0c195902dd- Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now validates archives to ensure member offsets are non-negative (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).Matej Cepl2025-08-01 20:18:10 +00:00
e06b229157Accepting request 1294514 from devel:languages:python:FactoryAna Guerrero2025-07-20 13:28:51 +00:00
420a5bd2d2- Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).Matej Cepl2025-07-02 15:58:03 +00:00
4cd370afa9Accepting request 1289839 from home:dgarcia:branches:devel:languages:python:FactoryMatej Cepl2025-07-02 14:13:50 +00:00
3701c69ddbAccepting request 1288599 from devel:languages:python:FactoryAna Guerrero2025-06-26 09:38:07 +00:00
6b34ffaa68Accepting request 1284263 from devel:languages:python:FactoryAna Guerrero2025-06-11 14:20:10 +00:00
28749a59dd- Update to 3.11.13: - Security - gh-135034: Fixes multiple issues that allowed tarfile extraction filters (filter="data" and filter="tar") to be bypassed using crafted symlinks and hard links. Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138 (bsc#1244059), CVE-2025-4330 (bsc#1244060), and CVE-2025-4517 (bsc#1244032). - gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler (CVE-2025-4516, bsc#1243273). - gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service. - Library - gh-128840: Fix parsing long IPv6 addresses with embedded IPv4 address. - gh-134062: ipaddress: fix collisions in __hash__() for IPv4Network and IPv6Network objects. - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output according to RFC 3596, §2.5. Patch by Bénédikt Tran. - bpo-43633: Improve the textual representation of IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2) in ipaddress. Patch by Oleksandr Pavliuk. - Remove upstreamed patches: - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch - CVE-2025-4516-DecodeError-handler.patchMatej Cepl2025-06-09 17:26:24 +00:00
ebd01e5a57Accepting request 1281358 from devel:languages:python:FactoryAna Guerrero2025-06-02 19:58:44 +00:00
ee7afa01a6- Add CVE-2025-4516-DecodeError-handler.patch fixing CVE-2025-4516 (bsc#1243273) blocking DecodeError handling vulnerability, which could lead to DoS.Matej Cepl2025-05-22 13:01:41 +00:00
d91107c793Accepting request 1270996 from devel:languages:python:FactoryAna Guerrero2025-04-24 15:24:53 +00:00
1dad22a352- Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch which makes test_ssl not to stop ThreadedEchoServer on OSError, which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067, gh#python/cpython!126572)Matej Cepl2025-04-19 18:46:57 +00:00
42d2447d53Accepting request 1269623 from devel:languages:python:FactoryAna Guerrero2025-04-16 18:37:19 +00:00
93c48806cf- Update to 3.11.12: - gh-131809: Update bundled libexpat to 2.7.1 - gh-131261: Upgrade to libexpat 2.7.0 - gh-105704: When using urllib.parse.urlsplit() and urllib.parse.urlparse() host parsing would not reject domain names containing square brackets ([ and ]). Square brackets are only valid for IPv6 and IPvFuture hosts according to RFC 3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704). - gh-121284: Fix bug in the folding of rfc2047 encoded-words when flattening an email message using a modern email policy. Previously when an encoded-word was too long for a line, it would be decoded, split across lines, and re-encoded. But commas and other special characters in the original text could be left unencoded and unquoted. This could theoretically be used to spoof header lines using a carefully constructed encoded-word if the resulting rendered email was transmitted or re-parsed. - gh-80222: Fix bug in the folding of quoted strings when flattening an email message using a modern email policy. Previously when a quoted string was folded so that it spanned more than one line, the surrounding quotes and internal escapes would be omitted. This could theoretically be used to spoof header lines using a carefully constructed quoted string if the resulting rendered email was transmitted or re-parsed. - gh-119511: Fix a potential denial of service in the imaplib module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. On many systems this is harmless as unused virtual memory is onlyMatej Cepl2025-04-11 08:56:48 +00:00
