9594a07523
- Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378).
Matej Cepl2024-07-15 12:20:19 +00:00
ff752654c7
Accepting request 1175721 from devel:languages:python:Factory
Ana Guerrero2024-05-22 19:29:36 +00:00
6565758ff5
Accepting request 1175099 from devel:languages:python:Factory
Ana Guerrero2024-05-21 16:34:28 +00:00
01ce66c584
- Add CVE-2023-52425-libexpat-2.6.0-remove-failing-tests.patch removing failing test fixing bpo#3151, which we just not support. - Remove patches over those embedded packages (cffi): - python-2.7-libffi-aarch64.patch - sparc_longdouble.patch
Matej Cepl2024-05-19 06:56:12 +00:00
3b6fb6241d
- bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016).
Matej Cepl2024-05-18 16:51:08 +00:00
36ed6c337d
Accepting request 1173435 from devel:languages:python:Factory
Ana Guerrero2024-05-13 15:56:59 +00:00
773b5da2c2
- Switch to using the system libexpat (bsc#1219559, CVE-2023-52425) - Make sure to remove all embedded versions of other packages (including expat).
Matej Cepl2024-05-11 05:48:37 +00:00
9d69392fdf
Accepting request 1169941 from devel:languages:python:Factory
Ana Guerrero2024-04-25 18:47:30 +00:00
93c812d448
- Revert CVE-2022-48560-after-free-heappushpop.patch, the fix was unneeded. - Add CVE-2022-48560-after-free-heappushpop.patch fixing use-after-free in Python via heappushpop in heapq (bsc#1214675, CVE-2022-48560).
Matej Cepl2024-04-23 15:53:53 +00:00
7ccba948f3
- Modify CVE-2023-27043-email-parsing-errors.patch to fix the unicode string handling in email.utils.parseaddr() (bsc#1222537).
Matej Cepl2024-04-16 20:26:40 +00:00
86d87a8612
- Switch on tests again. - Add bsc1222537-py2-email-addr-parse.patch to fix the unicode string handling in email.utils.parseaddr() (bsc#1222537).
Matej Cepl2024-04-16 15:40:54 +00:00
30e970e5f7
- Add CVE-2022-48560-after-free-heappushpop.patch fixing use-after-free in Python via heappushpop in heapq (bsc#1214675, CVE-2022-48560). - switch from %patchN style to the %patch -P N one.
Matej Cepl2023-11-27 16:32:40 +00:00
10bb24e527
- (bsc#1214691, CVE-2022-48566) Add CVE-2022-48566-compare_digest-more-constant.patch to make compare_digest more constant-time.
Matej Cepl2023-09-16 16:30:00 +00:00
fe93386c91
- (bsc#1214685, CVE-2022-48565) Add CVE-2022-48565-plistlib-XML-vulns.patch (from gh#python/cpython#86217) reject XML entity declarations in plist files.
Matej Cepl2023-09-14 21:54:10 +00:00
e5cdb13a6b
Accepting request 1110909 from devel:languages:python:Factory
Ana Guerrero2023-09-14 14:25:01 +00:00
0012499f47
Accepting request 1110536 from home:dgarcia:branches:devel:languages:python:Factory
Matej Cepl2023-09-13 12:22:49 +00:00
4a7548ec68
- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED! - Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941) partially reverting CVE-2023-27043-email-parsing-errors.patch, because of the regression in gh#python/cpython#106669.
Matej Cepl2023-08-11 18:04:06 +00:00
1108b564fe
- The condition around libnsl-devel BuildRequires is NOT switching off NIS support on SLE < 15, support for NIS used to be in the glibc itself. Partial revert of sr#1061583.
Matej Cepl2023-05-29 18:52:32 +00:00
c0fecb5ffe
- Add PygmentsBridge-trime_doctest_flags.patch to allow build of the documentation even with the current Sphinx. (SUSE-ONLY PATCH, DO NOT SEND UPSTREAM!)
Matej Cepl2023-05-24 20:56:16 +00:00
b60b8e8937
Create isascii() shim for missing str.isascii().
Matej Cepl2023-03-02 15:36:10 +00:00
9f86e564da
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters
Matej Cepl2023-03-01 22:01:21 +00:00
c21db0430f
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters
Matej Cepl2023-03-01 22:00:56 +00:00
2a9d6402e8
- Add skip_unverified_test.patch because apparently switching off SSL verification doesn't work on older SLE.
Matej Cepl2023-01-19 08:45:16 +00:00
3f9f4e7cb7
- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names.
Matej Cepl2022-11-09 19:07:01 +00:00