763b1dde4d- Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number. Include also support-expat-CVE-2022-25236-patched.patch.Matej Cepl2024-09-19 00:29:56 +0000
387acaaa01Accepting request 1201476 from devel:languages:python:Factory
Ana Guerrero
2024-09-17 16:18:12 +0000
101efeb9ac- Update to 3.8.20: - Tests - gh-112769: The tests now correctly compare zlib version when :const:zlib.ZLIB_RUNTIME_VERSION contains non-integer suffixes. For example zlib-ng defines the version as `1.3.0.zlib-ng. - gh-117187: Fix XML tests for vanilla Expat <2.6.0. - Security - gh-123678: Upgrade libexpat to 2.6.3 - gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The event in question is cpython.run_stdin. - gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows. Patch by Gregory P. Smith <greg@krypto.org> and Seth Larson <seth@python.org>. Reported by Ellie <el@horse64.org> - gh-121285: Remove backtracking from tarfile header parsing for hdrcharset, PAX, and GNU sparse headers (bsc#1230227, CVE-2024-6232). - gh-118486: :func:os.mkdir on Windows now accepts *mode* of 0o700 to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting :func:tempfile.mkdtemp in scenarios where the base temporary directory is more permissive than the default. - gh-114572: :meth:ssl.SSLContext.cert_store_stats and :meth:ssl.SSLContext.get_ca_certs now correctly lock access to the certificate store, when the :class:ssl.SSLContext` is shared across multiple threads (bsc#1226447, CVE-2024-0397). - gh-116741: Update bundled libexpat to 2.6.2 - Library - gh-123270: Applied a more surgical fix for malformed payloads inMatej Cepl2024-09-09 20:47:14 +0000
037a7134ec- Add CVE-2024-6232-cookies-quad-complex.patch to avoid quadratic complexity in parsing "-quoted cookie values with backslashes (bsc#1229596, CVE-2024-6232).Matej Cepl2024-09-05 13:50:55 +0000
bda5141050- Add gh120226-fix-sendfile-test-kernel-610.patch to avoid failing test_sendfile_close_peer_in_the_middle_of_receiving tests on Linux >= 6.10 (GH-120227).Matej Cepl2024-09-02 12:39:16 +0000
e74115a0efAccepting request 1197121 from devel:languages:python:Factory
Dominique Leuenberger
2024-08-29 13:43:26 +0000
17d5df370f- Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, CVE-2024-8088).Matej Cepl2024-08-28 16:55:40 +0000
fd788dae46Add back qemu_user_space_build conditionMatej Cepl2024-08-28 16:41:06 +0000
99694cf810Accepting request 1193121 from devel:languages:python:Factory
Dominique Leuenberger
2024-08-10 17:08:15 +0000
88ff22d131- Add CVE-2024-5642-OpenSSL-API-buf-overread-NPN.patch removing support for anything but OpenSSL 1.1.1 or newer (bsc#1227233, CVE-2024-5642).Matej Cepl2024-08-08 20:05:24 +0000
91f49896e0- Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999)Matej Cepl2024-08-08 19:37:01 +0000
7199bebb4c- Adding bso1227999-reproducible-builds.patch fixing bsc#1227999 adding reproducibility patches from gh#python/cpython!121872 and gh#python/cpython!121883.Matej Cepl2024-08-08 19:32:27 +0000
ac7a8d9cedAccepting request 1190345 from devel:languages:python:Factory
Dominique Leuenberger
2024-07-30 09:55:02 +0000
394799feb0- Remove %suse_update_desktop_file macro as it is not useful any more.Matej Cepl2024-07-22 21:23:07 +0000
007712f397Accepting request 1189044 from devel:languages:python:Factory
Ana Guerrero
2024-07-22 15:19:12 +0000
964c03b239- Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378).Matej Cepl2024-07-15 12:18:05 +0000
fdf4727713Accepting request 1183507 from devel:languages:python:Factory
Ana Guerrero