2f4b16c511Accepting request 1228380 from devel:languages:python:FactoryAna Guerrero2024-12-06 13:24:50 +00:00
9fa0280821- Update to 3.11.11: - Tools/Demos - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15 and multissltests to use 3.0.15, 3.1.7, and 3.2.3. - Tests - gh-125041: Re-enable skipped tests for zlib on the s390x architecture: only skip checks of the compressed bytes, which can be different between zlib’s software implementation and the hardware-accelerated implementation. - Security - gh-126623: Upgrade libexpat to 2.6.4 - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified. - Library - gh-124651: Properly quote template strings in venv activation scripts (bsc#1232241, CVE-2024-9287). - Removed upstreamed patches: - CVE-2024-9287-venv_path_unquoted.patchMatej Cepl2024-12-04 21:44:34 +00:00
77563efde5Accepting request 1227946 from devel:languages:python:FactoryAna Guerrero2024-12-04 14:26:23 +00:00
12e9f4c239- Add add-loongarch64-support.patch to support loongarch64Matej Cepl2024-12-03 09:29:46 +00:00
ecc51fd1a6- Drop .pyc files from docdir for reproducible buildsMatej Cepl2024-10-02 16:19:39 +00:00
a2eeecf0edAccepting request 1199725 from devel:languages:python:FactoryAna Guerrero2024-09-18 13:25:57 +00:00
8d7964cbfc- Update to 3.11.10: - Security - gh-123678: Upgrade libexpat to 2.6.3 - gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for `python -i, as well as for python -m asyncio. The event in question is cpython.run_stdin. - gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows. Patch by Gregory P. Smith <greg@krypto.org> and Seth Larson <seth@python.org>. Reported by Ellie <el@horse64.org> - gh-121285: Remove backtracking from tarfile header parsing for hdrcharset, PAX, and GNU sparse headers (bsc#1230227, CVE-2024-6232). - gh-118486: :func:os.mkdir on Windows now accepts *mode* of 0o700 to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting :func:tempfile.mkdtemp in scenarios where the base temporary directory is more permissive than the default. - gh-116741: Update bundled libexpat to 2.6.2 - Library - gh-123270: Applied a more surgical fix for malformed payloads in :class:zipfile.Path causing infinite loops (gh-122905) without breaking contents using legitimate characters (bsc#1229704, CVE-2024-8088). - gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes by :mod:http.cookies (bsc#1229596, CVE-2024-7592). - gh-122905: :class:zipfile.Path` objects now sanitize names
1741817519334369620/tmp_refs/heads/main
1741817519334369620/main
Matej Cepl2024-09-09 17:03:10 +00:00
f2ba782fa5- Add gh120226-fix-sendfile-test-kernel-610.patch to avoid failing test_sendfile_close_peer_in_the_middle_of_receiving tests on Linux >= 6.10 (GH-120227).Matej Cepl2024-09-02 09:45:35 +00:00
4c1b2b97e5- Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, CVE-2024-8088).Matej Cepl2024-08-29 12:48:46 +00:00
511b0d3f92- Adding bso1227999-reproducible-builds.patch fixing bsc#1227999 adding reproducibility patches from gh#python/cpython!121872 and gh#python/cpython!121883. - Trying %autopatch again (bsc#1189495 seems to be fixed)Matej Cepl2024-07-18 22:39:01 +00:00
63b5b7e315- Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378).Matej Cepl2024-07-15 12:14:33 +00:00
7124f7199fAccepting request 1185397 from devel:languages:python:FactoryAna Guerrero2024-07-09 18:02:51 +00:00
1170d3a502Accepting request 1184845 from home:dgarcia:usr-local-cpythonMatej Cepl2024-07-04 13:17:01 +00:00
