forked from pool/python310
Set link to python310.38050 via maintenance_release request
This commit is contained in:
@@ -1,127 +0,0 @@
|
||||
From d91e2c740890837edafaee24d68112b776cda9c5 Mon Sep 17 00:00:00 2001
|
||||
From: Seth Michael Larson <seth@python.org>
|
||||
Date: Fri, 31 Jan 2025 11:41:34 -0600
|
||||
Subject: [PATCH] gh-105704: Disallow square brackets (`[` and `]`) in domain
|
||||
names for parsed URLs (GH-129418)
|
||||
|
||||
* gh-105704: Disallow square brackets ( and ) in domain names for parsed URLs
|
||||
|
||||
* Use Sphinx references
|
||||
|
||||
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
|
||||
|
||||
* Add mismatched bracket test cases, fix news format
|
||||
|
||||
* Add more test coverage for ports
|
||||
|
||||
---------
|
||||
|
||||
(cherry picked from commit d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a)
|
||||
|
||||
Co-authored-by: Seth Michael Larson <seth@python.org>
|
||||
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
|
||||
---
|
||||
Lib/test/test_urlparse.py | 37 +++++++++-
|
||||
Lib/urllib/parse.py | 20 ++++-
|
||||
Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst | 4 +
|
||||
3 files changed, 58 insertions(+), 3 deletions(-)
|
||||
create mode 100644 Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
|
||||
|
||||
--- a/Lib/test/test_urlparse.py
|
||||
+++ b/Lib/test/test_urlparse.py
|
||||
@@ -1149,16 +1149,51 @@ class UrlParseTestCase(unittest.TestCase
|
||||
self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
|
||||
self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
|
||||
self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@]v6a.ip[/Path')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]/')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix/')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]?')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix?')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]/')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix/')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]?')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix?')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a1')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a1')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:1a')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:1a')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:/')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:?')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@prefix.[v6a.ip]')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@[v6a.ip].suffix')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip]')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip[')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip].suffix')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip[suffix')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip')
|
||||
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[suffix')
|
||||
|
||||
def test_splitting_bracketed_hosts(self):
|
||||
- p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query')
|
||||
+ p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]:1234/path?query')
|
||||
self.assertEqual(p1.hostname, 'v6a.ip')
|
||||
self.assertEqual(p1.username, 'user')
|
||||
self.assertEqual(p1.path, '/path')
|
||||
+ self.assertEqual(p1.port, 1234)
|
||||
p2 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7%test]/path?query')
|
||||
self.assertEqual(p2.hostname, '0439:23af:2309::fae7%test')
|
||||
self.assertEqual(p2.username, 'user')
|
||||
self.assertEqual(p2.path, '/path')
|
||||
+ self.assertIs(p2.port, None)
|
||||
p3 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146%test]/path?query')
|
||||
self.assertEqual(p3.hostname, '0439:23af:2309::fae7:1234:192.0.2.146%test')
|
||||
self.assertEqual(p3.username, 'user')
|
||||
--- a/Lib/urllib/parse.py
|
||||
+++ b/Lib/urllib/parse.py
|
||||
@@ -442,6 +442,23 @@ def _checknetloc(netloc):
|
||||
raise ValueError("netloc '" + netloc + "' contains invalid " +
|
||||
"characters under NFKC normalization")
|
||||
|
||||
+def _check_bracketed_netloc(netloc):
|
||||
+ # Note that this function must mirror the splitting
|
||||
+ # done in NetlocResultMixins._hostinfo().
|
||||
+ hostname_and_port = netloc.rpartition('@')[2]
|
||||
+ before_bracket, have_open_br, bracketed = hostname_and_port.partition('[')
|
||||
+ if have_open_br:
|
||||
+ # No data is allowed before a bracket.
|
||||
+ if before_bracket:
|
||||
+ raise ValueError("Invalid IPv6 URL")
|
||||
+ hostname, _, port = bracketed.partition(']')
|
||||
+ # No data is allowed after the bracket but before the port delimiter.