2024-06-27 14:04:04 +0000
d643820e38- Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses.Matej Cepl2024-06-26 22:43:09 +0000
d6dfaba499Accepting request 1182492 from devel:languages:python:Factory
Ana Guerrero
2024-06-22 11:23:28 +0000
1225645d7f- Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods.Matej Cepl2024-06-21 14:10:27 +0000
de045a908dAccepting request 1161073 from devel:languages:python:Factory
Ana Guerrero
2024-03-25 20:09:52 +0000
68ee175f5e- Add old-libexpat.patch making the test suite work with libexpat < 2.6.0 (gh#python/cpython#117187).Matej Cepl2024-03-24 01:17:22 +0000
c8c768ab77Accepting request 1160582 from devel:languages:python:Factory
Ana Guerrero
2024-03-22 14:21:09 +0000
9921186373- Update to 3.8.19: - Security - gh-115398: Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods: xml.etree.ElementTree.XMLParser.flush() xml.etree.ElementTree.XMLPullParser.flush() xml.parsers.expat.xmlparser.GetReparseDeferralEnabled() xml.parsers.expat.xmlparser.SetReparseDeferralEnabled() xml.sax.expatreader.ExpatParser.flush() - gh-115399: Update bundled libexpat to 2.6.0 - gh-113659: Skip .pth files with names starting with a dot or hidden file attribute. - Core and Builtins - gh-102388: Fix a bug where iso2022_jp_3 and iso2022_jp_2004 codecs read out of bounds - Library - gh-115197: urllib.request no longer resolves the hostname before checking it against the system’s proxy bypass list on macOS and Windows. - gh-115133: Fix tests for XMLPullParser with Expat 2.6.0. - gh-81194: Fix a crash in socket.if_indextoname() with specific value (UINT_MAX). Fix an integer overflow in socket.if_indextoname() on 64-bit non-Windows platforms. - gh-109858: Protect zipfile from “quoted-overlap” zipbomb. It now raises BadZipFile when try to read an entry that overlaps with other entry or central directory. - gh-107077: Seems that in some conditions, OpenSSL will return SSL_ERROR_SYSCALL instead of SSL_ERROR_SSL when a certification verification has failed, but the error parameters will still contain ERR_LIB_SSLMatej Cepl2024-03-21 20:34:23 +0000
8bca74942fAccepting request 1157647 from devel:languages:python:Factory
Ana Guerrero
2024-03-13 21:21:14 +0000
9e0baf2aeeAccepting request 1155683 from home:pmonrealgonzalez:branches:devel:languages:python:FactoryMatej Cepl2024-03-06 21:50:51 +0000
053e2753e4Accepting request 1153058 from devel:languages:python:Factory
Dominique Leuenberger
2024-02-29 20:49:40 +0000
b2465b642f- (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory.Matej Cepl2024-02-28 23:22:48 +0000
bccd86cdccAccepting request 1152788 from devel:languages:python:Factory
Ana Guerrero
2024-02-28 18:46:44 +0000
540802ee0b- Remove double definition of /usr/bin/idle%%{version} in %%files.Matej Cepl2024-02-20 22:17:37 +0000
74bd53beaeAccepting request 1146871 from devel:languages:python:Factory
Ana Guerrero
2024-02-15 20:01:35 +0000
e455bcb51aAccepting request 1146815 from home:dgarcia:branches:devel:languages:python:FactoryMatej Cepl2024-02-15 14:36:44 +0000
ad14c29c9aAccepting request 1143660 from devel:languages:python:Factory
Ana Guerrero
2024-02-04 18:07:22 +0000
1dc7335dfc- Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Thus we can remove Revert-gh105127-left-tests.patch, which is now useless.Matej Cepl2024-02-02 11:48:17 +0000
0ab6b54fdeAccepting request 1109196 from devel:languages:python:Factory
Ana Guerrero
2023-09-06 16:59:26 +0000
