- bpo#42988 (bsc#1183374) CVE-2021-3426: Remove the getfile
feature of the pydoc module which could be abused to read
arbitrary files on the disk (directory traversal
vulnerability). Moreover, even source code of Python modules
can contain sensitive data like passwords. Vulnerability
reported by David Schwörer.
- bpo-43285: ftplib no longer trusts the IP address value
returned from the server in response to the PASV command by
default. This prevents a malicious FTP server from using the
response to probe IPv4 address and port combinations on the
client network.
- Code that requires the former vulnerable behavior may set
a trust_server_pasv_ipv4_address attribute on their
ftplib.FTP instances to True to re-enable it.
- bpo-43439: Add audit hooks for gc.get_objects(),
gc.get_referrers() and gc.get_referents(). Patch by Pablo
Galindo.
- bpo-43660: Fix crash that happens when replacing sys.stderr
with a callable that can remove the object while an exception
is being printed. Patch by Pablo Galindo.
- bpo-35883: Python no longer fails at startup with a fatal
error if a command line argument contains an invalid Unicode
character. The Py_DecodeLocale() function now escapes byte
sequences which would be decoded as Unicode characters
outside the [U+0000; U+10ffff] range.
- bpo-43406: Fix a possible race condition where
PyErr_CheckSignals tries to execute a non-Python signal
handler.
- bpo-35930: Raising an exception raised in a “future” instance
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python38?expand=0&rev=62
- bpo#42938 (bsc#1181126): Avoid static buffers when computing
the repr of ctypes.c_double and ctypes.c_longdouble
values. This issue was assigned CVE-2021-3177.
- bpo#42967 (bso#1182379): Fix web cache poisoning
vulnerability by defaulting the query args separator to &,
and allowing the user to choose a custom separator. This
issue was assigned CVE-2021-23336.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python38?expand=0&rev=53
- Last try before this results in an editwar:
* remove importlib_resources and importlib-metadata
provides/obsoletes
* import importlib_resources is not the same as
import importlib.resources, same for metadata
* The backport packages from PyPI needed for older flavors are
specified as such for setuptools or in pyproject.toml. If a
package requires them they typically add them with a python
version qualifier and the packages have their own version
numbers.
OBS-URL: https://build.opensuse.org/request/show/854402
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python38?expand=0&rev=43
- Update to version 3.8.5:
- bpo-39603: Prevent http header injection by rejecting control characters in http.client.putrequest(…).
- bpo-41295: a regression in CPython 3.8.4 where defining “__setattr__” in a multi-inheritance setup and calling up the hierarchy chain could fail if builtins/extension types were involved in the base types.
- bpo-41288: Unpickling invalid NEWOBJ_EX opcode with the C implementation raises now UnpicklingError instead of crashing.
- bpo-39017: Avoid infinite loop when reading specially crafted TAR files using the tarfile module (CVE-2019-20907).
- bpo-37703: Updated Documentation to comprehensively elaborate on the behaviour of gather.cancel()
- bpo-41302: Enable building Python 3.8 with libmpdec-2.5.0 to ease maintenance for Linux distributions. Patch by Felix Yan.
- bpo-41300: Save files with non-ascii chars. Fix regression released in 3.9.0b4 and 3.8.4.
OBS-URL: https://build.opensuse.org/request/show/821971
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python38?expand=0&rev=21
- Assignment expressions (PEP-572)
- Positional-only parameters (PEP-570)
- Parallel filesystem cache for compiled bytecode files
(PYTHONPYCACHEPREFIX variable)
- Debug build uses the same ABI as release build
- f-strings support = for self-documenting expressions
and debugging
- Python Runtime Audit Hooks (PEP-578)
- Python Initialization Configuration (PEP-587)
- Vectorcall: a fast calling protocol for CPython (PEP-590)
- Pickle protocol 5 with out-of-band data buffers (PEP-574)
- Many other smaller bug fixes
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python38?expand=0&rev=16
for python interpreter
- Reduce some now unused conditionals
- Redux the -base dependencies to match up pre-merge layout
- Generate baselibs in pre-checkin too
- Generate the importlib-failed using pre_checking again
- Add back the information about skipped tests on the pre_checkin
output
- Use %python_pkg_name instead of hardcoding python3 where
applicable
- Sort out preamble with spec-cleaner
- Calculate required variables instead of relying on their continuous manual update
- Fix the -base module build again to generate only the deps
we need
- Replace OBS_dev-shm.patch with the upstream PR#20944
- Use the %{python_pkg_name} on more places to allow easier
multiversioning
- Switch to _multibuild approach for easier maintenance of this
package. All is now in one spec file with 3 conditionals:
* bcond_with base
* bcond_with doc
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python38?expand=0&rev=3
