c457f4f6ba- bsc#1122191: add CVE-2019-5010-null-defer-x509-cert-DOS.patch fixing bpo-35746. An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.7.2. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.Matej Cepl2019-01-20 01:08:59 +00:00
9eba14b8c5- Apply "CVE-2018-1000802-shutil_use_subprocess_no_spawn.patch" which converts shutil._call_external_zip to use subprocess rather than distutils.spawn. [bsc#1109663, CVE-2018-1000802]Matej Cepl2018-09-27 14:11:14 +00:00
a253d3727a* dozens of bugfixes, see NEWS for details - add patch from upstream: * do-not-use-non-ascii-in-test_ssl.patch * dozens of bugfixes, see NEWS for details - add patch from upstream: * do-not-use-non-ascii-in-test_ssl.patch * dozens of bugfixes, see NEWS for details - add patch from upstream: * do-not-use-non-ascii-in-test_ssl.patch
Tomáš Chvátal
2018-05-22 08:07:44 +00:00
1e548f3452Accepting request 611078 from home:stroeder:branches:devel:languages:python:Factory
Tomáš Chvátal
2018-05-22 08:06:13 +00:00
70d78d4e2f- update to 2.7.14 * dozens of bugfixes, see NEWS for details * fixed possible integer overflow in PyString_DecodeEscape (CVE-2017-1000158, bsc#1068664) * fixed segfaults with dict mutated during search * fixed possible free-after-use problems with buffer objects with custom indexing * fixed urllib.splithost to correctly parse fragments (bpo-30500) - drop upstreamed python-2.7.13-overflow_check.patch - drop unneeded python-2.7.12-makeopcode.patch - drop upstreamed 0001-2.7-bpo-30714-ALPN-changes-for-OpenSSL-1.1.0f-3094.patch
Jan Matejek
2017-11-21 18:28:14 +00:00
0b843a9f57- obsolete/provide python-argparse and provide python2-argparse, because the argparse module is available from python 2.7 up
Jan Matejek
2017-08-28 13:29:37 +00:00
acb48c1f8aAccepting request 517529 from home:kukuk:branches:devel:languages:python:Factory
Jan Matejek
2017-08-21 12:25:25 +00:00
e76bc8d64f- update python-2.7.10-overflow_check.patch with python-2.7.13-overflow_check.patch, incorporating upstream changes
Jan Matejek
2017-01-05 11:54:43 +00:00
3a2ae521f8* dozens of bugfixes, see NEWS for details * updated cipher lists for openssl wrapper, support openssl >= 1.1.0 * properly fix HTTPoxy (CVE-2016-1000110) * profile-opt build now applies PGO to modules as well - drop python-2.7.10-overflow_check.patch which is solved in upstream
Jan Matejek
2017-01-03 17:42:38 +00:00
1ca0d56f57- update to 2.7.13 * dozens of bugfixes, see NEWS for details * updated cipher lists for openssl wrapper, support openssl >= 1.1.0 * properly fix HTTPoxy (CVE-2016-1000110) * profile-opt build now applies PGO to modules as well - drop python-2.7.10-overflow_check.patch which is solved in upstream
Jan Matejek
2017-01-03 17:42:02 +00:00
f21ffdf240- provide python2-* symbols, for support of new packages built as python2-foo - rename macros.python to macros.python2 accordingly - require python-rpm-macros package, drop macro definitions from macros.python2
Jan Matejek
2016-12-02 15:37:55 +00:00
23d372d986CVE-2016-5699 httplib header injection (bsc#985348) (this one is actually fixed since 2.7.10) CVE-2016-5699 httplib header injection (bsc#985348) (this one is actually fixed since 2.7.10)
Jan Matejek
2016-07-01 13:16:46 +00:00
3d29b362e3CVE-2016-5699 httplib header injection (bsc#985348) (this one is actually fixed since 2.7.10)
Jan Matejek
2016-07-01 13:15:24 +00:00
95238b7fc9- update LD_LIBRARY_PATH to use $PWD instead of "." because the test process escapes to its own directory - modify shebang-fixing scriptlet to ignore makeopcodetargets.py
Jan Matejek
2016-06-30 13:10:14 +00:00
05220bdba0- python-2.7.12-makeopcode.patch - run newly-built python interpreter to make opcodes, in order not to require pre-built python
Jan Matejek
2016-06-30 12:56:08 +00:00
91b628d395- update to 2.7.12 * dozens of bugfixes, see NEWS for details * fixes multiple security issues: CVE-2016-0772 TLS stripping attack on smtplib (bsc#984751) CVE-2016-5636 zipimporter heap overflow (bsc#985177) - removed upstreamed python-2.7.7-mhlib-linkcount.patch - refreshed multilib patch
Jan Matejek
2016-06-30 10:50:57 +00:00
1e93af4043Accepting request 361067 from openSUSE:Factory:Staging:Gcc6
Jan Matejek
2016-02-23 15:31:19 +00:00
bc41d3aa08Accepting request 331039 from devel:languages:python:Factory
Stephan Kulow
2015-09-19 04:52:47 +00:00
c890c9fda8- copy strict-tls-checks subpackage from SLE to retain future compatibility (not built in openSUSE) - do this properly to fix bnc#945401
Jan Matejek
2015-09-14 15:36:31 +00:00
9877de58c4Accepting request 266105 from home:Andreas_Schwab:Factory
Jan Matejek
2014-12-22 16:49:53 +00:00
032a0b15daAccepting request 265739 from devel:languages:python:Factory
Stephan Kulow
2014-12-21 11:04:15 +00:00
