyZWtGQ1FWRlJZbUZJVWpCalNFMDJUSGs1YUZreVRuWmtWelV3WTNrMWJtSXlPVzVpUjFWMVdUSTVkRTFEYzBkRGFYTkhRVkZSUW1jM09IZEJVV2RGQ2toUmQySmhTRkl3WTBoTk5reDVPV2haTWs1MlpGYzFNR041Tlc1aU1qbHVZa2RWZFZreU9YUk5TVWRNUW1kdmNrSm5SVVZCWkZvMVFXZFJRMEpJTUVVS1pYZENOVUZJWTBFelZEQjNZWE5pU0VWVVNtcEhValJqYlZkak0wRnhTa3RZY21wbFVFc3pMMmcwY0hsblF6aHdOMjgwUVVGQlIxaE9NRTUzUjNkQlFRcENRVTFCVTBSQ1IwRnBSVUUyY0VRNFVHcFRLelY2TWxOUmNtVXZUbE12ZDA5a1JsTnFWazF6ZUhaMFprWTJRVEZxWnlzeFZETlpRMGxSUkVNME5GTXZDbG96WXpCa1RtUmtUVGRGYTBVclFUTnFOMVptZEROb2NWSlZiMFpyVG1VMFZUWm5OWEZVUVV0Q1oyZHhhR3RxVDFCUlVVUkJkMDV2UVVSQ2JFRnFRVFlLYkVKSk1uSXpTME5hUm1Nck1tRm1abkJJTTFNeldHb3paMDFQUzJnNFRISTFXamRVWjJ0SGNETlJObEZ6YmtWNFIyMUtTakJzWlZob2NVZzJjbEZyUXdwTlVVUm1lR3N2TmtSNWFHSlBOMHRVY2tsVlptMXlZbHB2WVRka1ZqYzFZM0psYzBwVE5qbFlhelkzV0U0MU4zRnpjVmsxTWtSYWFqbHZOR1ppVlVsM0NqUnliejBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In19fX0="}], "timestampVerificationData": {}}, "messageSignature": {"messageDigest": {"algorithm": "SHA2_256", "digest": "j7X5+8dgn6giyzFUmIRXXbf9llfL/7iVELXXl1ljqDo="}, "signature": "MEUCIQC9CRYF3RXe3t3qBPIwe+GzL12B9uKN2+DZVkbcemEM/wIgO01JiXgmBqdCyEXh3NIPKyBTAohir6GNHYuxbILJ49Q="}}
|
||||
@@ -1,5 +1,9 @@
|
||||
Description: Add platform triplets for LoongArch.
|
||||
|
||||
---
|
||||
configure.ac | 14 ++++++++++++++
|
||||
1 file changed, 14 insertions(+)
|
||||
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -976,6 +976,20 @@ cat > conftest.c <<EOF
|
||||
|
||||
@@ -3,11 +3,9 @@
|
||||
Misc/NEWS | 2 +-
|
||||
2 files changed, 1 insertion(+), 4 deletions(-)
|
||||
|
||||
Index: Python-3.11.12/Doc/using/configure.rst
|
||||
===================================================================
|
||||
--- Python-3.11.12.orig/Doc/using/configure.rst 2025-04-08 16:15:29.000000000 +0200
|
||||
+++ Python-3.11.12/Doc/using/configure.rst 2025-04-11 10:52:39.419877561 +0200
|
||||
@@ -43,7 +43,6 @@
|
||||
--- a/Doc/using/configure.rst
|
||||
+++ b/Doc/using/configure.rst
|
||||
@@ -43,7 +43,6 @@ General Options
|
||||
|
||||
See :data:`sys.int_info.bits_per_digit <sys.int_info>`.
|
||||
|
||||
@@ -15,7 +13,7 @@ Index: Python-3.11.12/Doc/using/configure.rst
|
||||
.. option:: --with-cxx-main=COMPILER
|
||||
|
||||
Compile the Python ``main()`` function and link Python executable with C++
|
||||
@@ -529,13 +528,11 @@
|
||||
@@ -529,13 +528,11 @@ macOS Options
|
||||
|
||||
See ``Mac/README.rst``.