|
||||
+ if port and not port.startswith(":"):
|
||||
+ raise ValueError("Invalid IPv6 URL")
|
||||
+ else:
|
||||
+ hostname, _, port = hostname_and_port.partition(':')
|
||||
+ _check_bracketed_host(hostname)
|
||||
+
|
||||
# Valid bracketed hosts are defined in
|
||||
# https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
|
||||
def _check_bracketed_host(hostname):
|
||||
@@ -505,8 +522,7 @@ def urlsplit(url, scheme='', allow_fragm
|
||||
(']' in netloc and '[' not in netloc)):
|
||||
raise ValueError("Invalid IPv6 URL")
|
||||
if '[' in netloc and ']' in netloc:
|
||||
- bracketed_host = netloc.partition('[')[2].partition(']')[0]
|
||||
- _check_bracketed_host(bracketed_host)
|
||||
+ _check_bracketed_netloc(netloc)
|
||||
if allow_fragments and '#' in url:
|
||||
url, fragment = url.split('#', 1)
|
||||
if '?' in url:
|
||||
--- /dev/null
|
||||
+++ b/Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
|
||||
@@ -0,0 +1,4 @@
|
||||
+When using :func:`urllib.parse.urlsplit` and :func:`urllib.parse.urlparse` host
|
||||
+parsing would not reject domain names containing square brackets (``[`` and
|
||||
+``]``). Square brackets are only valid for IPv6 and IPvFuture hosts according to
|
||||
+`RFC 3986 Section 3.2.2 <https://www.rfc-editor.org/rfc/rfc3986#section-3.2.2>`__.
|
||||
@@ -1 +0,0 @@
|
||||
{"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": {"certificate": {"rawBytes": "MIICzDCCAlKgAwIBAgIUH4wr+RBSLHxmoLeVWQFWtLrOickwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjQxMjAzMTgzMzQ0WhcNMjQxMjAzMTg0MzQ0WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEDu7neWfjmWCoWs4toOwMe5ZS5m/Qod/IAYGdai04Qjx+fJ2JKIML8OXa376wmCRg+1mE5N75M5g55sjeH6AW5KOCAXEwggFtMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUVxcoODLOP6ce+ffWUlBZ8dQpAtAwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wIgYDVR0RAQH/BBgwFoEUcGFibG9nc2FsQHB5dGhvbi5vcmcwKQYKKwYBBAGDvzABAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMIGJBgorBgEEAdZ5AgQCBHsEeQB3AHUA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGTjcy6WQAABAMARjBEAiAWKkpOltF6fngTPFPiPrjo6Mnx7DvjTjhy+I9C8a1E8AIgDFHJXkaNO/cRHZCEycDJfdcJrMlDEI+iTAc9GbhJreMwCgYIKoZIzj0EAwMDaAAwZQIwRlcLZ+KTrMXkSOqoeZkRtIMzrMhiRvjoMfcYt7d3zX+t+fDtaywsYIu0WSWNtwLuAjEAk1LM0s1c13zn/l9B9I8YMDJxCiUY2ed5AK523TIy75cmH+IYO7XODOD86YSkytvS"}, "tlogEntries": [{"logIndex": "153123526", "logId": {"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}, "kindVersion": {"kind": "hashedrekord", "version": "0.0.1"}, "integratedTime": "1733250825", "inclusionPromise": {"signedEntryTimestamp": "MEUCIBb+3OGEfIJgweBH+795X/kmenmW5L6lzTaW5mU9DN++AiEAni2MKnETeAsGhc8u0W/Y5AuhYKd14TdRvoUw/bWhzjs="}, "inclusionProof": {"logIndex": "31219264", "rootHash": "EEDRbQekcBvIu2A3f37wAtzpj3Tu+lPYLi9AUyS4FBY=", "treeSize": "31219265", "hashes": ["jy1RZw1zMvGOhV5pYK21mUnw/3hfyXoogDNhzfMT8uA=", "t7CZ1TCAQBidKeIL1f3M7Y3VwBYB2DQeG1Sp8X8Mepc=", "LIvgEWJ5UP1rLp6WPJ2TzjrHAa5MpLpXOdj/yoZvLcM=", "XjayhjKU3shP7q7lhmhKDv3Vpi4gJgAPCu0KlEzc9Qo=", "go1dmexQYS5etu69upRRX7IFvuA0rIcT9aYjMstmPIU=", "AYwr74Bm2w383UnS7DdbZUUAhusq28JoxKpWrQ7OvGQ=", "u+yWmGIR6sAH32wiSy22mz1Yf+jfPdBTjFbyRISuTZw=", "3eFC7Gp4fWecybDOAw9uUTrM1xB7YRYRAGsfYkiQbV8=", "1uKk2qjOliHMiTk906jrchP8mXWsRG8apaU1sa0lfh0=", "oOecFfN3YqDOkbijS/ej1WF5Da/Gt/AZNhbwE9uoOE8=", "4lUF0YOu9XkIDXKXA0wMSzd6VeDY3TZAgmoOeWmS2+Y=", "gf+9m552B3PnkWnO0o4KdVvjcT3WVHLrCbf1DoVYKFw="], "checkpoint": {"envelope": "rekor.sigstore.dev - 1193050959916656506\n31219265\nEEDRbQekcBvIu2A3f37wAtzpj3Tu+lPYLi9AUyS4FBY=\n\n\u2014 rekor.sigstore.dev wNI9ajBFAiAnUUia2onArhzOpQclqAm9wBFu32/qoYagpd3PkWeELgIhAPUWvc2y6UP8V2I/ABP9HtsQi208X3nuSI8xunycnmZl\n"}}, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJiZmIyNDk2MDk5OTAyMjA0OTFhMWI5Mjg1MGEwNzEzNWVkMDgzMWU0MTczOGNmNjgxZDYzY2YwMWIyYThmYmQxIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FWUNJUUQyYW4xbTUvSWl4clZsYVlpcUMxQmpuamc3eG55MTBxVWw5WHhIM2hJSkNRSWhBS1l4YzRNeTNYTndscEdEU25QTTBjU1gxM3ljMGNnN3BTVVZCS2RrOHZMaiIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZSRU5EUVd4TFowRjNTVUpCWjBsVlNEUjNjaXRTUWxOTVNIaHRiMHhsVmxkUlJsZDBUSEpQYVdOcmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFJlRTFxUVhwTlZHZDZUWHBSTUZkb1kwNU5hbEY0VFdwQmVrMVVaekJOZWxFd1YycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZFZFRkdVpWZG1hbTFYUTI5WGN6UjBiMDkzVFdVMVdsTTFiUzlSYjJRdlNVRlpSMlFLWVdrd05GRnFlQ3RtU2pKS1MwbE5URGhQV0dFek56WjNiVU5TWnlzeGJVVTFUamMxVFRWbk5UVnphbVZJTmtGWE5VdFBRMEZZUlhkblowWjBUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZXZUdOdkNrOUVURTlRTm1ObEsyWm1WMVZzUWxvNFpGRndRWFJCZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBsbldVUldVakJTUVZGSUwwSkNaM2RHYjBWVlkwZEdhV0pIT1c1ak1rWnpVVWhDTldSSGFIWmlhVFYyWTIxamQwdFJXVXRMZDFsQ1FrRkhSQXAyZWtGQ1FWRlJZbUZJVWpCalNFMDJUSGs1YUZreVRuWmtWelV3WTNrMWJtSXlPVzVpUjFWMVdUSTVkRTFEYzBkRGFYTkhRVkZSUW1jM09IZEJVV2RGQ2toUmQySmhTRkl3WTBoTk5reDVPV2haTWs1MlpGYzFNR041Tlc1aU1qbHVZa2RWZFZreU9YUk5TVWRLUW1kdmNrSm5SVVZCWkZvMVFXZFJRMEpJYzBVS1pWRkNNMEZJVlVFelZEQjNZWE5pU0VWVVNtcEhValJqYlZkak0wRnhTa3RZY21wbFVFc3pMMmcwY0hsblF6aHdOMjgwUVVGQlIxUnFZM2syVjFGQlFRcENRVTFCVW1wQ1JVRnBRVmRMYTNCUGJIUkdObVp1WjFSUVJsQnBVSEpxYnpaTmJuZzNSSFpxVkdwb2VTdEpPVU00WVRGRk9FRkpaMFJHU0VwWWEyRk9Dazh2WTFKSVdrTkZlV05FU21aa1kwcHlUV3hFUlVrcmFWUkJZemxIWW1oS2NtVk5kME5uV1VsTGIxcEplbW93UlVGM1RVUmhRVUYzV2xGSmQxSnNZMHdLV2l0TFZISk5XR3RUVDNGdlpWcHJVblJKVFhweVRXaHBVblpxYjAxbVkxbDBOMlF6ZWxncmRDdG1SSFJoZVhkeldVbDFNRmRUVjA1MGQweDFRV3BGUVFwck1VeE5NSE14WXpFemVtNHZiRGxDT1VrNFdVMUVTbmhEYVZWWk1tVmtOVUZMTlRJelZFbDVOelZqYlVnclNWbFBOMWhQUkU5RU9EWlpVMnQ1ZEhaVENpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9fX19"}]}, "messageSignature": {"messageDigest": {"algorithm": "SHA2_256", "digest": "v7JJYJmQIgSRobkoUKBxNe0IMeQXOM9oHWPPAbKo+9E="}, "signature": "MEYCIQD2an1m5/IixrVlaYiqC1Bjnjg7xny10qUl9XxH3hIJCQIhAKYxc4My3XNwlpGDSnPM0cSX13yc0cg7pSUVBKdk8vLj"}}
|
||||
1
Python-3.10.18.tar.xz.sigstore
Normal file
1
Python-3.10.18.tar.xz.sigstore
Normal file
File diff suppressed because one or more lines are too long
@@ -29,7 +29,7 @@
|
||||
Create a Python.framework rather than a traditional Unix install. Optional
|
||||
--- a/Misc/NEWS
|
||||
+++ b/Misc/NEWS
|
||||
@@ -3810,7 +3810,7 @@ C API
|
||||
@@ -3942,7 +3942,7 @@ C API
|
||||
-----
|
||||
|
||||
- bpo-43795: The list in :ref:`stable-abi-list` now shows the public name
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
