44f30856f0
Accepting request 1311762 from devel:languages:python:Factory
Ana Guerrero2025-10-17 15:25:45 +00:00
0b3ef5de96
- Update to 3.10.19: - Security - gh-139700: Check consistency of the zip64 end of central directory record. Support records with “zip64 extensible data” if there are no bytes prepended to the ZIP file. - gh-139400: xml.parsers.expat: Make sure that parent Expat parsers are only garbage-collected once they are no longer referenced by subparsers created by ExternalEntityParserCreate(). Patch by Sebastian Pipping. - gh-135661: Fix parsing start and end tags in html.parser.HTMLParser according to the HTML5 standard. * Whitespaces no longer accepted between </ and the tag name. E.g. </ script> does not end the script section. * Vertical tabulation (\v) and non-ASCII whitespaces no longer recognized as whitespaces. The only whitespaces are \t\n\r\f and space. * Null character (U+0000) no longer ends the tag name. * Attributes and slashes after the tag name in end tags are now ignored, instead of terminating after the first > in quoted attribute value. E.g. </script/foo=">"/>. * Multiple slashes and whitespaces between the last attribute and closing > are now ignored in both start and end tags. E.g. <a foo=bar/ //>. * Multiple = between attribute name and value are no longer collapsed. E.g. <a foo==bar> produces attribute “foo” with value “=bar”. - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser according to the HTML5 standard: ] ]> and ]] > no longer end the CDATA section. Add private method _set_support_cdata() which can be used to specify how to parse <[CDATA[ — as a CDATA section in
Matej Cepl2025-10-16 16:28:51 +00:00
9f232b9370
Accepting request 1308252 from devel:languages:python:Factory
Ana Guerrero2025-10-01 16:56:21 +00:00
219e54f074
- Add gh139257-Support-docutils-0.22.patch to fix build with latest docutils (>=0.22) gh#python/cpython#139257
Matej Cepl2025-09-30 16:24:35 +00:00
d3b25f2c17
Accepting request 1307130 from devel:languages:python:Factory
Ana Guerrero2025-09-25 16:46:04 +00:00
a4e8af6753
- Require AppStream to validate appdata file instead of deprecated appstream-glib. - Update idle3.appdata.xml to pass the more pedantic appstreamcli.
Matej Cepl2025-09-18 13:58:10 +00:00
4d0e8ae006
- Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now validates archives to ensure member offsets are non-negative (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).
Matej Cepl2025-08-01 20:20:01 +00:00
a1677ef90d
Accepting request 1290033 from devel:languages:python:Factory
Ana Guerrero2025-07-03 10:10:49 +00:00
21d02acf4f
- Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).
Matej Cepl2025-07-02 16:01:11 +00:00
e00f14a3f1
Accepting request 1288601 from devel:languages:python:Factory
Ana Guerrero2025-06-26 09:39:54 +00:00
868e16eab8
Also addresses CVE-2025-4435 (gh#135034, bsc#1244061).
Matej Cepl2025-06-25 20:02:08 +00:00
0ae2dc2f69
Accepting request 1284259 from devel:languages:python:Factory
Ana Guerrero2025-06-10 10:24:40 +00:00
5c156cd8cb
- Update to 3.10.18: - Security - gh-135034: Fixes multiple issues that allowed tarfile extraction filters (filter="data" and filter="tar") to be bypassed using crafted symlinks and hard links. Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138 (bsc#1244059), CVE-2025-4330 (bsc#1244060), and CVE-2025-4517 (bsc#1244032). - gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler (CVE-2025-4516, bsc#1243273). - gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service. - Library - gh-128840: Fix parsing long IPv6 addresses with embedded IPv4 address. - gh-134062: ipaddress: fix collisions in __hash__() for IPv4Network and IPv6Network objects. - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output according to RFC 3596, §2.5. Patch by Bénédikt Tran. - bpo-43633: Improve the textual representation of IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2) in ipaddress. Patch by Oleksandr Pavliuk. - Remove upstreamed patches: - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch - CVE-2025-4516-DecodeError-handler.patch
Matej Cepl2025-06-09 17:02:25 +00:00
482cd35216
Accepting request 1281886 from devel:languages:python:Factory
Ana Guerrero2025-06-02 20:01:01 +00:00
c1c3249a12
- Add CVE-2025-4516-DecodeError-handler.patch fixing CVE-2025-4516 (bsc#1243273) blocking DecodeError handling vulnerability, which could lead to DoS.