|
||||
|
||||
@@ -29,11 +27,9 @@ Index: Python-3.11.12/Doc/using/configure.rst
|
||||
.. option:: --enable-framework=INSTALLDIR
|
||||
|
||||
Create a Python.framework rather than a traditional Unix install. Optional
|
||||
Index: Python-3.11.12/Misc/NEWS
|
||||
===================================================================
|
||||
--- Python-3.11.12.orig/Misc/NEWS 2025-04-08 16:15:29.000000000 +0200
|
||||
+++ Python-3.11.12/Misc/NEWS 2025-04-11 10:52:39.425550531 +0200
|
||||
@@ -9872,7 +9872,7 @@
|
||||
--- a/Misc/NEWS
|
||||
+++ b/Misc/NEWS
|
||||
@@ -9911,7 +9911,7 @@ C API
|
||||
- bpo-40939: Removed documentation for the removed ``PyParser_*`` C API.
|
||||
|
||||
- bpo-43795: The list in :ref:`limited-api-list` now shows the public name
|
||||
|
||||
@@ -1,82 +0,0 @@
|
||||
From 3d390148c05a7ea2d401c4633e7d4db75ebf97d9 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Viktorin <encukou@gmail.com>
|
||||
Date: Thu, 7 Nov 2024 11:07:02 +0100
|
||||
Subject: [PATCH] gh-126500: test_ssl: Don't stop ThreadedEchoServer on OSError
|
||||
in ConnectionHandler; rely on __exit__ (GH-126503)
|
||||
|
||||
If `read()` in the ConnectionHandler thread raises `OSError` (except `ConnectionError`),
|
||||
the ConnectionHandler shuts down the entire ThreadedEchoServer,
|
||||
preventing further connections.
|
||||
It also does that for `EPROTOTYPE` in `wrap_conn`.
|
||||
|
||||
As far as I can see, this is done to avoid the server thread getting stuck,
|
||||
forgotten, in its accept loop. However, since 2011 (5b95eb90a7167285b6544b50865227c584943c9a)
|
||||
the server is used as a context manager, and its `__exit__` does `stop()` and `join()`.
|
||||
(I'm not sure if we *always* used `with` since that commit, but currently we do.)
|
||||
|
||||
Make sure that the context manager *is* used, and remove the `server.stop()`
|
||||
calls from ConnectionHandler.
|
||||
(cherry picked from commit c9cda1608edf7664c10f4f467e24591062c2fe62)
|
||||
|
||||
Co-authored-by: Petr Viktorin <encukou@gmail.com>
|
||||
---
|
||||
Lib/test/test_ssl.py | 17 ++++++++++++-----
|
||||
1 file changed, 12 insertions(+), 5 deletions(-)
|
||||
|
||||
Index: Python-3.11.12/Lib/test/test_ssl.py
|
||||
===================================================================
|
||||
--- Python-3.11.12.orig/Lib/test/test_ssl.py 2025-04-19 19:55:02.157545844 +0200
|
||||
+++ Python-3.11.12/Lib/test/test_ssl.py 2025-04-19 19:55:05.014552345 +0200
|
||||
@@ -2516,7 +2516,6 @@
|
||||
# See also http://erickt.github.io/blog/2014/11/19/adventures-in-debugging-a-potential-osx-kernel-bug/
|
||||
if e.errno != errno.EPROTOTYPE and sys.platform != "darwin":
|
||||
self.running = False
|
||||
- self.server.stop()
|
||||
self.close()
|
||||
return False
|
||||
else:
|
||||
@@ -2651,10 +2650,6 @@
|
||||
self.close()
|
||||
self.running = False
|
||||
|
||||
- # normally, we'd just stop here, but for the test
|
||||
- # harness, we want to stop the server
|
||||
- self.server.stop()
|
||||
-
|
||||
def __init__(self, certificate=None, ssl_version=None,
|
||||
certreqs=None, cacerts=None,
|
||||
chatty=True, connectionchatty=False, starttls_server=False,
|
||||
@@ -2688,21 +2683,33 @@
|
||||
self.conn_errors = []
|
||||
threading.Thread.__init__(self)
|
||||
self.daemon = True
|
||||
+ self._in_context = False
|
||||
|
||||
def __enter__(self):
|
||||