Lib/test/test_posix.py | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
--- a/Lib/test/test_posix.py
|
||||
+++ b/Lib/test/test_posix.py
|
||||
@@ -425,7 +425,7 @@ class PosixTester(unittest.TestCase):
|
||||
def test_posix_fadvise(self):
|
||||
fd = os.open(os_helper.TESTFN, os.O_RDONLY)
|
||||
try:
|
||||
- posix.posix_fadvise(fd, 0, 0, posix.POSIX_FADV_WILLNEED)
|
||||
+ posix.posix_fadvise(fd, 0, 0, posix.POSIX_FADV_RANDOM)
|
||||
finally:
|
||||
os.close(fd)
|
||||
|
||||
@@ -1,3 +1,107 @@
|
||||
-------------------------------------------------------------------
|
||||
Mon Jun 9 16:53:24 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Update to 3.10.18:
|
||||
- Security
|
||||
- gh-135034: Fixes multiple issues that allowed tarfile
|
||||
extraction filters (filter="data" and filter="tar") to be
|
||||
bypassed using crafted symlinks and hard links.
|
||||
Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
|
||||
(bsc#1244059), CVE-2025-4330 (bsc#1244060), and
|
||||
CVE-2025-4517 (bsc#1244032).
|
||||
- gh-133767: Fix use-after-free in the “unicode-escape”
|
||||
decoder with a non-“strict” error handler (CVE-2025-4516,
|
||||
bsc#1243273).
|
||||
- gh-128840: Short-circuit the processing of long IPv6
|
||||
addresses early in ipaddress to prevent excessive memory
|
||||
consumption and a minor denial-of-service.
|
||||
- Library
|
||||
- gh-128840: Fix parsing long IPv6 addresses with embedded
|
||||
IPv4 address.
|
||||
- gh-134062: ipaddress: fix collisions in __hash__() for
|
||||
IPv4Network and IPv6Network objects.
|
||||
- gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
|
||||
according to RFC 3596, §2.5. Patch by Bénédikt Tran.
|
||||
- bpo-43633: Improve the textual representation of
|
||||
IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
|
||||
in ipaddress. Patch by Oleksandr Pavliuk.
|
||||
- Remove upstreamed patches:
|
||||
- gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
|
||||
- CVE-2025-4516-DecodeError-handler.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu May 22 13:01:17 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Add CVE-2025-4516-DecodeError-handler.patch fixing
|
||||
CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
|
||||
vulnerability, which could lead to DoS.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Sat May 17 10:02:27 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Use extended %autopatch.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Sat May 10 11:38:22 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
|
||||
since kernel 3.6-rc1)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Apr 11 08:12:14 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Update to 3.10.17:
|
||||
- gh-131809: Update bundled libexpat to 2.7.1
|
||||
- gh-131261: Upgrade to libexpat 2.7.0
|
||||
- gh-105704: When using urllib.parse.urlsplit() and
|
||||
urllib.parse.urlparse() host parsing would not reject domain
|
||||
names containing square brackets ([ and ]). Square brackets
|
||||
are only valid for IPv6 and IPvFuture hosts according to RFC
|
||||
3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
|
||||
gh#python/cpython#105704).
