cb3301d2cc- Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Thus we can remove Revert-gh105127-left-tests.patch, which is now useless.Matej Cepl2023-12-18 16:25:35 +00:00
a7b11641feAccepting request 1133399 from home:dgarcia:branches:devel:languages:python:FactoryDaniel Garcia2023-12-15 12:09:56 +00:00
18a62cf507Accepting request 1128112 from devel:languages:python:FactoryAna Guerrero2023-11-23 20:38:28 +00:00
dbc72d69e1Accepting request 1126597 from home:dgarcia:branches:devel:languages:python:FactoryMatej Cepl2023-11-15 12:57:57 +00:00
4b50a8332bAccepting request 1113067 from devel:languages:python:FactoryAna Guerrero2023-09-25 18:00:36 +00:00
558337c773characters without truncating the path (bsc#1214693, CVE-2023-41105).Matej Cepl2023-09-15 11:19:47 +00:00
382f0f4b58Accepting request 1109225 from devel:languages:python:FactoryAna Guerrero2023-09-08 19:15:18 +00:00
55316ef9e1- Update to 3.11.5 (bsc#1214692): - Security - gh-108310: Fixed an issue where instances of ssl.SSLSocket were vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and treating sent unencrypted data as if it were post-handshake TLS encrypted data. Security issue reported as CVE-2023-40217 by Aapo Oksman. Patch by Gregory P. Smith. - Core and Builtins - gh-104432: Fix potential unaligned memory access on C APIs involving returned sequences of char * pointers within the grp and socket modules. These were revealed using a -fsaniziter=alignment build on ARM macOS. Patch by Christopher Chavez. - gh-77377: Ensure that multiprocessing synchronization objects created in a fork context are not sent to a different process created in a spawn context. This changes a segfault into an actionable RuntimeError in the parent process. - gh-106092: Fix a segmentation fault caused by a use-after-free bug in frame_dealloc when the trashcan delays the deallocation of a PyFrameObject. - gh-106719: No longer suppress arbitrary errors in the __annotations__ getter and setter in the type and module types. - gh-106723: Propagate frozen_modules to multiprocessing spawned process interpreters. - gh-105979: Fix crash in _imp.get_frozen_object() due to improper exception handling. - gh-105840: Fix possible crashes when specializing function calls with too many __defaults__. - gh-105588: Fix an issue that could result in crashes whenDaniel Garcia2023-09-06 07:58:19 +00:00
eb7790f0a7- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!Matej Cepl2023-08-03 15:27:34 +00:00
41e7e28995- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941) partially reverting CVE-2023-27043-email-parsing-errors.patch, because of the regression in gh#python/cpython#106669. - (bsc#1210638, CVE-2023-27043) Add CVE-2023-27043-email-parsing-errors.patch, which detects email address parsing errors and returns empty tuple to indicate the parsing error (old API). (The patch is faulty, gh#python/cpython#106669, but upstream decided not to just revert it).Matej Cepl2023-08-03 14:58:20 +00:00
b8797f4452- Update to Python 3.11.4: - gh-103142: The version of OpenSSL used in Windows and Mac installers has been upgraded to 1.1.1u to address CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464, as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 fixed previously in 1.1.1t (gh-101727). - gh-102153: urllib.parse.urlsplit() now strips leading C0 control and space characters following the specification for URLs defined by WHATWG in response to CVE-2023-24329 (bsc#1208471). - gh-99889: Fixed a security in flaw in uu.decode() that could allow for directory traversal based on the input if no out_file was specified. - gh-104049: Do not expose the local on-disk location in directory indexes produced by http.client.SimpleHTTPRequestHandler. - gh-103935: trace.__main__ now uses io.open_code() for files to be executed instead of raw open(). - gh-102953: The extraction methods in tarfile, and shutil.unpack_archive(), have a new filter argument that allows limiting tar features than may be surprising or dangerous, such as creating files outside the destination directory. See Extraction filters for details (fixing CVE-2007-4559, bsc#1203750). - Remove upstreamed patches: - CVE-2007-4559-filter-tarfile_extractall.patchMatej Cepl2023-06-28 19:51:47 +00:00
7a2425c221- Remove obsolete_python_versioned macro again. This mechanism has no business to be in Python 3.11, because we have abolished with it whole interpreter+setuptools+pip product. Python 3.11 should not be replaced by later versions anymore.Matej Cepl2023-06-26 13:04:00 +00:00
f503a46aa9- Add skip_if_buildbot-extend.patch to avoid the bug altogether (extending what skip_if_buildbot covers).Matej Cepl2023-05-03 05:42:18 +00:00