+ if self._in_context:
|
||||
+ raise ValueError('Re-entering ThreadedEchoServer context')
|
||||
+ self._in_context = True
|
||||
self.start(threading.Event())
|
||||
self.flag.wait()
|
||||
return self
|
||||
|
||||
def __exit__(self, *args):
|
||||
+ assert self._in_context
|
||||
+ self._in_context = False
|
||||
self.stop()
|
||||
self.join()
|
||||
|
||||
def start(self, flag=None):
|
||||
+ if not self._in_context:
|
||||
+ raise ValueError(
|
||||
+ 'ThreadedEchoServer must be used as a context manager')
|
||||
self.flag = flag
|
||||
threading.Thread.start(self)
|
||||
|
||||
def run(self):
|
||||
+ if not self._in_context:
|
||||
+ raise ValueError(
|
||||
+ 'ThreadedEchoServer must be used as a context manager')
|
||||
self.sock.settimeout(1.0)
|
||||
self.sock.listen(5)
|
||||
self.active = True
|
||||
@@ -1,17 +0,0 @@
|
||||
---
|
||||
Lib/test/test_posix.py | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
Index: Python-3.11.8/Lib/test/test_posix.py
|
||||
===================================================================
|
||||
--- Python-3.11.8.orig/Lib/test/test_posix.py
|
||||
+++ Python-3.11.8/Lib/test/test_posix.py
|
||||
@@ -430,7 +430,7 @@ class PosixTester(unittest.TestCase):
|
||||
def test_posix_fadvise(self):
|
||||
fd = os.open(os_helper.TESTFN, os.O_RDONLY)
|
||||
try:
|
||||
- posix.posix_fadvise(fd, 0, 0, posix.POSIX_FADV_WILLNEED)
|
||||
+ posix.posix_fadvise(fd, 0, 0, posix.POSIX_FADV_RANDOM)
|
||||
finally:
|
||||
os.close(fd)
|
||||
|
||||
@@ -1,3 +1,67 @@
|
||||
-------------------------------------------------------------------
|
||||
Wed Jul 2 14:47:20 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
|
||||
case quadratic complexity when processing certain crafted
|
||||
malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Jul 1 08:19:52 UTC 2025 - Daniel Garcia <daniel.garcia@suse.com>
|
||||
|
||||
- Use one core to build doc. This will make sphinx doc build
|
||||
reproducible.
|
||||
bsc#1243155
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Jun 9 17:19:32 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Update to 3.11.13:
|
||||
- Security
|
||||
- gh-135034: Fixes multiple issues that allowed tarfile
|
||||
extraction filters (filter="data" and filter="tar")
|
||||
to be bypassed using crafted symlinks and hard links.
|
||||
Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
|
||||
(bsc#1244059), CVE-2025-4330 (bsc#1244060), and
|
||||
CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
|
||||
(gh#135034, bsc#1244061).
|
||||
- gh-133767: Fix use-after-free in the “unicode-escape”
|
||||
decoder with a non-“strict” error handler (CVE-2025-4516,
|
||||
bsc#1243273).
|
||||
- gh-128840: Short-circuit the processing of long IPv6
|
||||
addresses early in ipaddress to prevent excessive memory
|
||||
consumption and a minor denial-of-service.
|
||||
- Library
|
||||
- gh-128840: Fix parsing long IPv6 addresses with embedded
|
||||
IPv4 address.
|
||||
- gh-134062: ipaddress: fix collisions in __hash__() for
|
||||
IPv4Network and IPv6Network objects.
|
||||
- gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
|
||||
according to RFC 3596, §2.5. Patch by Bénédikt Tran.
|
||||
- bpo-43633: Improve the textual representation of
|
||||
IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
|
||||
in ipaddress. Patch by Oleksandr Pavliuk.