|
||||
- gh-121284: Fix bug in the folding of rfc2047 encoded-words
|
||||
when flattening an email message using a modern email
|
||||
policy. Previously when an encoded-word was too long for
|
||||
a line, it would be decoded, split across lines, and
|
||||
re-encoded. But commas and other special characters in the
|
||||
original text could be left unencoded and unquoted. This
|
||||
could theoretically be used to spoof header lines using a
|
||||
carefully constructed encoded-word if the resulting rendered
|
||||
email was transmitted or re-parsed.
|
||||
- gh-80222: Fix bug in the folding of quoted strings
|
||||
when flattening an email message using a modern email
|
||||
policy. Previously when a quoted string was folded so that
|
||||
it spanned more than one line, the surrounding quotes and
|
||||
internal escapes would be omitted. This could theoretically
|
||||
be used to spoof header lines using a carefully constructed
|
||||
quoted string if the resulting rendered email was transmitted
|
||||
or re-parsed.
|
||||
- gh-119511: Fix a potential denial of service in the imaplib
|
||||
module. When connecting to a malicious server, it could
|
||||
cause an arbitrary amount of memory to be allocated. On many
|
||||
systems this is harmless as unused virtual memory is only
|
||||
a mapping, but if this hit a virtual address size limit
|
||||
it could lead to a MemoryError or other process crash. On
|
||||
unusual systems or builds where all allocated memory is
|
||||
touched and backed by actual ram or storage it could’ve
|
||||
consumed resources doing so until similarly crashing.
|
||||
- gh-127257: In ssl, system call failures that OpenSSL reports
|
||||
using ERR_LIB_SYS are now raised as OSError.
|
||||
- gh-121277: Writers of CPython’s documentation can now use
|
||||
next as the version for the versionchanged, versionadded,
|
||||
deprecated directives.
|
||||
- Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
|
||||
which makes test_ssl not to stop ThreadedEchoServer on OSError,
|
||||
which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
|
||||
gh#python/cpython!126572)
|
||||
- Remote upstreamed patch:
|
||||
- CVE-2025-0938-sq-brackets-domain-names.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Mar 10 15:44:31 UTC 2025 - Bernhard Wiedemann <bwiedemann@suse.com>
|
||||
|
||||
- Skip PGO with %want_reproducible_builds (bsc#1239210)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Feb 4 14:43:13 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
@@ -288,7 +392,7 @@ Fri Feb 23 01:06:42 UTC 2024 - Matej Cepl <mcepl@suse.com>
|
||||
Tue Feb 20 22:14:02 UTC 2024 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Remove double definition of /usr/bin/idle%%{version} in
|
||||
%%files.
|
||||
%%files.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Feb 15 10:29:07 UTC 2024 - Daniel Garcia <daniel.garcia@suse.com>
|
||||
|
||||
@@ -36,7 +36,7 @@
|
||||
%bcond_without general
|
||||
%endif
|
||||
|
||||
%if 0%{?do_profiling}
|
||||
%if 0%{?do_profiling} && !0%{?want_reproducible_builds}
|
||||
%bcond_without profileopt
|
||||
%else
|
||||
%bcond_with profileopt
|
||||
@@ -108,7 +108,7 @@ Obsoletes: python39%{?1:-%{1}}
|
||||
# _md5.cpython-38m-x86_64-linux-gnu.so
|
||||
%define dynlib() %{sitedir}/lib-dynload/%{1}.cpython-%{abi_tag}-%{archname}-%{_os}%{?_gnu}%{?armsuffix}.so
|
||||
Name: %{python_pkg_name}%{psuffix}
|
||||
Version: 3.10.16
|
||||
Version: 3.10.18
|
||||
Release: 0
|
||||
Summary: Python 3 Interpreter
|
||||
License: Python-2.0
|
||||
@@ -152,8 +152,6 @@ Patch02: distutils-reproducible-compile.patch
|
||||
Patch03: python-3.3.0b1-localpath.patch
|
||||
# replace DATE, TIME and COMPILER by fixed definitions to aid reproducible builds
|
||||
Patch04: python-3.3.0b1-fix_date_time_compiler.patch
|
||||
# POSIX_FADV_WILLNEED throws EINVAL. Use a different constant in test
|
||||
Patch05: python-3.3.0b1-test-posix_fadvise.patch
|
||||
# Raise timeout value for test_subprocess
|
||||
Patch06: subprocess-raise-timeout.patch
|
||||
# PATCH-FEATURE-UPSTREAM bpo-31046_ensurepip_honours_prefix.patch bpo#31046 mcepl@suse.com
|
||||
@@ -204,9 +202,6 @@ Patch27: gh120226-fix-sendfile-test-kernel-610.patch
|
||||
# PATCH-FIX-UPSTREAM sphinx-802.patch mcepl@suse.com
|
||||
# status_iterator method moved between the Sphinx versions
|
||||
Patch28: sphinx-802.patch
|
||||
# PATCH-FIX-UPSTREAM CVE-2025-0938-sq-brackets-domain-names.patch bsc#1236705 mcepl@suse.com
|
||||
# functions `urllib.parse.urlsplit` and `urlparse` accept domain names including square brackets
|
||||
Patch29: CVE-2025-0938-sq-brackets-domain-names.patch
|
||||
BuildRequires: autoconf-archive
|
||||
BuildRequires: automake
|
||||
BuildRequires: fdupes
|
||||
@@ -464,33 +459,15 @@ other applications.