Matej Cepl2025-05-30 15:54:19 +00:00
359236be54
Accepting request 1276661 from devel:languages:python:Factory
Ana Guerrero2025-05-12 14:50:28 +00:00
03d327814d
- Remove python-3.3.0b1-test-posix_fadvise.patch (not needed since kernel 3.6-rc1)
Matej Cepl2025-05-10 11:42:57 +00:00
8576c1ee61
Accepting request 1270151 from devel:languages:python:Factory
Ana Guerrero2025-04-18 14:14:32 +00:00
91bc0ccbd9
- Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch which makes test_ssl not to stop ThreadedEchoServer on OSError, which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067, gh#python/cpython!126572)
Matej Cepl2025-04-17 01:21:02 +00:00
ac296bbdef
Accepting request 1269057 from devel:languages:python:Factory
Ana Guerrero2025-04-16 18:37:17 +00:00
d9086c0242
- Update to 3.10.17: - gh-131809: Update bundled libexpat to 2.7.1 - gh-131261: Upgrade to libexpat 2.7.0 - gh-105704: When using urllib.parse.urlsplit() and urllib.parse.urlparse() host parsing would not reject domain names containing square brackets ([ and ]). Square brackets are only valid for IPv6 and IPvFuture hosts according to RFC 3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704). - gh-121284: Fix bug in the folding of rfc2047 encoded-words when flattening an email message using a modern email policy. Previously when an encoded-word was too long for a line, it would be decoded, split across lines, and re-encoded. But commas and other special characters in the original text could be left unencoded and unquoted. This could theoretically be used to spoof header lines using a carefully constructed encoded-word if the resulting rendered email was transmitted or re-parsed. - gh-80222: Fix bug in the folding of quoted strings when flattening an email message using a modern email policy. Previously when a quoted string was folded so that it spanned more than one line, the surrounding quotes and internal escapes would be omitted. This could theoretically be used to spoof header lines using a carefully constructed quoted string if the resulting rendered email was transmitted or re-parsed. - gh-119511: Fix a potential denial of service in the imaplib module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. On many systems this is harmless as unused virtual memory is only
Matej Cepl2025-04-11 08:15:51 +00:00
18c5374a91
- Add CVE-2025-0938-sq-brackets-domain-names.patch which disallows square brackets ([ and ]) in domain names for parsed URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)
Matej Cepl2025-02-06 21:23:12 +00:00
bca08c148c
Accepting request 1228381 from devel:languages:python:Factory
Ana Guerrero2024-12-06 13:24:57 +00:00
8a5d187b75
- Update to 3.10.16: - Tests - gh-125041: Re-enable skipped tests for zlib on the s390x architecture: only skip checks of the compressed bytes, which can be different between zlib’s software implementation and the hardware-accelerated implementation. - gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode. Use a longer key: FIPS mode requires at least of at least 112 bits. The previous key was only 32 bits. Patch by Victor Stinner. - Security - gh-126623: Upgrade libexpat to 2.6.4 - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified (bsc#1233307, CVE-2024-11168). - Library - gh-124651: Properly quote template strings in venv activation scripts (bsc#1232241, CVE-2024-9287). - gh-103848: Add checks to ensure that [ bracketed ] hosts found by urllib.parse.urlsplit() are of IPv6 or IPvFuture format. - Removed upstreamed patches: - CVE-2024-9287-venv_path_unquoted.patch - CVE-2024-11168-validation-IPv6-addrs.patch
Matej Cepl2024-12-04 21:28:34 +00:00
98a593499c
Accepting request 1227182 from devel:languages:python:Factory
Ana Guerrero2024-11-30 12:27:20 +00:00
9a60aeb3ff
- Apply sphinx-72.patch only conditionally for non-SLE-15 builds.
Matej Cepl2024-11-28 18:17:32 +00:00
cae840a2ef
Accepting request 1224262 from devel:languages:python:Factory
Ana Guerrero2024-11-15 14:37:43 +00:00
622f9d4446
- Remove -IVendor/ from python-config boo#1231795
Matej Cepl2024-11-14 16:25:57 +00:00
7ee50cc171
- Add CVE-2024-11168-validation-IPv6-addrs.patch fixing bsc#1233307 (CVE-2024-11168, gh#python/cpython#103848): Improper validation of IPv6 and IPvFuture addresses.