|
||||
- Remove upstreamed patches:
|
||||
- gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
|
||||
- CVE-2025-4516-DecodeError-handler.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu May 22 13:01:17 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Add CVE-2025-4516-DecodeError-handler.patch fixing
|
||||
CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
|
||||
vulnerability, which could lead to DoS.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Sat May 17 10:02:27 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Use extended %autopatch.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Sat May 10 11:38:24 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
|
||||
since kernel 3.6-rc1)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Apr 18 14:05:38 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
@@ -255,7 +319,7 @@ Thu Jul 18 22:37:07 UTC 2024 - Matej Cepl <mcepl@cepl.eu>
|
||||
Mon Jul 15 12:14:05 UTC 2024 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Stop using %%defattr, it seems to be breaking proper executable
|
||||
attributes on /usr/bin/ scripts (bsc#1227378).
|
||||
attributes on /usr/bin/ scripts (bsc#1227378).
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Jul 2 10:32:58 UTC 2024 - Daniel Garcia <daniel.garcia@suse.com>
|
||||
@@ -596,7 +660,7 @@ Fri Feb 23 01:06:42 UTC 2024 - Matej Cepl <mcepl@suse.com>
|
||||
Tue Feb 20 22:14:02 UTC 2024 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Remove double definition of /usr/bin/idle%%{version} in
|
||||
%%files.
|
||||
%%files.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Feb 15 10:29:07 UTC 2024 - Daniel Garcia <daniel.garcia@suse.com>
|
||||
@@ -1516,12 +1580,12 @@ Wed Sep 6 07:52:11 UTC 2023 - Daniel Garcia <daniel.garcia@suse.com>
|
||||
-------------------------------------------------------------------
|
||||
Thu Aug 10 09:33:26 UTC 2023 - Dirk Müller <dmueller@suse.com>
|
||||
|
||||
- restrict PEP668 to ALP/Tumbleweed
|
||||
- restrict PEP668 to ALP/Tumbleweed
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Aug 4 06:37:41 UTC 2023 - Dirk Müller <dmueller@suse.com>
|
||||
|
||||
- add externally_managed.in to label this build as PEP-668 managed
|
||||
- add externally_managed.in to label this build as PEP-668 managed
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Aug 3 14:53:38 UTC 2023 - Matej Cepl <mcepl@suse.com>
|
||||
@@ -2876,7 +2940,7 @@ Sat Mar 26 22:52:45 UTC 2022 - Matej Cepl <mcepl@suse.com>
|
||||
Tue Feb 22 05:53:06 UTC 2022 - Steve Kowalik <steven.kowalik@suse.com>
|
||||
|
||||
- Add patch support-expat-245.patch:
|
||||
* Support Expat >= 2.4.5
|
||||
* Support Expat >= 2.4.5
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Feb 15 23:05:55 UTC 2022 - Matej Cepl <mcepl@suse.com>
|
||||
@@ -3066,7 +3130,7 @@ Sat Jun 5 21:21:38 UTC 2021 - Matej Cepl <mcepl@suse.com>
|
||||
-------------------------------------------------------------------
|
||||
Fri Jun 4 21:36:30 UTC 2021 - Dirk Müller <dmueller@suse.com>
|
||||
|
||||
- allow build with Sphinx >= 3.x
|
||||
- allow build with Sphinx >= 3.x
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Jun 2 13:12:04 UTC 2021 - Dan Čermák <dcermak@suse.com>
|
||||
@@ -3618,7 +3682,7 @@ Sat Dec 12 14:29:33 UTC 2020 - Matej Cepl <mcepl@suse.com>
|
||||
Thu Dec 10 00:26:51 UTC 2020 - Benjamin Greiner <code@bnavigator.de>
|
||||
|
||||
- Last try before this results in an editwar:
|
||||
* remove importlib_resources and importlib-metadata
|
||||
* remove importlib_resources and importlib-metadata
|
||||
provides/obsoletes
|
||||
* import importlib_resources is not the same as
|
||||
import importlib.resources, same for metadata
|
||||
@@ -3735,54 +3799,54 @@ Tue Jul 21 09:53:06 UTC 2020 - Callum Farmer <callumjfarmer13@gmail.com>
|
||||
- Removed CVE-2019-20907_tarfile-inf-loop.patch: fixed in upstream
|
||||
- Removed recursion.tar: contained in upstream
|
||||
- Update to 3.9.0b5:
|
||||
- bpo-41304: Fixes python3x._pth being ignored on Windows, caused
|
||||
- bpo-41304: Fixes python3x._pth being ignored on Windows, caused
|
||||
by the fix for bpo-29778 (CVE-2020-15801).
