python-interpreters/python315
SHA256
7
0
Fork 0
forked from pool/python315
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Remove unnecessary patch and note that the bug has been already fixed.

Browse Source
This commit is contained in:
Matej Cepl
2025-11-13 14:32:39 +01:00
parent 8825dfe9e6
commit b563206f1a
3 changed files with 2 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
python315.changes
View File

@@ -3,17 +3,6 @@ Mon Nov 10 10:01:37 UTC 2025 - Andreas Schwab <schwab@suse.de>
- Update list of skipped tests in qemu linux-user emulation
-------------------------------------------------------------------
Thu Nov 6 23:45:56 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
- Add CVE-2025-8291-consistency-zip64.patch which checks
consistency of the zip64 end of central directory record, and
preventing obfuscation of the payload, i.e., you scanning for
malicious content in a ZIP file with one ZIP parser (let's say
a Rust one) then unpack it in production with another (e.g.,
the Python one) and get malicious content that the other parser
did not see (CVE-2025-8291, bsc#1251305)
-------------------------------------------------------------------
Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
@@ -89,7 +78,8 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
- Security
- gh-139700: Check consistency of the zip64 end of central
directory record. Support records with “zip64 extensible
data” if there are no bytes prepended to the ZIP file.
data” if there are no bytes prepended to the ZIP file
(bsc#1251305, CVE-2025-8291).
- gh-139400: xml.parsers.expat: Make sure that parent
Expat parsers are only garbage-collected once they
are no longer referenced by subparsers created by