8a5d187b75- Update to 3.10.16: - Tests - gh-125041: Re-enable skipped tests for zlib on the s390x architecture: only skip checks of the compressed bytes, which can be different between zlib’s software implementation and the hardware-accelerated implementation. - gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode. Use a longer key: FIPS mode requires at least of at least 112 bits. The previous key was only 32 bits. Patch by Victor Stinner. - Security - gh-126623: Upgrade libexpat to 2.6.4 - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified (bsc#1233307, CVE-2024-11168). - Library - gh-124651: Properly quote template strings in venv activation scripts (bsc#1232241, CVE-2024-9287). - gh-103848: Add checks to ensure that [ bracketed ] hosts found by urllib.parse.urlsplit() are of IPv6 or IPvFuture format. - Removed upstreamed patches: - CVE-2024-9287-venv_path_unquoted.patch - CVE-2024-11168-validation-IPv6-addrs.patchMatej Cepl2024-12-04 21:28:34 +0000
98a593499cAccepting request 1227182 from devel:languages:python:Factory
Ana Guerrero
2024-11-30 12:27:20 +0000
9a60aeb3ff- Apply sphinx-72.patch only conditionally for non-SLE-15 builds.Matej Cepl2024-11-28 18:17:32 +0000
cae840a2efAccepting request 1224262 from devel:languages:python:Factory
Ana Guerrero
2024-11-15 14:37:43 +0000
622f9d4446- Remove -IVendor/ from python-config boo#1231795Matej Cepl2024-11-14 16:25:57 +0000
7ee50cc171- Add CVE-2024-11168-validation-IPv6-addrs.patch fixing bsc#1233307 (CVE-2024-11168, gh#python/cpython#103848): Improper validation of IPv6 and IPvFuture addresses.Matej Cepl2024-11-13 14:50:14 +0000
87b79dfb11Accepting request 1221276 from devel:languages:python:Factory
Ana Guerrero
2024-11-05 14:39:49 +0000
fa752e2d67- Update sphinx-72.patch to include renaming :noindex: option to :no-index: in Sphinx 7.2 (bsc#1232750). - While renaming drop fix-sphinx-72.patch.Matej Cepl2024-11-04 21:51:43 +0000
c683cd8edcAccepting request 1220124 from devel:languages:python:Factory
Dominique Leuenberger
2024-11-03 06:16:58 +0000
2bd9540ae5- Update CVE-2024-9287-venv_path_unquoted.patch according to the upstream PR gh#python/cpython!126301.Matej Cepl2024-11-01 21:39:14 +0000
ff4810a8a2- Drop .pyc files from docdir for reproducible buildsMatej Cepl2024-10-02 16:22:51 +0000
a4325ecaa9Accepting request 1199711 from devel:languages:python:Factory
Ana Guerrero
2024-09-18 13:26:05 +0000
805320f21a- Add sphinx-802.patch to overcome working both with the most recent and older Sphinx versions.Matej Cepl2024-09-09 15:27:02 +0000
2999469a13- Tests - gh-112769: The tests now correctly compare zlib version when :const:zlib.ZLIB_RUNTIME_VERSION contains non-integer suffixes. For example zlib-ng defines the version as `1.3.0.zlib-ng. - gh-117187: Fix XML tests for vanilla Expat <2.6.0. - gh-100454: Fix SSL tests CI for OpenSSL 3.1+ - Security - gh-123678: Upgrade libexpat to 2.6.3 - gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The event in question is cpython.run_stdin. - gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows. Patch by Gregory P. Smith <greg@krypto.org> and Seth Larson <seth@python.org>. Reported by Ellie <el@horse64.org> - gh-121285: Remove backtracking from tarfile header parsing for hdrcharset, PAX, and GNU sparse headers (bsc#1230227, CVE-2024-6232). - gh-118486: :func:os.mkdir on Windows now accepts *mode* of 0o700 to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting :func:tempfile.mkdtemp in scenarios where the base temporary directory is more permissive than the default. - gh-116741: Update bundled libexpat to 2.6.2 - Library - gh-123693: Use platform-agnostic behavior when computing zipfile.Path.name`.Matej Cepl2024-09-09 14:17:15 +0000
be25887dfa- Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, CVE-2024-8088).Matej Cepl2024-08-29 12:04:00 +0000
