summaryrefslogtreecommitdiffstats
path: root/meta-python/recipes-devtools/python
Commit message (Collapse)AuthorAgeFilesLines
* python3-django: fix CVE-2025-32873Saravanan2025-12-054-0/+219
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-32873 Upstream-patch: https://github.com/django/django/commit/9cd8028f3e38dca8e51c1388f474eecbe7d6ca3c/ Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2024-53907Saravanan2025-12-052-0/+125
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-53907 Upstream-patch: https://github.com/django/django/commit/790eb058b0716c536a2f2e8d1c6d5079d776c22b/ Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2024-41991Saravanan2025-12-052-0/+144
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41991 Upstream-patch: https://github.com/django/django/commit/efea1ef7e2190e3f77ca0651b5458297bc0f6a9f/ Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2024-39330Saravanan2025-11-304-0/+367
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-39330 Upstream-patch: https://github.com/django/django/commit/2b00edc0151a660d1eb86da4059904a0fc4e095e Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2024-39329Saravanan2025-11-304-0/+227
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-39329 Upstream-patch: https://github.com/django/django/commit/156d3186c96e3ec2ca73b8b25dc2ef366e38df14 Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2025-57833Saravanan2025-11-304-0/+207
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-57833 Upstream-patch: https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92 Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2024-56374Saravanan2025-11-304-0/+625
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-56374 Upstream-patch: https://github.com/django/django/commit/ad866a1ca3e7d60da888d25d27e46a8adb2ed36e Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2025-26699Saravanan2025-11-304-0/+217
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-26699 Upstream-patch: https://github.com/django/django/commit/e88f7376fe68dbf4ebaf11fad1513ce700b45860 Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2024-27351Saravanan2025-11-302-0/+150
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-27351 Upstream-patch: https://github.com/django/django/commit/072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: upgrade 4.2.17 -> 4.2.26Saravanan2025-11-303-14/+22
| | | | | | | | | | | | | | | | | | | | Fixes CVE-2025-64459, CVE-2025-64458, CVE-2025-59682, CVE-2025-59681, CVE-2025-57833, CVE-2025-48432, CVE-2025-32873, CVE-2025-26699, CVE-2024-56374 and other bug fixes. Release notes: https://docs.djangoproject.com/en/dev/releases/4.2.18/ https://docs.djangoproject.com/en/dev/releases/4.2.19/ https://docs.djangoproject.com/en/dev/releases/4.2.20/ https://docs.djangoproject.com/en/dev/releases/4.2.21/ https://docs.djangoproject.com/en/dev/releases/4.2.22/ https://docs.djangoproject.com/en/dev/releases/4.2.23/ https://docs.djangoproject.com/en/dev/releases/4.2.24/ https://docs.djangoproject.com/en/dev/releases/4.2.25/ https://docs.djangoproject.com/en/dev/releases/4.2.26/ Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: upgrade 3.2.23 -> 3.2.25Saravanan2025-11-301-2/+2
| | | | | | | | | | | Fixes CVE-2024-27351, CVE-2024-24680 and other bugfixes. Release notes: https://docs.djangoproject.com/en/dev/releases/3.2.24/ https://docs.djangoproject.com/en/dev/releases/3.2.25/ Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-behave: update SRC_URI branchGyorgy Sarvari2025-11-171-1/+1
| | | | | | Master branch was renamed to main. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-aiohttp: Fix CVE-2024-23829Soumya Sambu2025-11-072-0/+345
| | | | | | | | | | | | | | | | | | | | | | | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input. Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability. References: https://nvd.nist.gov/vuln/detail/CVE-2024-23829 https://security-tracker.debian.org/tracker/CVE-2024-23829 Upstream patch: https://github.com/aio-libs/aiohttp/commit/d33bc21414e283c9e6fe7f6caf69e2ed60d66c82 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-pillow: Fix CVE-2024-28219Soumya Sambu2025-11-072-0/+44
| | | | | | | | | | | | | | | In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. References: https://nvd.nist.gov/vuln/detail/CVE-2024-28219 https://security-tracker.debian.org/tracker/CVE-2024-28219 Upstream patch: https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-aspectlib: fix ptestsGyorgy Sarvari2025-11-022-0/+55
| | | | | | Backport patch that adapts failing tests. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-gunicorn: add patch work with geventletGyorgy Sarvari2025-10-272-1/+56