|
||||
- bpo-41162: Audit hooks are now cleared later during
|
||||
finalization to avoid missing events.
|
||||
- bpo-29778: Ensure python3.dll is loaded from correct locations
|
||||
- bpo-29778: Ensure python3.dll is loaded from correct locations
|
||||
when Python is embedded (CVE-2020-15523).
|
||||
- bpo-39603: Prevent http header injection by rejecting control
|
||||
- bpo-39603: Prevent http header injection by rejecting control
|
||||
characters in http.client.putrequest(…).
|
||||
- bpo-41295: Resolve a regression in CPython 3.8.4 where defining
|
||||
“__setattr__” in a multi-inheritance setup and
|
||||
“__setattr__” in a multi-inheritance setup and
|
||||
calling up the hierarchy chain could fail if builtins/extension
|
||||
types were involved in the base types.
|
||||
- bpo-41247: Always cache the running loop holder when running
|
||||
- bpo-41247: Always cache the running loop holder when running
|
||||
asyncio.set_running_loop.
|
||||
- bpo-41252: Fix incorrect refcounting in
|
||||
- bpo-41252: Fix incorrect refcounting in
|
||||
_ssl.c’s _servername_callback().
|
||||
- bpo-41215: Use non-NULL default values in the PEG parser
|
||||
- bpo-41215: Use non-NULL default values in the PEG parser
|
||||
keyword list to overcome a bug that was '
|
||||
preventing Python from being properly compiled when using the
|
||||
XLC compiler. Patch by Pablo Galindo.
|
||||
- bpo-41218: Python 3.8.3 had a regression where compiling with
|
||||
ast.PyCF_ALLOW_TOP_LEVEL_AWAIT would
|
||||
- bpo-41218: Python 3.8.3 had a regression where compiling with
|
||||
ast.PyCF_ALLOW_TOP_LEVEL_AWAIT would
|
||||
aggressively mark list comprehension with CO_COROUTINE. Now only
|
||||
list comprehension making use of async/await will tagged as so.
|
||||
- bpo-41175: Guard against a NULL pointer dereference within
|
||||
- bpo-41175: Guard against a NULL pointer dereference within
|
||||
bytearrayobject triggered by the bytearray() + bytearray() operation.
|
||||
- bpo-39960: The “hackcheck” that prevents sneaking around a type’s
|
||||
__setattr__() by calling the superclass method was
|
||||
- bpo-39960: The “hackcheck” that prevents sneaking around a type’s
|
||||
__setattr__() by calling the superclass method was
|
||||
rewritten to allow C implemented heap types.
|
||||
- bpo-41288: Unpickling invalid NEWOBJ_EX opcode with the
|
||||
- bpo-41288: Unpickling invalid NEWOBJ_EX opcode with the
|
||||
C implementation raises now UnpicklingError instead of crashing.
|
||||
- bpo-39017: Avoid infinite loop when reading specially crafted
|
||||
- bpo-39017: Avoid infinite loop when reading specially crafted
|
||||
TAR files using the tarfile module (CVE-2019-20907, bsc#1174091).
|
||||
- bpo-41235: Fix the error handling in ssl.SSLContext.load_dh_params().
|
||||
- bpo-41207: In distutils.spawn, restore expectation that
|
||||
- bpo-41207: In distutils.spawn, restore expectation that
|
||||
DistutilsExecError is raised when the command is not found.
|
||||
- bpo-39168: Remove the __new__ method of typing.Generic.
|
||||
- bpo-41194: Fix a crash in the _ast module: it can no longer be
|
||||
- bpo-41194: Fix a crash in the _ast module: it can no longer be
|
||||
loaded more than once. It now uses a global state rather than a module state.
|
||||
- bpo-39384: Fixed email.contentmanager to allow set_content() to set a
|
||||
- bpo-39384: Fixed email.contentmanager to allow set_content() to set a
|
||||
null string.