b0e622c8e8Accepting request 1192675 from devel:languages:python:Factory
Dominique Leuenberger
2024-08-10 17:06:06 +0000
ca334cc307- Adding bso1227999-reproducible-builds.patch fixing bsc#1227999 adding reproducibility patches from gh#python/cpython!121872 and gh#python/cpython!121883.Matej Cepl2024-08-07 20:30:36 +0000
a5c76344b0- Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Update bluez-devel-vendor.tar.xzMatej Cepl2024-08-07 15:06:12 +0000
6af8f5b52dAccepting request 1189131 from devel:languages:python:Factory
Dominique Leuenberger
2024-07-24 13:33:10 +0000
351afad84b- Remove %suse_update_desktop_file macro as it is not useful any more.Matej Cepl2024-07-22 21:25:49 +0000
57b3bbe7c5- Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378).Matej Cepl2024-07-15 12:15:29 +0000
f7b7d9f2f6Accepting request 1185398 from devel:languages:python:Factory
Ana Guerrero
2024-07-05 17:45:12 +0000
ef3a96a70cAccepting request 1184844 from home:dgarcia:usr-local-cpythonMatej Cepl2024-07-04 13:17:05 +0000
9fdf5d0b2cAccepting request 1183503 from devel:languages:python:Factory
Ana Guerrero
2024-06-29 13:16:42 +0000
b062a97a85- Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses.Matej Cepl2024-06-25 22:17:11 +0000
346624a8d5Accepting request 1182484 from devel:languages:python:Factory
Ana Guerrero
2024-06-24 18:50:16 +0000
1f90dc5291- Remove old-libexpat.patch, of course.Matej Cepl2024-06-21 09:50:19 +0000
31dd9389f8- Add CVE-2023-52425-libexpat-2.6.0-backport.patch to fix tests with patched libexpat below 2.6.0 that doesn't update the version number, just in SLE.Matej Cepl2024-06-21 09:49:34 +0000
041ff70f73- Update 3.10.14: - gh-115399 & gh-115398: bundled libexpat was updated to 2.6.0 to address CVE-2023-52425, and control of the new reparse deferral functionality was exposed with new APIs - gh-109858: zipfile is now protected from the “quoted-overlap” zipbomb to address CVE-2024-0450. It now raises BadZipFile when attempting to read an entry that overlaps with another entry or central directory - gh-91133: tempfile.TemporaryDirectory cleanup no longer dereferences symlinks when working around file system permission errors to address CVE-2023-6597 - gh-115197: urllib.request no longer resolves the hostname before checking it against the system’s proxy bypass list on macOS and Windows - gh-81194: a crash in socket.if_indextoname() with a specific value (UINT_MAX) was fixed. Relatedly, an integer overflow in socket.if_indextoname() on 64-bit non-Windows platforms was fixed - gh-113659: .pth files with names starting with a dot or containing the hidden file attribute are now skipped - gh-102388: iso2022_jp_3 and iso2022_jp_2004 codecs no longer read out of bounds - gh-114572: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads - Remove upstreamed patches: - CVE-2023-6597-TempDir-cleaning-symlink.patch - Port to %autosetup and %autopatch.Matej Cepl2024-03-21 16:45:30 +0000
a358b6b1ecAccepting request 1157645 from devel:languages:python:Factory
Ana Guerrero
2024-03-14 16:42:36 +0000
9d2100328bAccepting request 1155683 from home:pmonrealgonzalez:branches:devel:languages:python:FactoryMatej Cepl2024-03-06 21:50:46 +0000
fb64581e60Accepting request 1153061 from devel:languages:python:Factory
Dominique Leuenberger
2024-03-01 22:34:08 +0000
ec6474e9bc- (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory.Matej Cepl2024-02-28 23:32:27 +0000
f660687d3fAccepting request 1152786 from devel:languages:python:Factory
Ana Guerrero
2024-02-28 18:44:32 +0000
3711a039e6- Remove double definition of /usr/bin/idle%%{version} in %%files.Matej Cepl2024-02-20 22:16:34 +0000
f2acc64a8cAccepting request 1146869 from devel:languages:python:Factory
Ana Guerrero
2024-02-15 19:59:20 +0000
951fa01e4bAccepting request 1146817 from home:dgarcia:branches:devel:languages:python:FactoryMatej Cepl2024-02-15 14:36:25 +0000