| | | | | | | | | | | python3-gunicorn depends on python3-geventlet. geventlet has made some breaking changes (which is part of meta-oe/kirkstone), however gunicorn wasn't adapted to this, and it broke some features (at least ptests). This patch backports the change that adapts gunicorn to the used version of geventlet. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-gevent: fix syntax error in cve patchGyorgy Sarvari2025-10-271-1/+1
| | | | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-pint: fix ptestsGyorgy Sarvari2025-10-272-6/+3
| | | | | | | | | | | | | | | 1. Add missing ptest dependency (pytest-subtest) 2. The testsuite is installed in both the site-packages and ${PTEST_PATH} folders, however some dependencies are only available in the site-packages folder, so many test cases fail. At this point of the branch lifecycle I decided not to refactor the recipe, but rather to just use the installation in the site-packages dir to run the tests (switch to that folder in the run-ptest script) 3. Fix the run-ptest script to output PASS/FAIL status. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-requests-toolbelt: disable tests with expired certificateGyorgy Sarvari2025-10-271-1/+1
| | | | | | | | | | | | | | | | The application ships with a self signed certificate as part of the test suite. Unfortunately this certificate has expired in 2021, and since then the tests refuse to use it, they just fail. Upstream has fixed this issue by refactoring these tests[1] not to use a vendored certificate, but rather to use the "python3-trustme" module - however this is not part of Kirkstone meta-oe, so that patch cannot be used. Due to this, disable these particular test cases. [1]: https://github.com/requests/toolbelt/commit/b93b4067ea1ded1e33959920ae5ff4163fdd6939 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-py-cpuinfo: fix ptestsGyorgy Sarvari2025-10-271-0/+1
| | | | | | | The tests require the library to be present in the folder of test execution, otherwise many of them fail. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-yarl: fix ptests (and make it compatible with current python)Gyorgy Sarvari2025-10-202-1/+140
| | | | | | | | | | | | | | | | oe-core currently ships with Python 3.10.18. Python 3.10.17 has introduced a change in urlparse library, regarding how brackets are handled by urllib.parse.urlsplit() and urlparse() functions (which makes it more conformant to the specification). This has caused a regression in yarl: some tests have failed, and it also revealed a bug in how yarl treates brackets. This backported patch corrects this behavior, making it compatible once again with the current Python version - and it also allows the the ptests to pass once again. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-betamax: fix ptestsGyorgy Sarvari2025-10-204-0/+93
| | | | | | | | | | | | | | 1. Some tests require internet access. Set a DNS for that, if it is not available at the start of the test. 2. Added a backported patch that fixes some failing tests, due to a variable header value contained in a response. (fix-failing-ptest.patch) 3. Added a backported patch that avoids calling pytest fixtures directly. If not applied, tests calling them are marked as failing by pytest. (fix-direct-calls-to-test-fixtures.patch) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-soupsieve: fix ptestsGyorgy Sarvari2025-10-202-0/+163
| | | | | | | | | | Some ptests have started to fail, due to a change in libxml 2.9.12 (oe-core ships with 2.9.14 currently). See upstream issue: https://github.com/facelessuser/soupsieve/issues/220 This backported patch solves this issue. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-typeguard: update ptest dependenciesDerek Straka2025-10-201-0/+1
| | | | | | | | | | Signed-off-by: Derek Straka <derek@asterius.io> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit bb8e0534be8349e73b069a63739e965e9442934e) Adapted to Kirkstone. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-ujson: fix run-ptest scriptGyorgy Sarvari2025-10-201-1/+1
| | | | | | | | | The current script doesn't execute any tests. This patch fixes the run-ptest script. This is mostly a backport of e183db0c8f0b6ef605731769aeefed3e4f0a0093. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-whoosh: Fix an intermittent ptestKhem Raj2025-10-202-0/+31
| | | | | | | | It fails sometimes when system is under stress Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 38e2f6a9a94463916d2c4ea5d08f1a554e337f28) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-twisted: Fix CVE-2023-46137Soumya Sambu2025-09-182-1/+198
| | | | | | | | | | | | | | | | | | | | Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2023-46137 https://security-tracker.debian.org/tracker/CVE-2023-46137 Upstream patch: https://github.com/twisted/twisted/commit/1e6e9d23cac59689760558dcb6634285e694b04c Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-twisted: Fix CVE-2024-41810Soumya Sambu2025-09-182-1/+111
| | | | | | | | | | | | | | | | | Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41810 Upstream patch: https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-protobuf: patch CVE-2025-4565Peter Marko2025-09-062-0/+379
| | | | | | | | | This CVE fix was added to protobuf recipe but since it's patching python code, it should have been submitted to python3-protobuf. Take the patch from protobuf recipe and adapt to python3-protobuf. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-aiohttp: fix CVE-2025-53643 and drop CVE-2024-42367 patchJiaying Song2025-09-063-66/+198
| | | | | | | | | | | | | | | | | | | | | | | | | | - Fix CVE-2025-53643: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-53643 - Drop CVE-2024-42367.patch: According to upstream discussion and advisory [1][2], aiohttp 3.8.6 is not affected by CVE-2024-42367, and the patch is therefore no longer needed. [1] https://github.com/advisories/GHSA-jwhx-xcg6-8xhj [2] https://github.com/aio-libs/aiohttp/issues/11149 Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-protobuf: fix RDEPENDSChen Qi2025-07-021-0/+1
| | | | | | | python3-ctypes is needed as a runtime dependency. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-aiohttp: fix CVE-2024-42367Jiaying Song2025-07-022-0/+66
| | | | | | | | | | | | | | | | | | | | | | | | | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-42367 https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhj Upstream patch: https://github.com/aio-libs/aiohttp/commit/ce2e9758814527589b10759a20783fb03b98339f Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-twisted: Fix CVE-2024-41671Soumya Sambu2025-05-253-0/+232
| | | | | | | | | | | | | | | | | | Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1. References: https://nvd.nist.gov/vuln/detail/CVE-2024-41671 https://ubuntu.com/security/CVE-2024-41671 Upstream patches: https://github.com/twisted/twisted/commit/f1cb4e616e9f23b4dd044a6db44365060950c64f https://github.com/twisted/twisted/commit/ef2c755e9e9d57d58132af790bd2fd2b957b3fb1 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-grpcio(-tools): fix build concurrency issuePeter Marko2025-03-062-0/+8
| | | | | | | | | | | | | | | | | | | Set GRPC_PYTHON_BUILD_EXT_COMPILER_JOBS to limit spawned compiler processes. Without this it uses all available CPUs (via multiprocessing.cpu_count()) and can exhaust build host since there are lot of files to compile (e.g. with 128 cores it manages to spawn 128 gcc processes) Note that this is a general problem for all setuptools based builds with build_ext compilation which can either compile with 1 thread or cpu_count threads. grpcio hot-patches setuptools and allows to set specific build concurrency value. (From master rev: fe582374d3ba474164005942799eb2bddc52a080) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-future: upgrade 0.18.2 -> 0.18.3Wang Mingyu2025-03-061-2/+1
| | | | | | | | | | | | Full changelog: https://github.com/PythonCharmers/python-future/releases (cherry-picked from a10bda8c873e66f0d895cf8065cbc076b2055655) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-h5py: add -Wno-error to allow building native with gcc-14 on hostMartin Jansa2025-02-091-0/+4
| | | | | Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-sqlparse: Fix CVE-2024-4340Soumya Sambu2025-01-222-0/+49
| | | | | | | | | | | | | | Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-4340 Upstream-patch: https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-53907Soumya Sambu2025-01-222-0/+93
| | | | | | | | | | | | | | | | An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-53907 Upstream-patch: https://github.com/django/django/commit/790eb058b0716c536a2f2e8d1c6d5079d776c22b Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-45231Soumya Sambu2025-01-222-0/+121
| | | | | | | | | | | | | | | | | An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing). Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-45231 Upstream-patch: https://github.com/django/django/commit/bf4888d317ba4506d091eeac6e8b4f1fcc731199 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-45230Soumya Sambu2025-01-222-0/+138
