9594a07523- Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378).Matej Cepl2024-07-15 12:20:19 +00:00
ff752654c7Accepting request 1175721 from devel:languages:python:Factory
Ana Guerrero
2024-05-22 19:29:36 +00:00
6565758ff5Accepting request 1175099 from devel:languages:python:Factory
Ana Guerrero
2024-05-21 16:34:28 +00:00
01ce66c584- Add CVE-2023-52425-libexpat-2.6.0-remove-failing-tests.patch removing failing test fixing bpo#3151, which we just not support. - Remove patches over those embedded packages (cffi): - python-2.7-libffi-aarch64.patch - sparc_longdouble.patchMatej Cepl2024-05-19 06:56:12 +00:00
3b6fb6241d- bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016).Matej Cepl2024-05-18 16:51:08 +00:00
36ed6c337dAccepting request 1173435 from devel:languages:python:Factory
Ana Guerrero
2024-05-13 15:56:59 +00:00
773b5da2c2- Switch to using the system libexpat (bsc#1219559, CVE-2023-52425) - Make sure to remove all embedded versions of other packages (including expat).Matej Cepl2024-05-11 05:48:37 +00:00
9d69392fdfAccepting request 1169941 from devel:languages:python:Factory
Ana Guerrero
2024-04-25 18:47:30 +00:00
93c812d448- Revert CVE-2022-48560-after-free-heappushpop.patch, the fix was unneeded. - Add CVE-2022-48560-after-free-heappushpop.patch fixing use-after-free in Python via heappushpop in heapq (bsc#1214675, CVE-2022-48560).Matej Cepl2024-04-23 15:53:53 +00:00
7ccba948f3- Modify CVE-2023-27043-email-parsing-errors.patch to fix the unicode string handling in email.utils.parseaddr() (bsc#1222537).Matej Cepl2024-04-16 20:26:40 +00:00
86d87a8612- Switch on tests again. - Add bsc1222537-py2-email-addr-parse.patch to fix the unicode string handling in email.utils.parseaddr() (bsc#1222537).Matej Cepl2024-04-16 15:40:54 +00:00
30e970e5f7- Add CVE-2022-48560-after-free-heappushpop.patch fixing use-after-free in Python via heappushpop in heapq (bsc#1214675, CVE-2022-48560). - switch from %patchN style to the %patch -P N one.Matej Cepl2023-11-27 16:32:40 +00:00
10bb24e527- (bsc#1214691, CVE-2022-48566) Add CVE-2022-48566-compare_digest-more-constant.patch to make compare_digest more constant-time.Matej Cepl2023-09-16 16:30:00 +00:00
fe93386c91- (bsc#1214685, CVE-2022-48565) Add CVE-2022-48565-plistlib-XML-vulns.patch (from gh#python/cpython#86217) reject XML entity declarations in plist files.Matej Cepl2023-09-14 21:54:10 +00:00
e5cdb13a6bAccepting request 1110909 from devel:languages:python:Factory
Ana Guerrero
2023-09-14 14:25:01 +00:00
0012499f47Accepting request 1110536 from home:dgarcia:branches:devel:languages:python:FactoryMatej Cepl2023-09-13 12:22:49 +00:00
4a7548ec68- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED! - Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941) partially reverting CVE-2023-27043-email-parsing-errors.patch, because of the regression in gh#python/cpython#106669.Matej Cepl2023-08-11 18:04:06 +00:00
1108b564fe- The condition around libnsl-devel BuildRequires is NOT switching off NIS support on SLE < 15, support for NIS used to be in the glibc itself. Partial revert of sr#1061583.Matej Cepl2023-05-29 18:52:32 +00:00
c0fecb5ffe- Add PygmentsBridge-trime_doctest_flags.patch to allow build of the documentation even with the current Sphinx. (SUSE-ONLY PATCH, DO NOT SEND UPSTREAM!)Matej Cepl2023-05-24 20:56:16 +00:00
b60b8e8937Create isascii() shim for missing str.isascii().Matej Cepl2023-03-02 15:36:10 +00:00
9f86e564da- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank charactersMatej Cepl2023-03-01 22:01:21 +00:00
c21db0430f- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank charactersMatej Cepl2023-03-01 22:00:56 +00:00
2a9d6402e8- Add skip_unverified_test.patch because apparently switching off SSL verification doesn't work on older SLE.Matej Cepl2023-01-19 08:45:16 +00:00
3f9f4e7cb7- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names.Matej Cepl2022-11-09 19:07:01 +00:00