9168347d4a- Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Thus we can remove Revert-gh105127-left-tests.patch, which is now useless.Matej Cepl2024-02-12 13:18:00 +0000
83a7da7040Accepting request 1110597 from devel:languages:python:Factory
Ana Guerrero
2023-09-12 19:02:42 +0000
dc236e4d07- Link to CVE-2023-40217 bug report in changelog, bsc#1214692Daniel Garcia2023-09-05 11:37:11 +0000
044091027dAccepting request 1108911 from devel:languages:python:Factory
Ana Guerrero
2023-09-04 20:52:31 +0000
310cd89462Accepting request 1108888 from home:dgarcia:branches:devel:languages:python:FactoryDirk Mueller2023-09-04 15:07:39 +0000
9708415de3Accepting request 1102193 from devel:languages:python:Factory
Dominique Leuenberger
2023-08-06 14:29:12 +0000
4a7871d409- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941) partially reverting CVE-2023-27043-email-parsing-errors.patch, because of the regression in gh#python/cpython#106669.Matej Cepl2023-08-03 14:14:37 +0000
0d124ed5f4Accepting request 1099501 from devel:languages:python:Factory
Ana Guerrero
2023-07-24 16:12:32 +0000
32717ebf00- Add gh-78214-marshal_stabilize_FLAG_REF.patch to marshal.c for stabilizing FLAG_REF usage (required for reproduceability; bsc#1213463).Matej Cepl2023-07-19 11:19:26 +0000
3c34744813Accepting request 1098690 from devel:languages:python:FactoryMatej Cepl2023-07-14 14:06:10 +0000
18f6b99d17- (bsc#1210638, CVE-2023-27043) Add CVE-2023-27043-email-parsing-errors.patch, which detects email address parsing errors and returns empty tuple to indicate the parsing error (old API).Matej Cepl2023-07-12 10:49:44 +0000
7870b5cb09Accepting request 1095863 from devel:languages:python:Factory
Dominique Leuenberger
2023-06-30 17:58:24 +0000
402f3ae924- Update to 3.10.12: - gh-103142: The version of OpenSSL used in Windows and Mac installers has been upgraded to 1.1.1u to address CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464, as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 fixed previously in 1.1.1t (gh-101727). - gh-102153: urllib.parse.urlsplit() now strips leading C0 control and space characters following the specification for URLs defined by WHATWG in response to CVE-2023-24329. - gh-99889: Fixed a security in flaw in uu.decode() that could allow for directory traversal based on the input if no out_file was specified. - gh-104049: Do not expose the local on-disk location in directory indexes produced by http.client.SimpleHTTPRequestHandler. - gh-103935: trace.__main__ now uses io.open_code() for files to be executed instead of raw open(). - gh-102953: The extraction methods in tarfile, and shutil.unpack_archive(), have a new filter argument that allows limiting tar features than may be surprising or dangerous, such as creating files outside the destination directory. See Extraction filters for details. - Remove upstreamed patches: - CVE-2007-4559-filter-tarfile_extractall.patchMatej Cepl2023-06-28 17:56:56 +0000
d26ce719adAccepting request 1094243 from devel:languages:python:Factory
Dominique Leuenberger
2023-06-22 21:24:50 +0000
f21150c420- Add bpo-37596-make-set-marshalling.patch making marshalling of set and frozenset deterministic (bsc#1211765).Matej Cepl2023-06-20 21:41:03 +0000
e8a35797e6- Update to 3.10.11: - Core and Builtins - gh-102416: Do not memoize incorrectly automatically generated loop rules in the parser. Patch by Pablo Galindo. - gh-102356: Fix a bug that caused a crash when deallocating deeply nested filter objects. Patch by Marta Gómez Macías. - gh-102397: Fix segfault from race condition in signal handling during garbage collection. Patch by Kumar Aditya. - gh-102126: Fix deadlock at shutdown when clearing thread states if any finalizer tries to acquire the runtime head lock. Patch by Kumar Aditya. - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal module. Patch by Max Bachmann. - gh-101967: Fix possible segfault in positional_only_passed_as_keyword function, when new list created. - gh-101765: Fix SystemError / segmentation fault in iter __reduce__ when internal access of builtins.