|
||||
- bpo-41300: Save files with non-ascii chars.
|
||||
- bpo-41300: Save files with non-ascii chars.
|
||||
Fix regression released in 3.9.0b4 and 3.8.4.
|
||||
- bpo-37765: Add keywords to module name completion list.
|
||||
- bpo-37765: Add keywords to module name completion list.
|
||||
Rewrite Completions section of IDLE doc.
|
||||
- bpo-40170: Revert PyType_HasFeature() change: it reads
|
||||
again directly the PyTypeObject.tp_flags
|
||||
member when the limited C API is not used, rather than always calling
|
||||
- bpo-40170: Revert PyType_HasFeature() change: it reads
|
||||
again directly the PyTypeObject.tp_flags
|
||||
member when the limited C API is not used, rather than always calling
|
||||
PyType_GetFlags() which hides implementation details.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
@@ -4303,7 +4367,7 @@ Wed Jun 5 12:19:09 CEST 2019 - Matej Cepl <mcepl@suse.com>
|
||||
pickling costs between processes
|
||||
- typed_ast is merged back to CPython
|
||||
- LOAD_GLOBAL is now 40% faster
|
||||
- pickle now uses Protocol 4 by default, improving performance
|
||||
- pickle now uses Protocol 4 by default, improving performance
|
||||
- Remove patches which were included in the upstream:
|
||||
- 00251-change-user-install-location.patch
|
||||
- 00316-mark-bdist_wininst-unsupported.patch
|
||||
@@ -4448,7 +4512,7 @@ Mon Dec 17 17:24:49 CET 2018 - mcepl@suse.com
|
||||
|
||||
- Upgrade to 3.7.2rc1:
|
||||
* bugfix release, for the full list of all changes see
|
||||
https://docs.python.org/3.7/whatsnew/changelog.html#changelog
|
||||
https://docs.python.org/3.7/whatsnew/changelog.html#changelog
|
||||
- Make run of the test suite more verbose
|
||||
|
||||
-------------------------------------------------------------------
|
||||
@@ -4875,7 +4939,7 @@ Mon Mar 13 14:04:22 UTC 2017 - jmatejek@suse.com
|
||||
Sat Feb 25 20:55:57 UTC 2017 - bwiedemann@suse.com
|
||||
|
||||
- Add 0001-allow-for-reproducible-builds-of-python-packages.patch
|
||||
upstream https://github.com/python/cpython/pull/296
|
||||
upstream https://github.com/python/cpython/pull/296
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Feb 8 12:30:20 UTC 2017 - jmatejek@suse.com
|
||||
@@ -4941,7 +5005,7 @@ Mon Mar 7 20:38:11 UTC 2016 - toddrme2178@gmail.com
|
||||
|
||||
- Add Python-3.5.1-fix_lru_cache_copying.patch
|
||||
Fix copying the lru_cache() wrapper object.
|
||||
Fixes deep-copying lru_cache regression, which worked on
|
||||
Fixes deep-copying lru_cache regression, which worked on
|
||||
previous versions of python but fails on python 3.5.
|
||||
This fixes a bunch of packages in devel:languages:python3.