b6c310cc5aAccepting request 1183510 from devel:languages:python:FactoryAna Guerrero2024-06-28 13:46:47 +00:00
2f6f68cb45- Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses.Matej Cepl2024-06-25 21:58:48 +00:00
d00c2f8ffdAccepting request 1171202 from devel:languages:python:FactoryAna Guerrero2024-05-02 21:42:42 +00:00
77ce54fe8f- Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number. Include also support-expat-CVE-2022-25236-patched.patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests.Matej Cepl2024-05-01 23:30:08 +00:00
e54275a76b- Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number. Include also support-expat-CVE-2022-25236-patched.patch. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Remove included patch: - support-expat-CVE-2022-25236-patched.patchMatej Cepl2024-05-01 09:01:36 +00:00
32bb272437Accepting request 1169286 from devel:languages:python:FactoryAna Guerrero2024-04-21 18:24:16 +00:00
116be53bb3Accepting request 1169083 from home:dgarcia:branches:devel:languages:python:FactoryMatej Cepl2024-04-19 22:20:05 +00:00
fe7f29284cAccepting request 1166573 from home:dgarcia:branches:devel:languages:python:FactoryMatej Cepl2024-04-10 14:25:37 +00:00
19bdd05c49Accepting request 1161081 from devel:languages:python:FactoryAna Guerrero2024-03-25 20:06:04 +00:00
246a8799b3- Add reference to CVE-2024-0450 (bsc#1221854) to changelog. other entry or central directory (bsc#1221854, CVE-2024-0450).Matej Cepl2024-03-24 07:52:22 +00:00
eceb720075- Because of bsc#1189495 we have to revert use of %autopatch.Matej Cepl2024-03-22 21:22:48 +00:00
b1a4352010Accepting request 1157149 from devel:languages:python:FactoryAna Guerrero2024-03-13 21:16:00 +00:00
6acd83df79autosetup actually doesn't have -m/-M, it's autopatchMatej Cepl2024-03-12 08:53:52 +00:00
f2e8cdf7ce- Rewrite %prep to use %autosetup et al. for compatibility with rpm 4.20.Matej Cepl2024-03-12 08:46:16 +00:00
61edd8bfc6- bsc#1221260 add bsc1221260-test_asyncio-ResourceWarning.patch to eliminate ResourceWarning which broke the test suite in test_asyncio.Matej Cepl2024-03-12 08:20:37 +00:00
2697832d56Accepting request 1155683 from home:pmonrealgonzalez:branches:devel:languages:python:FactoryMatej Cepl2024-03-06 21:50:48 +00:00
af31ac92dd- (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Repurpose skip-failing-tests.patch to increase timeout for test.test_asyncio.test_tasks.TimeoutTests.test_timeout_time, which fails on slow machines in IBS (s390x).Matej Cepl2024-02-29 07:16:40 +00:00
b0bca7ad80- Remove double definition of /usr/bin/idle%%{version} in %%files.Matej Cepl2024-02-20 22:15:23 +00:00
96b991b360Accepting request 1146838 from devel:languages:python:FactoryAna Guerrero2024-02-18 19:22:52 +00:00
0d9b06c5c0Accepting request 1146787 from home:dgarcia:branches:devel:languages:python:FactoryMatej Cepl2024-02-15 12:58:25 +00:00
4fb12f44ccAccepting request 1145179 from devel:languages:python:FactoryAna Guerrero2024-02-11 14:45:04 +00:00
a7d54cb5c3Accepting request 1145174 from home:dgarcia:branches:devel:languages:python:FactoryMatej Cepl2024-02-08 12:49:59 +00:00
21e9e7f697Accepting request 1136197 from devel:languages:python:FactoryAna Guerrero2024-01-08 22:43:42 +00:00
380c1fa01bAccepting request 1134225 from home:dgarcia:branches:devel:languages:python:FactoryMatej Cepl2024-01-02 13:44:05 +00:00
c7d2aa9012Accepting request 1134084 from devel:languages:python:FactoryAna Guerrero2023-12-20 20:00:08 +00:00
ebe00d33da- Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Thus we can remove Revert-gh105127-left-tests.patch, which is now useless.Matej Cepl2023-12-19 15:40:30 +00:00
5fae7e4a44Accepting request 1134054 from devel:languages:python:FactoryMatej Cepl2023-12-19 15:24:17 +00:00
727f4c9b01Accepting request 1134053 from devel:languages:python:FactoryMatej Cepl2023-12-19 15:22:13 +00:00
Dominique Leuenberger
Matej Cepl
Ana Guerrero