__dict__ keys mutates the iter object. - Library - gh-102947: Improve traceback when dataclasses.fields() is called on a non-dataclass. Patch by Alex Waygood - gh-101979: Fix a bug where parentheses in the metavar argument to argparse.ArgumentParser.add_argument() were dropped. Patch by Yeojin Kim. - gh-102179: Fix os.dup2() error message for negative fds. - gh-101961: For the binary mode, fileinput.hookcompressed() doesn’t set the encoding value even if the value is None. Patch by Gihwan Kim. - gh-101936: The default value of fp becomes io.BytesIOMatej Cepl2023-04-27 21:53:08 +0000
0a6bd2edcb- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706).Matej Cepl2023-04-27 21:21:50 +0000
e4ffe4ce0f- Add invalid-json.patch fixing invalid JSON in Doc/howto/logging-cookbook.rst (somehow similar to gh#python/cpython#102582).Matej Cepl2023-03-10 14:39:59 +0000
a67ddc0ae1Accepting request 1068979 from devel:languages:python:Factory
Dominique Leuenberger
2023-03-05 19:07:48 +0000
0c5704949dTake care of _testclinic binary module.Matej Cepl2023-03-02 15:23:34 +0000
602adbc016- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank charactersMatej Cepl2023-03-01 21:21:46 +0000
a60c90b1d7- Update to 3.10.10: Bug fixes and regressions handling, no change of behaviour and no security bugs fixed.Matej Cepl2023-03-01 21:10:15 +0000
55a026e97bAccepting request 1066987 from devel:languages:python:Factory
Dominique Leuenberger
2023-02-22 14:21:08 +0000
b88ed8b5bd- Add provides for readline and sqlite3 to the main Python package.Matej Cepl2023-02-21 11:35:05 +0000
eb1e8bd53aAccepting request 1061591 from devel:languages:python:Factory
Dominique Leuenberger
2023-01-29 13:10:05 +0000
a2b5c7c23bAccepting request 1061584 from home:kukuk:branches:devel:languages:python:FactoryMatej Cepl2023-01-27 16:14:56 +0000
438d63cfdeAccepting request 1041730 from devel:languages:python:Factory
Dominique Leuenberger
2022-12-12 17:59:10 +0000
7757e5a6dc- Update to 3.10.9: - python -m http.server no longer allows terminal control characters sent within a garbage request to be printed to the stderr server lo This is done by changing the http.server BaseHTTPRequestHandler .log_message method to replace control characters with a \xHH hex escape before printin - Avoid publishing list of active per-interpreter audit hooks via the gc module - The IDNA codec decoder used on DNS hostnames by socket or asyncio related name resolution functions no longer involves a quadratic algorithm. This prevents a potential CPU denial of service if an out-of-spec excessive length hostname involving bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects potentially allow for an attacker to supply such a name. - Update bundled libexpat to 2.5.0 - Port XKCP’s fix for the buffer overflows in SHA-3 (CVE-2022-37454). - On Linux the multiprocessing module returns to using filesystem backed unix domain sockets for communication with the forkserver process instead of the Linux abstract socket namespace. Only code that chooses to use the “forkserver” start method is affected Abstract sockets have no permissions and could allow any user on the system in the same network namespace (often the whole system) to inject code into the multiprocessing forkserver process. This was a potential privilege escalation. Filesystem based socket permissions restrict this to the forkserver process user as was the default inMatej Cepl2022-12-08 14:49:07 +0000
d498aa5eb1Accepting request 1034962 from devel:languages:python:Factory
Dominique Leuenberger
2022-11-12 16:39:52 +0000
Ana Guerrero
Matej Cepl
Dominique Leuenberger
Daniel Garcia
Dirk Mueller