21d42b692c- Update to 3.11.3: - Security - gh-101727: Updated the OpenSSL version used in Windows and macOS binary release builds to 1.1.1t to address CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 per the OpenSSL 2023-02-07 security advisory. - gh-101283: subprocess.Popen now uses a safer approach to find cmd.exe when launching with shell=True. Patch by Eryk Sun, based on a patch by Oleg Iarygin. - Core and Builtins - gh-101975: Fixed stacktop value on tracing entries to avoid corruption on garbage collection. - gh-102701: Fix overflow when creating very large dict. - gh-102416: Do not memoize incorrectly automatically generated loop rules in the parser. Patch by Pablo Galindo. - gh-102356: Fix a bug that caused a crash when deallocating deeply nested filter objects. Patch by Marta Gómez Macías. - gh-102397: Fix segfault from race condition in signal handling during garbage collection. Patch by Kumar Aditya. - gh-102281: Fix potential nullptr dereference and use of uninitialized memory in fileutils. Patch by Max Bachmann. - gh-102126: Fix deadlock at shutdown when clearing thread states if any finalizer tries to acquire the runtime head lock. Patch by Kumar Aditya. - gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal module. Patch by Max Bachmann. - gh-101967: Fix possible segfault in positional_only_passed_as_keyword function, when new list created. - gh-101765: Fix SystemError / segmentation fault in iterMatej Cepl2023-04-27 22:09:02 +00:00
6c436c7abc- Update to 3.11.1: - python -m http.server no longer allows terminal control characters sent within a garbage request to be printed to the stderr server lo This is done by changing the http.server BaseHTTPRequestHandler .log_message method to replace control characters with a \xHH hex escape before printin - Avoid publishing list of active per-interpreter audit hooks via the gc module - The IDNA codec decoder used on DNS hostnames by socket or asyncio related name resolution functions no longer involves a quadratic algorithm. This prevents a potential CPU denial of service if an out-of-spec excessive length hostname involving bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects potentially allow for an attacker to supply such a name (CVE-2022-45061). - Update bundled libexpat to 2.5.0 - Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run openssl commands. Issue reported and initial fix by Caleb Shortt. Patch by Victor Stinner. - Fix a crash when an object which does not have a dictionary frees its instance values. - Fix a bug in the tokenizer that could cause infinite recursion when showing syntax warnings that happen in the first line of the source. Patch by Pablo Galindo - Fix an issue that could cause frames to be visible to Python code as they are being torn down, possibly leading to memory corruption or hard crashes of the interpreter. - Fix a reference bug in _imp.create_builtin() after theMatej Cepl2022-12-08 15:05:06 +00:00
03d1be1616- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names.Matej Cepl2022-11-09 18:37:56 +00:00
ba06f07184- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid CVE-2022-42919 (bsc#1204886) avoiding Linux specific local privilege escalation via the multiprocessing forkserver start method.Matej Cepl2022-11-04 15:00:28 +00:00
d8ac67fc2d- Update to 3.11.0rc2: - Converting between int and str in bases other than 2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now raises a ValueError if the number of digits in string form is above a limit to avoid potential denial of service attacks due to the algorithmic complexity. This is a mitigation for CVE-2020-10735. This new limit can be configured or disabled by environment variable, command line flag, or sys APIs. See the integer string conversion length limitation documentation. The default limit is 4300 digits in string form. - Fix case of undefined behavior in ceval.c - Do not expose KeyWrapper in _functools. - Ensure that tracing, sys.setrace(), is turned on immediately. In pre-release versions of 3.11, some tracing events might have been lost when turning on tracing in a __del__ method or interrupt. - Fix use after free in trace refs build mode. Patch by Kumar Aditya. - When loading a file with invalid UTF-8 inside a multi-line string, a correct SyntaxError is emitted. - Make sure that incomplete frames do not show up in tracemalloc traces. - Remove two cases of undefined behavior, by adding NULL checks. - Fix possible NULL pointer dereference in _PyThread_CurrentFrames. Patch by Kumar Aditya. - Fix AttributeError missing name and obj attributes in object.__getattribute__(). Patch by Philip Georgi. - Loading a file with invalid UTF-8 will now report the brokenMatej Cepl2022-09-15 09:14:50 +00:00
3931fb9f09- fix import_failed.map to refer to the python 3.11 package versionsMatej Cepl2022-08-20 21:31:49 +00:00