|
||||
|
||||
%prep
|
||||
%setup -q -n %{tarname}
|
||||
%patch -p1 -P 01
|
||||
%patch -p1 -P 02
|
||||
%patch -p1 -P 03
|
||||
%patch -p1 -P 04
|
||||
%patch -p1 -P 05
|
||||
%patch -p1 -P 06
|
||||
%patch -p1 -P 07
|
||||
|
||||
%autopatch -p1 -M 07
|
||||
%if 0%{?sle_version} && 0%{?sle_version} <= 150300
|
||||
%patch -P 11 -p1
|
||||
%patch -p1 -P 11
|
||||
%endif
|
||||
|
||||
%patch -p1 -P 15
|
||||
%patch -p1 -P 16
|
||||
%patch -p1 -P 17
|
||||
%patch -p1 -P 18
|
||||
%patch -p1 -P 19
|
||||
|
||||
%autopatch -p1 -m 12 -M 20
|
||||
%if ! 0%{?sle_version} || 0%{?sle_version} >= 160000
|
||||
%patch -p1 -P 21
|
||||
%endif
|
||||
|
||||
%patch -p1 -P 22
|
||||
%patch -p1 -P 24
|
||||
%patch -p1 -P 27
|
||||
%patch -p1 -P 28
|
||||
%patch -p1 -P 29
|
||||
%autopatch -p1 -m 22
|
||||
|
||||
# drop Autoconf version requirement
|
||||
sed -i 's/^AC_PREREQ/dnl AC_PREREQ/' configure.ac
|
||||
|
||||
@@ -2944,7 +2944,7 @@
|
||||
string argument to :func:`eval` must have the following form:
|
||||
--- a/Doc/tools/extensions/pyspecific.py
|
||||
+++ b/Doc/tools/extensions/pyspecific.py
|
||||
@@ -623,6 +623,30 @@ def process_audit_events(app, doctree, f
|
||||
@@ -644,6 +644,30 @@ def process_audit_events(app, doctree, f
|
||||
node.replace_self(table)
|
||||
|
||||
|
||||
@@ -2975,7 +2975,7 @@
|
||||
def setup(app):
|
||||
app.add_role('issue', issue_role)
|
||||
app.add_role('gh', gh_issue_role)
|
||||
@@ -645,6 +669,7 @@ def setup(app):
|
||||
@@ -670,6 +694,7 @@ def setup(app):
|
||||
app.add_directive_to_domain('py', 'awaitablemethod', PyAwaitableMethod)
|
||||
app.add_directive_to_domain('py', 'abstractmethod', PyAbstractMethod)
|
||||
app.add_directive('miscnews', MiscNews)
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
--- a/Doc/tools/extensions/pyspecific.py
|
||||
+++ b/Doc/tools/extensions/pyspecific.py
|
||||
@@ -27,7 +27,13 @@ try:
|
||||
@@ -28,7 +28,13 @@ try:
|
||||
except ImportError:
|
||||
from sphinx.environment import NoUri
|
||||
from sphinx.locale import _ as sphinx_gettext
|
||||
|
||||
Reference in New Issue
Block a user