36d04b865e- Update to 3.8.18 (bsc#1214692): - gh-108310: Fixed an issue where instances of ssl.SSLSocket were vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and treating sent unencrypted data as if it were post-handshake TLS encrypted data. Security issue reported as CVE-2023-40217 by Aapo Oksman. Patch by Gregory P. Smith. - gh-107845: tarfile.data_filter() now takes the location of symlinks into account when determining their target, so it will no longer reject some valid tarballs with LinkOutsideDestinationError. - gh-107565: Update multissltests and GitHub CI workflows to use OpenSSL 1.1.1v, 3.0.10, and 3.1.2.Daniel Garcia2023-09-06 06:19:21 +0000
a1dd924e47Accepting request 1102235 from devel:languages:python:Factory
Dominique Leuenberger
2023-08-04 13:03:43 +0000
0ec3738d87- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED! - Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941) partially reverting CVE-2023-27043-email-parsing-errors.patch, because of the regression in gh#python/cpython#106669. - (bsc#1210638, CVE-2023-27043) Add CVE-2023-27043-email-parsing-errors.patch, which detects email address parsing errors and returns empty tuple to indicate the parsing error (old API). (The patch is faulty, gh#python/cpython#106669, but upstream decided not to just revert it).Matej Cepl2023-08-03 15:36:38 +0000
4d0cce2058Accepting request 1098688 from devel:languages:python:FactoryMatej Cepl2023-07-14 14:05:14 +0000
ad4c4c8221- (bsc#1210638, CVE-2023-27043) Add CVE-2023-27043-email-parsing-errors.patch, which detects email address parsing errors and returns empty tuple to indicate the parsing error (old API).Matej Cepl2023-07-12 15:22:03 +0000
85a5883af2Accepting request 1095964 from devel:languages:python:Factory
Dominique Leuenberger
2023-06-29 15:29:29 +0000
6037f4f429- Update to 3.8.17: - gh-103142: The version of OpenSSL used in Windows and Mac installers has been upgraded to 1.1.1u to address CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464, as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 fixed previously in 1.1.1t (gh-101727). - gh-102153: urllib.parse.urlsplit() now strips leading C0 control and space characters following the specification for URLs defined by WHATWG in response to CVE-2023-24329 (bsc#1208471). - gh-99889: Fixed a security in flaw in uu.decode() that could allow for directory traversal based on the input if no out_file was specified. - gh-104049: Do not expose the local on-disk location in directory indexes produced by http.client.SimpleHTTPRequestHandler. - gh-103935: trace.__main__ now uses io.open_code() for files to be executed instead of raw open(). - gh-102953: The extraction methods in tarfile, and shutil.unpack_archive(), have a new filter argument that allows limiting tar features than may be surprising or dangerous, such as creating files outside the destination directory. See Extraction filters for details (fixing CVE-2007-4559, bsc#1203750). - Remove upstreamed patches: - CVE-2023-24329-blank-URL-bypass.patch - CVE-2007-4559-filter-tarfile_extractall.patchMatej Cepl2023-06-28 19:33:18 +0000
dc848e1ea4Accepting request 1090625 from devel:languages:python:Factory
Dominique Leuenberger
2023-06-03 22:13:23 +0000
bb69159320- Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158.Matej Cepl2023-06-03 08:20:52 +0000
ffe74871f7- Why in the world we download from HTTP?Matej Cepl2023-04-30 18:17:18 +0000
477aeca3cfAccepting request 1080040 from devel:languages:python:Factory
Dominique Leuenberger
2023-04-18 13:53:05 +0000
c602a4652d- Use python3 modules to build the documentation.