|
||||
See: https://bugs.python.org/issue25447
|
||||
@@ -5079,7 +5143,7 @@ Sun Jan 11 13:01:30 UTC 2015 - p.drouand@gmail.com
|
||||
-------------------------------------------------------------------
|
||||
Sat Oct 18 20:14:54 UTC 2014 - crrodriguez@opensuse.org
|
||||
|
||||
- Only pkgconfig(x11) is required for build, not the whole
|
||||
- Only pkgconfig(x11) is required for build, not the whole
|
||||
set of packages provided by xorg-x11-devel metapackage.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
@@ -5139,7 +5203,7 @@ Wed Mar 26 15:24:46 UTC 2014 - jmatejek@suse.com
|
||||
-------------------------------------------------------------------
|
||||
Mon Mar 24 17:29:31 UTC 2014 - dmueller@suse.com
|
||||
|
||||
- remove blacklisting of test_posix on aarch64: qemu bug is fixed
|
||||
- remove blacklisting of test_posix on aarch64: qemu bug is fixed
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Mar 17 18:26:58 UTC 2014 - jmatejek@suse.com
|
||||
@@ -5242,7 +5306,7 @@ Tue Nov 19 14:28:41 UTC 2013 - jmatejek@suse.com
|
||||
-------------------------------------------------------------------
|
||||
Tue Oct 15 17:44:08 UTC 2013 - crrodriguez@opensuse.org
|
||||
|
||||
- build with -DOPENSSL_LOAD_CONF for the same reasons
|
||||
- build with -DOPENSSL_LOAD_CONF for the same reasons
|
||||
described in the python2 package.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
@@ -5254,7 +5318,7 @@ Fri Aug 16 11:35:15 UTC 2013 - jmatejek@suse.com
|
||||
-------------------------------------------------------------------
|
||||
Thu Aug 8 14:54:49 UTC 2013 - dvaleev@suse.com
|
||||
|
||||
- Exclue test_faulthandler from tests on powerpc due to bnc#831629
|
||||
- Exclue test_faulthandler from tests on powerpc due to bnc#831629
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Jun 13 15:05:34 UTC 2013 - jmatejek@suse.com
|
||||
@@ -5313,7 +5377,7 @@ Fri Mar 1 07:42:21 UTC 2013 - dmueller@suse.com
|
||||
|
||||
- add ctypes-libffi-aarch64.patch:
|
||||
* import aarch64 support for libffi in _ctypes module
|
||||
- add aarch64 to the list of lib64 based archs
|
||||
- add aarch64 to the list of lib64 based archs
|
||||
- add movetogetdents64.diff:
|
||||
* port to getdents64, as SYS_getdents is not implemented everywhere
|
||||
|
||||
@@ -5367,9 +5431,9 @@ Mon Oct 29 18:21:45 UTC 2012 - dmueller@suse.com
|
||||
-------------------------------------------------------------------
|
||||
Thu Oct 25 08:14:36 UTC 2012 - Rene.vanPaassen@gmail.com
|
||||
|
||||
- exclude test_math for SLE 11; math library fails on negative
|
||||
- exclude test_math for SLE 11; math library fails on negative
|
||||
gamma function values close to integers and 0, probably
|
||||
due to imprecision in -lm on SLE_11_SP2.
|
||||
due to imprecision in -lm on SLE_11_SP2.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Oct 16 12:15:34 UTC 2012 - coolo@suse.com
|
||||
@@ -5393,7 +5457,7 @@ Mon Oct 1 08:53:03 UTC 2012 - idonmez@suse.com
|
||||
-------------------------------------------------------------------
|
||||
Thu Sep 27 12:35:01 UTC 2012 - idonmez@suse.com
|
||||
|
||||
- Correct dependency for python3-testsuite,
|
||||
- Correct dependency for python3-testsuite,
|
||||
python3-tkinter -> python3-tk
|
||||
|
||||
-------------------------------------------------------------------
|
||||
@@ -5426,7 +5490,7 @@ Fri Aug 3 12:09:34 UTC 2012 - jmatejek@suse.com
|
||||
-------------------------------------------------------------------
|
||||
Fri Jul 27 09:02:41 UTC 2012 - dvaleev@suse.com
|
||||
|
||||
- skip test_io on ppc
|
||||
- skip test_io on ppc