680cb721f9* SSLv3 disabled by default (bnc#901715)
Jan Matejek
2014-12-18 13:05:24 +00:00
bedd13ad31- set fixed doc build date, lower sphinx requirement (for older openSUSE)
Jan Matejek
2014-12-17 13:10:23 +00:00
cc099c9e1e- update to 2.7.9 * contains full backport of ssl module from Python 3.4 (PEP466) * HTTPS certificate validation enabled by default (PEP476) * SSLv3 disabled by default * backported ensurepip module (PEP477) * fixes several missing CVEs from last release: CVE-2013-1752, CVE-2013-1753 * dozens of minor bugfixes - dropped upstreamed patches: python-2.7.6-poplib.patch, smtplib_maxline-2.7.patch, xmlrpc_gzip_27.patch - dropped patch python-2.7.3-ssl_ca_path.patch because we don't need it with ssl module from Python 3 - libffi was upgraded upstream, seems to contain our changes, so dropping libffi-ppc64le.diff as well - python-2.7-urllib2-localnet-ssl.patch - properly remove unconditional "import ssl" from test_urllib2_localnet that caused it to fail without ssl - drop HTML doc tarball, build HTML documentation from source
Jan Matejek
2014-12-15 15:06:19 +00:00
5977a0f656Accepting request 258807 from devel:languages:python:Factory
Stephan Kulow
2014-11-02 15:28:06 +00:00
0a6b898b31Accepting request 257990 from home:dirkmueller:branches:devel:languages:python:Factory
Jan Matejek
2014-10-22 13:32:56 +00:00
ded2328eddAccepting request 257573 from home:elvigia:branches:devel:languages:python:Factory
Jan Matejek
2014-10-20 11:39:34 +00:00
ea8460734aAccepting request 253635 from devel:languages:python:Factory
Stephan Kulow
2014-10-05 18:30:36 +00:00
ad45ed7669- update to 2.7.8 * bugfix-only release, dozens of bugs fixed * fixes CVE-2014-4650 directory traversal in CGIHTTPServer * fixes CVE-2014-7185 (bnc#898572) potential buffer overflow in buffer() - dropped upstreamed CVE-2014-4650-CGIHTTPserver-traversal.patch
Jan Matejek
2014-09-30 15:34:42 +00:00
4eadd6b7fdAccepting request 242381 from devel:languages:python:Factory
Stephan Kulow
2014-07-28 04:31:15 +00:00
13e614b70b- CVE-2014-4650-CGIHTTPServer-traversal.patch: CGIHTTPServer file disclosure and directory traversal through URL-encoded characters (CVE-2014-4650, bnc#885882) - python-2.7.7-mhlib-linkcount.patch: remove link count optimizations that are incorrect on btrfs (and possibly other filesystems)
Jan Matejek
2014-07-24 14:33:34 +00:00
f32b030398Accepting request 238381 from devel:languages:python:Factory
Stephan Kulow
2014-06-25 13:24:03 +00:00
71551512cd- update to 2.7.7 * bugfix-only release, over a hundred bugs fixed * backported hmac.compare_digest from python3, first step of PEP 466 - drop upstreamed patches: * CVE-2014-1912-recvfrom_into.patch * python-2.7.4-no-REUSEPORT.patch * python-2.7.6-bdist-rpm.patch * python-2.7.6-imaplib.patch * python-2.7.6-sqlite-3.8.4-tests.patch - refresh patches: * python-2.7.3-ssl_ca_path.patch * python-2.7.4-canonicalize2.patch * xmlrpc_gzip_27.patch - added python keyring and signature for the main tarball
Jan Matejek
2014-06-20 13:47:06 +00:00
0dbc5d47baAccepting request 226492 from devel:languages:python:Factory
Stephan Kulow
2014-03-21 14:47:36 +00:00
b15d1e2b45Accepting request 226488 from home:Andreas_Schwab:Factory
Jan Matejek
2014-03-17 17:14:24 +00:00
5a079e8806Accepting request 226022 from home:AndreasStieger:branches:devel:languages:python:Factory
Jan Matejek
2014-03-17 16:14:14 +00:00
c0d3b23d88Accepting request 222235 from devel:languages:python:Factory
Stephan Kulow
2014-02-19 08:10:33 +00:00
4f815b3251- added patches for CVE-2013-1752 (bnc#856836) issues that are missing in 2.7.6: python-2.7.6-imaplib.patch python-2.7.6-poplib.patch smtplib_maxline-2.7.patch - CVE-2013-1753 (bnc#856835) gzip decompression bomb in xmlrpc client: xmlrpc_gzip_27.patch
Jan Matejek
2014-02-10 14:35:47 +00:00
122b37f5cbAccepting request 213846 from devel:languages:python:Factory
Stephan Kulow
2014-01-16 14:38:05 +00:00
73549b66f0Accepting request 213741 from openSUSE:Factory:PowerLE
Sascha Peilicke
2014-01-14 10:02:19 +00:00
e9b7c2930cAccepting request 212641 from devel:languages:python:Factory
Tomáš Chvátal
2014-01-03 13:49:34 +00:00
87ae076e4eAccepting request 209702 from openSUSE:Factory:PowerLE
Jan Matejek
2014-01-02 13:28:57 +00:00
ac82070996Accepting request 209596 from devel:languages:python:Factory
Stephan Kulow
2013-12-07 07:50:06 +00:00
ea9eb9ef07Accepting request 209414 from openSUSE:Factory:PowerLE
Sascha Peilicke
2013-12-06 10:30:57 +00:00
8336c28f3aAccepting request 208559 from devel:languages:python:Factory
Stephan Kulow
2013-11-26 18:33:31 +00:00
5b3091d163complete the previous commit
Jan Matejek
2013-11-26 16:14:13 +00:00
Dominique Leuenberger
Matej Cepl
Tomáš Chvátal
Jan Matejek
Stephan Kulow
Sascha Peilicke
Tomáš Chvátal