Steve Kowalik
2023-04-18 05:00:56 +0000
c4e259cd47Accepting request 1068563 from devel:languages:python:Factory
Dominique Leuenberger
2023-03-03 21:24:10 +0000
193496d5b0- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank charactersMatej Cepl2023-03-01 21:37:15 +0000
6de0cca667Accepting request 1067029 from devel:languages:python:Factory
Dominique Leuenberger
2023-02-22 14:21:10 +0000
93dd73b453- Add provides for readline and sqlite3 to the main Python package.Matej Cepl2023-02-21 13:44:55 +0000
87d61894a0Accepting request 1061592 from devel:languages:python:Factory
Dominique Leuenberger
2023-01-29 13:10:07 +0000
134012c00eAccepting request 1061585 from home:kukuk:branches:devel:languages:python:FactoryMatej Cepl2023-01-27 16:14:58 +0000
70a582039bAccepting request 1058190 from devel:languages:python:Factory
Dominique Leuenberger
2023-01-15 16:57:53 +0000
188f13580bAccepting request 1058145 from home:marxin:branches:devel:languages:python:FactoryMatej Cepl2023-01-13 10:28:20 +0000
a9fe505070Accepting request 1041645 from devel:languages:python:Factory
Dominique Leuenberger
2022-12-09 12:16:47 +0000
c462da06b7- Update to 3.8.16: - python -m http.server no longer allows terminal control characters sent within a garbage request to be printed to the stderr server log. This is done by changing the http.server BaseHTTPRequestHandler .log_message method to replace control characters with a \xHH hex escape before printing. - Avoid publishing list of active per-interpreter audit hooks via the gc module - The IDNA codec decoder used on DNS hostnames by socket or asyncio related name resolution functions no longer involves a quadratic algorithm. This prevents a potential CPU denial of service if an out-of-spec excessive length hostname involving bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects potentially allow for an attacker to supply such a name (CVE-2022-45061). - Update bundled libexpat to 2.5.0 - Port XKCP’s fix for the buffer overflows in SHA-3 (CVE-2022-37454). - The deprecated mailcap module now refuses to inject unsafe text (filenames, MIME types, parameters) into shell commands. Instead of using such text, it will warn and act as if a match was not found (or for test commands, as if the test failed). - Removed upstream patches: - CVE-2022-37454-sha3-buffer-overflow.patch - CVE-2022-45061-DoS-by-IDNA-decode.patchMatej Cepl2022-12-08 10:36:29 +0000
20c2782eeaAccepting request 1034964 from devel:languages:python:Factory
Dominique Leuenberger
2022-11-12 16:39:54 +0000
d73dddf910- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names.Matej Cepl2022-11-09 18:40:43 +0000
a7cf9db7d6Accepting request 1032060 from devel:languages:python:Factory
Dominique Leuenberger
2022-10-29 18:16:09 +0000
f1998cfdab- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library).Matej Cepl2022-10-28 19:44:10 +0000
000043d01cAccepting request 1031407 from devel:languages:python:Factory
Dominique Leuenberger
2022-10-28 17:28:32 +0000
8e65405c86Accepting request 1031399 from home:mcepl:branches:devel:languages:python:FactoryMatej Cepl2022-10-26 21:24:58 +0000
50231d7d05Accepting request 1030237 from devel:languages:python:Factory
Dominique Leuenberger
2022-10-22 12:11:58 +0000
75d8efff80Accepting request 1030164 from home:dgarcia:branches:devel:languages:python:FactoryMatej Cepl2022-10-20 18:12:06 +0000
b21d8c938d- Update to 3.8.15: - Fix multiplying a list by an integer (list *= int): detect the integer overflow when the new allocated length is close to the maximum size. - Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run openssl commands. (originally filed as CVE-2022-37460, later withdrawn) - Fix command line parsing: reject -X int_max_str_digits option with no value (invalid) when the PYTHONINTMAXSTRDIGITS environment variable is set to a valid limit. - When ValueError is raised if an integer is larger than the limit, mention the sys.set_int_max_str_digits() function in the error message. - Update bundled libexpat to 2.4.9 - Fixes a potential buffer overrun in msilib.Matej Cepl2022-10-19 07:18:07 +0000
0e86c36d64Accepting request 1002501 from devel:languages:python:Factory
Dominique Leuenberger
2022-09-17 18:08:05 +0000