| | | | | | | | | | | | | | | | An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-45230 Upstream-patch: https://github.com/django/django/commit/d147a8ebbdf28c17cafbbe2884f0bc57e2bf82e2 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-41991Soumya Sambu2025-01-222-0/+123
| | | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41991 Upstream-patch: https://github.com/django/django/commit/efea1ef7e2190e3f77ca0651b5458297bc0f6a9f Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-41990Soumya Sambu2025-01-222-0/+70
| | | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41990 Upstream-patch: https://github.com/django/django/commit/d0a82e26a74940bf0c78204933c3bdd6a283eb88 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-41989Soumya Sambu2025-01-225-0/+238
| | | | | | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41989 Upstream-patches: https://github.com/django/django/commit/08c5a787262c1ae57f6517d4574b54a5fcaad124 https://github.com/django/django/commit/4b066bde692078b194709d517b27e55defae787c https://github.com/django/django/commit/dcd974698301a38081c141ccba6dcafa5ed2c80e https://github.com/django/django/commit/fc76660f589ac07e45e9cd34ccb8087aeb11904b Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-39614Soumya Sambu2025-01-222-0/+139
| | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-39614 Upstream-patch: https://github.com/django/django/commit/17358fb35fb7217423d4c4877ccb6d1a3a40b1c3 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2023-23969Soumya Sambu2025-01-222-0/+109
| | | | | | | | | | | | | | | | In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large. References: https://nvd.nist.gov/vuln/detail/CVE-2023-23969 Upstream-patch: https://github.com/django/django/commit/c7e0151fdf33e1b11d488b6f67b94fdf3a30614a Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 4.2.15 -> 4.2.17Soumya Sambu2025-01-221-2/+2
| | | | | | | | | | | | Fixes CVE-2024-45230, CVE-2024-45231, CVE-2024-53907 and CVE-2024-53908 Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.16/ https://docs.djangoproject.com/en/dev/releases/4.2.17/ Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-38875Soumya Sambu2025-01-222-0/+162
| | | | | | | | | | | | | | | | An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets. References: https://nvd.nist.gov/vuln/detail/CVE-2024-38875 https://github.com/advisories/GHSA-qg2p-9jwr-mmqf Upstream-patch: https://github.com/django/django/commit/79f368764295df109a37192f6182fb6f361d85b5 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-werkzeug: Fix CVE-2024-49767Soumya Sambu2024-12-312-1/+89
| | | | | | | | | | | | | | | | | | | | Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-49767 Upstream-patch: https://github.com/pallets/werkzeug/commit/8760275afb72bd10b57d92cb4d52abf759b2f3a7 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-werkzeug: Fix CVE-2024-34069Soumya Sambu2024-12-313-1/+272
| | | | | | | | | | | | | | | | | | | | | Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-34069 Upstream-patches: https://github.com/pallets/werkzeug/commit/71b69dfb7df3d912e66bab87fbb1f21f83504967 https://github.com/pallets/werkzeug/commit/890b6b62634fa61224222aee31081c61b054ff01 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-aiohttp: fix ↵Jiaying Song2024-12-086-0/+855
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2023-49081/CVE-2024-30251/CVE-2024-52304/CVE-2023-49082/CVE-2024-27306 CVE-2023-49081: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0. References: https://nvd.nist.gov/vuln/detail/CVE-2023-49081 Upstream patches: https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b CVE-2024-30251: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions. References: https://nvd.nist.gov/vuln/detail/CVE-2024-30251 Upstream patches: https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19 https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597 https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866 CVE-2024-52304: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue. References: https://nvd.nist.gov/vuln/detail/CVE-2024-52304 Upstream patches: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71 CVE-2023-49082: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0. References: https://nvd.nist.gov/vuln/detail/CVE-2023-49082 Upstream patches: https://github.com/aio-libs/aiohttp/pull/7806/commits/a43bc1779892e7014b7723c59d08fb37a000955e CVE-2024-27306: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade. References: https://nvd.nist.gov/vuln/detail/CVE-2024-27306 Upstream patches: https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397 Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-16 03:47:44 +0000