|
||||
- drop test_io ppc patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
@@ -5475,8 +5539,8 @@ Wed Jan 18 15:49:47 UTC 2012 - jmatejek@suse.com
|
||||
-------------------------------------------------------------------
|
||||
Sun Dec 25 13:25:01 UTC 2011 - idonmez@suse.com
|
||||
|
||||
- Use system ffi, included one is broken see
|
||||
http://bugs.python.org/issue11729 and
|
||||
- Use system ffi, included one is broken see
|
||||
http://bugs.python.org/issue11729 and
|
||||
http://bugs.python.org/issue12081
|
||||
|
||||
-------------------------------------------------------------------
|
||||
|
||||
@@ -107,7 +107,7 @@
|
||||
# _md5.cpython-38m-x86_64-linux-gnu.so
|
||||
%define dynlib() %{sitedir}/lib-dynload/%{1}.cpython-%{abi_tag}-%{archname}-%{_os}%{?_gnu}%{?armsuffix}.so
|
||||
Name: %{python_pkg_name}%{psuffix}
|
||||
Version: 3.11.12
|
||||
Version: 3.11.13
|
||||
Release: 0
|
||||
Summary: Python 3 Interpreter
|
||||
License: Python-2.0
|
||||
@@ -152,8 +152,6 @@ Patch03: distutils-reproducible-compile.patch
|
||||
Patch04: python-3.3.0b1-localpath.patch
|
||||
# replace DATE, TIME and COMPILER by fixed definitions to aid reproducible builds
|
||||
Patch05: python-3.3.0b1-fix_date_time_compiler.patch
|
||||
# POSIX_FADV_WILLNEED throws EINVAL. Use a different constant in test
|
||||
Patch06: python-3.3.0b1-test-posix_fadvise.patch
|
||||
# Raise timeout value for test_subprocess
|
||||
Patch07: subprocess-raise-timeout.patch
|
||||
# PATCH-FEATURE-UPSTREAM bpo-31046_ensurepip_honours_prefix.patch bpo#31046 mcepl@suse.com
|
||||
@@ -188,9 +186,9 @@ Patch19: bso1227999-reproducible-builds.patch
|
||||
Patch22: gh120226-fix-sendfile-test-kernel-610.patch
|
||||
# PATCH-FIX-UPSTREAM Add platform triplets for 64-bit LoongArch gh#python/cpython#30939 glaubitz@suse.com
|
||||
Patch24: add-loongarch64-support.patch
|
||||
# PATCH-FIX-UPSTREAM gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch bsc#1241067 mcepl@suse.com
|
||||
# don't stop ThreadedEchoServer on OSError, makes test_ssl fail with OpenSSL 3.5
|
||||
Patch25: gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2025-6069-quad-complex-HTMLParser.patch bsc#1244705 mcepl@suse.com
|
||||
# avoid quadratic complexity when processing malformed inputs with HTMLParser
|
||||
Patch25: CVE-2025-6069-quad-complex-HTMLParser.patch
|
||||
BuildRequires: autoconf-archive
|
||||
BuildRequires: automake
|
||||
BuildRequires: crypto-policies-scripts
|
||||
@@ -434,28 +432,11 @@ other applications.
|
||||
%prep
|
||||
%setup -q -n %{tarname}
|
||||
|
||||
%patch -p1 -P 02
|
||||
%patch -p1 -P 03
|
||||
%patch -p1 -P 04
|
||||
%patch -p1 -P 05
|
||||
%patch -p1 -P 06
|
||||
%patch -p1 -P 07
|
||||
%patch -p1 -P 08
|
||||
|
||||
%autopatch -p1 -M 08
|
||||
%if 0%{?suse_version} <= 1500
|
||||
%patch -P 09 -p1
|
||||
%endif
|
||||
|
||||
%patch -p1 -P 10
|
||||
%patch -p1 -P 11
|
||||
%patch -p1 -P 13
|
||||
%patch -p1 -P 15
|
||||
%patch -p1 -P 16
|
||||
%patch -p1 -P 17
|
||||
%patch -p1 -P 19
|
||||
%patch -p1 -P 22
|
||||
%patch -p1 -P 24
|
||||
%patch -p1 -P 25
|
||||
%autopatch -p1 -m 10
|
||||
|
||||
# drop Autoconf version requirement
|
||||
sed -i 's/^AC_PREREQ/dnl AC_PREREQ/' configure.ac
|
||||
@@ -500,7 +481,7 @@ TODAY_DATE=`date -r %{SOURCE0} "+%%B %%d, %%Y"`
|
||||
|
||||
cd Doc
|
||||
sed -i "s/^today = .*/today = '$TODAY_DATE'/" conf.py
|
||||
%make_build -j1 html
|
||||
%make_build -j1 JOBS=1 html
|
||||
|
||||
# Build also devhelp files
|
||||
sphinx-build -a -b devhelp . build/devhelp
|
||||
|
||||
Reference in New Issue
Block a user