07285bcb8c- Update to 3.8.14: - (CVE-2020-10735, bsc#1203125). Converting between int and str in bases other than 2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now raises a ValueError if the number of digits in string form is above a limit to avoid potential denial of service attacks due to the algorithmic complexity. This new limit can be configured or disabled by environment variable, command line flag, or sys APIs. See the integer string conversion length limitation documentation. The default limit is 4300 digits in string form. - (CVE-2021-28861, bsc#1202624) http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. Vulnerability discovered, and initial fix proposed, by Hamza Avvan. - Also other bugfixes: - Fix contextvars HAMT implementation to handle iteration over deep trees. The bug was discovered and fixed by Eli Libman. See MagicStack/immutables#84 for more details. - Fix ensurepip environment isolation for subprocess running pip. - Raise ProgrammingError instead of segfaulting on recursive usage of cursors in sqlite3 converters. Patch by Sergey Fedoseev. - Add a new gh role to the documentation to link to GitHub issues. - Pin Jinja to a version compatible with Sphinx version 2.4.4. - test_ssl is now checking for supported TLS version and protocols in more tests.Matej Cepl2022-09-11 09:16:44 +0000
312e2a6886Accepting request 1000772 from devel:languages:python:Factory
Dominique Leuenberger
2022-09-03 21:18:33 +0000
452f54cf1b- (bsc#1196784, CVE-2022-25236) Add patch support-expat-CVE-2022-25236-patched.patch to allow working with different versions of libexpat.Matej Cepl2022-09-03 02:23:54 +0000
d58978abbdFix changelog entry
Steve Kowalik
2022-09-02 05:08:55 +0000
3ea01e31b6- http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861)
Steve Kowalik
2022-09-01 04:20:31 +0000
825dab796f- Add conditional for requiring rpm-build-python, so we should be compilable on SLE/Leap.Matej Cepl2022-08-31 21:37:06 +0000
a384b79efb- Add bpo34990-2038-problem-compileall.patch making compileall.py compliant with year 2038 (bsc#1202666, gh#python/cpython#79171), backport of fix to Python 3.8.Matej Cepl2022-08-31 09:50:12 +0000
f0e7813db0Accepting request 990680 from devel:languages:python:Factory
Richard Brown
2022-07-29 14:46:56 +0000
822856d8bd- Switch from %primary_interpreter to prjconf-defined %primary_python (gh#openSUSE/python-rpm-macros#127).Matej Cepl2022-07-21 14:22:29 +0000
578f048a9fAccepting request 975215 from devel:languages:python:Factory
Dominique Leuenberger
2022-06-14 22:31:44 +0000
5493df1c9c- Switch primary_interpreter from python38 to python310Matej Cepl2022-05-05 14:35:19 +0000
71ed8dd763Accepting request 965120 from devel:languages:python:Factory
Dominique Leuenberger
2022-04-01 19:34:44 +0000
8f9c4e7712- Update to 3.8.13: Core and Builtins bpo-46794: Bump up the libexpat version into 2.4.6 bpo-46985: Upgrade pip wheel bundled with ensurepip (pip 22.0.4) bpo-46932: Update bundled libexpat to 2.4.7 bpo-46811: Make test suite support Expat >=2.4.5 bpo-46784: Fix libexpat symbols collisions with user dynamically loaded or statically linked libexpat in embedded Python. bpo-46400: expat: Update libexpat from 2.4.1 to 2.4.4 bpo-46474: In importlib.metadata.EntryPoint.pattern, avoid potential REDoS by limiting ambiguity in consecutive whitespace. bpo-44849: Fix the os.set_inheritable() function on FreeBSD 14 for file descriptor opened with the O_PATH flag: ignore the EBADF error on ioctl(), fallback on the fcntl() implementation. bpo-41028: Language and version switchers, previously maintained in every cpython branches, are now handled by docsbuild-script. bpo-45195: Fix test_readline.test_nonascii(): sometimes, the newline character is not written at the end, so don’t expect it in the output. bpo-44949: Fix auto history tests of test_readline: sometimes, the newline character is not written at the end, so don’t expect it in the output. bpo-45405: Prevent internal configure error when running configure with recent versions of clang. - Remove upstreamed patches: - support-expat-245.patchMatej Cepl2022-03-26 22:17:57 +0000
7137fa9432Accepting request 956582 from devel:languages:python:Factory
Dominique Leuenberger
2022-02-23 15:25:35 +0000
d1acfb84ff- Add patch support-expat-245.patch: * Support Expat >= 2.4.5
Steve Kowalik
2022-02-22 05:55:24 +0000
055c12217cAccepting request 934639 from devel:languages:python:Factory
Dominique Leuenberger
2021-12-01 19:46:08 +0000