93d3c08eeb- Update to 3.11.0rc1: - Core and Builtins - Update code object hashing and equality to consider all debugging and exception handling tables. This fixes an issue where certain non-identical code objects could be “deduplicated” during compilation. - _PyPegen_Parser_New now properly detects token memory allocation errors. Patch by Honglin Zhu. - Run Python code in tracer/profiler function at full speed. Fixes slowdown in earlier versions of 3.11. - Emit a warning in debug mode if an object does not call PyObject_GC_UnTrack() before deallocation. Patch by Pablo Galindo. - Prevented crashes in the AST constructor when compiling some absurdly long expressions like "+0"*1000000. RecursionError is now raised instead. Patch by Pablo Galindo - ast.AST node positions are now validated when provided to compile() and other related functions. If invalid positions are detected, a ValueError will be raised. - Fix error detection in some builtin functions when keyword argument name is an instance of a str subclass with overloaded __eq__ and __hash__. Previously it could cause SystemError or other undesired behavior. - Library - Update bundled pip to 22.2.2. - Fix asyncio.TaskGroup to propagate exception when asyncio.CancelledError was replaced with another exception by a context manger. Patch by Kumar Aditya and Guido van Rossum.Matej Cepl2022-08-20 14:25:45 +00:00
7c5df48558Accepting request 991283 from devel:languages:python:FactoryRichard Brown2022-07-28 18:58:07 +00:00
a867744a23- Update to 3.11.0b5: - Core and Builtins - gh-93351: ast.AST node positions are now validated when provided to compile() and other related functions. If invalid positions are detected, a ValueError will be raised. - gh-94438: Fix an issue that caused extended opcode arguments and some conditional pops to be ignored when calculating valid jump targets for assignments to the f_lineno attribute of frame objects. In some cases, this could cause inconsistent internal state, resulting in a hard crash of the interpreter. - gh-95060: Undocumented PyCode_Addr2Location function now properly returns when addrq argument is less than zero. - gh-95113: Replace all EXTENDED_ARG_QUICK instructions with basic EXTENDED_ARG instructions in unquickened code. Consumers of non-adaptive bytecode should be able to handle extended arguments the same way they were handled in CPython 3.10 and older. - gh-91409: Fix incorrect source location info caused by certain optimizations in the bytecode compiler. - gh-94036: Fix incorrect source location info for some multi-line attribute accesses and method calls. - gh-94739: Allow jumping within, out of, and across exception handlers in the debugger. - gh-94949: ast.parse() will no longer parse parenthesized context managers when passed feature_version less than (3, 9). Patch by Shantanu Jain. - gh-94947: ast.parse() will no longer parse assignment expressions when passed feature_version less than (3,Matej Cepl2022-07-26 10:43:57 +00:00
cdbc2f881dAccepting request 990681 from devel:languages:python:FactoryRichard Brown2022-07-22 17:21:33 +00:00
6af5b9f2b3- Update to 3.11.0b4: - Fixes many bugs and adds following more significant changes - Security - gh-68966: The deprecated mailcap module now refuses to inject Coreunsafe text (filenames, MIME types, parameters) into shell Corecommands. Instead of using such text, it will warn and act Coreas if a match was not found (or for test commands, as if the Coretest failed). and Builtins - gh-93516: Lazily create a table mapping bytecode offsets to line numbers to speed up calculation of line numbers when tracing. - gh-93461: importlib.invalidate_caches() now drops entries from sys.path_importer_cache with a relative path as name. This solves a caching issue when a process changes its current working directory. - FileFinder no longer inserts a dot in the path, e.g. /egg/./spam is now /egg/spam. Library - gh-93896: Fix asyncio.run() and unittest.IsolatedAsyncioTestCase to always the set event loop as it was done in Python 3.10 and earlier. Patch by Kumar Aditya. - gh-94101: Manual instantiation of ssl.SSLSession objects is no longer allowed as it lead to misconfigured instances that crashed the interpreter when attributes where accessed on them. - gh-83658: Make multiprocessing.Pool raise an exception if maxtasksperchild is not None or a positive int. - gh-61162: Clarify sqlite3 behavior when Using the connection as a context manager.Matej Cepl2022-07-14 16:01:58 +00:00
62ccbe2ed8- Update to pre-release version 3.11.0b1: - PEP 657 – Include Fine-Grained Error Locations in Tracebacks - PEP 654 – Exception Groups and except* - PEP 673 – Self Type - PEP 646 – Variadic Generics - PEP 680– tomllib: Support for Parsing TOML in the Standard Library - PEP 675– Arbitrary Literal String Type - PEP 655– Marking individual TypedDict items as required or potentially-missing - bpo-46752– Introduce task groups to asyncio - The Faster Cpython Project is already yielding some exciting results. Python 3.11 is up to 10-60% faster than Python 3.10. On average, we measured a 1.22x speedup on the standard benchmark suite. See https://docs.python.org/3.11/whatsnew/3.11.html#faster-cpython for details.Matej Cepl2022-05-09 15:12:55 +00:00
Matej Cepl
Daniel Garcia
Ana Guerrero
Dominique Leuenberger
Fabian Vogt
Markéta Machová
Richard Brown