Matej Cepl2024-11-13 14:50:14 +00:00
87b79dfb11
Accepting request 1221276 from devel:languages:python:Factory
Ana Guerrero2024-11-05 14:39:49 +00:00
fa752e2d67
- Update sphinx-72.patch to include renaming :noindex: option to :no-index: in Sphinx 7.2 (bsc#1232750). - While renaming drop fix-sphinx-72.patch.
Matej Cepl2024-11-04 21:51:43 +00:00
ff4810a8a2
- Drop .pyc files from docdir for reproducible builds
Matej Cepl2024-10-02 16:22:51 +00:00
a4325ecaa9
Accepting request 1199711 from devel:languages:python:Factory
Ana Guerrero2024-09-18 13:26:05 +00:00
805320f21a
- Add sphinx-802.patch to overcome working both with the most recent and older Sphinx versions.
Matej Cepl2024-09-09 15:27:02 +00:00
2999469a13
- Tests - gh-112769: The tests now correctly compare zlib version when :const:zlib.ZLIB_RUNTIME_VERSION contains non-integer suffixes. For example zlib-ng defines the version as `1.3.0.zlib-ng. - gh-117187: Fix XML tests for vanilla Expat <2.6.0. - gh-100454: Fix SSL tests CI for OpenSSL 3.1+ - Security - gh-123678: Upgrade libexpat to 2.6.3 - gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The event in question is cpython.run_stdin. - gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows. Patch by Gregory P. Smith <greg@krypto.org> and Seth Larson <seth@python.org>. Reported by Ellie <el@horse64.org> - gh-121285: Remove backtracking from tarfile header parsing for hdrcharset, PAX, and GNU sparse headers (bsc#1230227, CVE-2024-6232). - gh-118486: :func:os.mkdir on Windows now accepts *mode* of 0o700 to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting :func:tempfile.mkdtemp in scenarios where the base temporary directory is more permissive than the default. - gh-116741: Update bundled libexpat to 2.6.2 - Library - gh-123693: Use platform-agnostic behavior when computing zipfile.Path.name`.
Matej Cepl2024-09-09 14:17:15 +00:00
50fc7d4d42
- Add gh120226-fix-sendfile-test-kernel-610.patch to avoid failing test_sendfile_close_peer_in_the_middle_of_receiving tests on Linux >= 6.10 (GH-120227).
Matej Cepl2024-09-02 12:12:17 +00:00
be25887dfa
- Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, CVE-2024-8088).
Matej Cepl2024-08-29 12:04:00 +00:00
ca334cc307
- Adding bso1227999-reproducible-builds.patch fixing bsc#1227999 adding reproducibility patches from gh#python/cpython!121872 and gh#python/cpython!121883.
Matej Cepl2024-08-07 20:30:36 +00:00
a5c76344b0
- Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Update bluez-devel-vendor.tar.xz
Matej Cepl2024-08-07 15:06:12 +00:00
351afad84b
- Remove %suse_update_desktop_file macro as it is not useful any more.
Matej Cepl2024-07-22 21:25:49 +00:00
57b3bbe7c5
- Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378).
Matej Cepl2024-07-15 12:15:29 +00:00
f7b7d9f2f6
Accepting request 1185398 from devel:languages:python:Factory
Ana Guerrero2024-07-05 17:45:12 +00:00
ef3a96a70c
Accepting request 1184844 from home:dgarcia:usr-local-cpython
Matej Cepl2024-07-04 13:17:05 +00:00
9fdf5d0b2c
Accepting request 1183503 from devel:languages:python:Factory
Ana Guerrero2024-06-29 13:16:42 +00:00
b062a97a85
- Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses.
Matej Cepl2024-06-25 22:17:11 +00:00
346624a8d5
Accepting request 1182484 from devel:languages:python:Factory
Ana Guerrero2024-06-24 18:50:16 +00:00
50f46d2e31
across multiple threads (bsc#1226447, CVE-2024-0397)
Matej Cepl2024-06-21 13:27:20 +00:00
1f90dc5291
- Remove old-libexpat.patch, of course.
Matej Cepl2024-06-21 09:50:19 +00:00
31dd9389f8
- Add CVE-2023-52425-libexpat-2.6.0-backport.patch to fix tests with patched libexpat below 2.6.0 that doesn't update the version number, just in SLE.
Matej Cepl2024-06-21 09:49:34 +00:00
factory
Matěj Cepl
Marcus Rueckert
Ruediger Oertel
Daniel Mach
Marco Strigl
Wolfgang Engel
Ana Guerrero
Dominique Leuenberger