linux/poky.git/meta/recipes-devtools/python/files, branch dunfell-23.0.29

python3: upgrade to 3.8.17

2023-07-12T15:13:58+00:00

License-Update: update year to 2023 https://github.com/python/cpython/commit/30afa75ad8deca57a2bd0218f8fd6b3437c89507 Release Notes for 3.8.15: Security content in this release CVE-2022-40674: bundled libexpat was upgraded from 2.4.7 to 2.4.9 which fixes a heap use-after-free vulnerability in function doContent gh-97616: a fix for a possible buffer overflow in list *= int gh-97612: a fix for possible shell injection in the example script get-remote-certificate.py (this issue originally had a CVE assigned to it, which its author withdrew) gh-96577: a fix for a potential buffer overrun in msilib https://www.python.org/downloads/release/python-3815/ Release Notes for 3.8.16: Security content in this release gh-98739: Updated bundled libexpat to 2.5.0 to fix CVE-2022-43680 (heap use-after-free). gh-98517: Port XKCP’s fix for the buffer overflows in SHA-3 to fix CVE-2022-37454. gh-98433: The IDNA codec decoder used on DNS hostnames by socket or asyncio related name resolution functions no longer involves a quadratic algorithm to fix CVE-2022-45061. This prevents a potential CPU denial of service if an out-of-spec excessive length hostname involving bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects potentially allow for an attacker to supply such a name. gh-68966: The deprecated mailcap module now refuses to inject unsafe text (filenames, MIME types, parameters) into shell commands to address CVE-2015-20107. Instead of using such text, it will warn and act as if a match was not found (or for test commands, as if the test failed). gh-100001: python -m http.server no longer allows terminal control characters sent within a garbage request to be printed to the stderr server log. gh-87604: Avoid publishing list of active per-interpreter audit hooks via the gc module. https://www.python.org/downloads/release/python-3816/ Release Notes for 3.8.17: Security content in this release gh-103142: The version of OpenSSL used in Windows and Mac installers has been upgraded to 1.1.1u to address CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464, as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 fixed previously in 1.1.1t (gh-101727). gh-102153: urllib.parse.urlsplit() now strips leading C0 control and space characters following the specification for URLs defined by WHATWG in response to CVE-2023-24329. gh-99889: Fixed a security in flaw in uu.decode() that could allow for directory traversal based on the input if no out_file was specified. gh-104049: Do not expose the local on-disk location in directory indexes produced by http.client.SimpleHTTPRequestHandler. gh-103935: trace.__main__ now uses io.open_code() for files to be executed instead of raw open(). gh-101283: subprocess.Popen now uses a safer approach to find cmd.exe when launching with shell=True. gh-102953: The extraction methods in tarfile, and shutil.unpack_archive(), have a new filter argument that allows limiting tar features than may be surprising or dangerous, such as creating files outside the destination directory. See Extraction filters for details. https://www.python.org/downloads/release/python-3817/ (From OE-Core rev: 01a1f016a6558566a36098a993adaf4b40e30c78) Signed-off-by: Chee Yang Lee Signed-off-by: Steve Sakoman

python3: Fix CVE-2022-45061

2022-12-07T15:06:36+00:00

Fix CVE-2022-45061, referenced as https://github.com/python/cpython/issues/98433 patch taken from https://github.com/python/cpython/pull/99231/commits/064ec20bf7a181ba5fa961aaa12973812aa6ca5d (From OE-Core rev: 4498ca9a299bd5d9a7173ec67daf17cb66b6d286) Signed-off-by: Omkar Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: fix CVE-2019-20907

2020-12-18T14:20:19+00:00

- move fixing patch for CVE-2020-8492 to the right location (From OE-Core rev: f7e7378ea7099af8555de809787cf8e2cb5208fd) Signed-off-by: Andrej Valek Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: fix CVE-2020-8492

2020-05-07T12:03:30+00:00

CVE: CVE-2020-8492 (From OE-Core rev: c9ee462bb606b34ab31cfb90f84a5302d15135cf) Signed-off-by: Trevor Gamblin Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3-setuptools: upgrade 45.0.0 -> 45.2.0

2020-02-28T23:11:28+00:00

(From OE-Core rev: 9c256927141deadebb0cf3e6c83e6a76b9f0c4b0) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

python3-setuptools: upgrade 42.0.2 -> 45.0.0

2020-02-03T13:03:32+00:00

(From OE-Core rev: ed1d8e2db0d3b5c60ce83ccebb7f0f7ac36f243a) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

python3-setuptools: upgrade 40.0.0 -> 40.8.0

2019-02-20T21:22:49+00:00

(From OE-Core rev: dceac54e05bb786e19de8db33982a8d54e41a915) Signed-off-by: Richard Purdie

distutils/setuptools-native, distutils3/setuptools3-native: do not try to fetch code during do_compile

2018-07-26T12:16:40+00:00

If a python recipe is using setuptools and the setup_requires argument, where setuptools will use easy_install to fetch the module if it isn't present. The build failed on a machine where a proxy was required, but succeeded on a machine which had direct access to the internet Add var-NO_FETCH_BUILD, and set it in distutils_do_compile which does not allow to fetch code from internet during do_compile. Example result: ... ERROR: Do not try to fetch `pytest-runner1' for building. Please add its native recipe to DEPENDS. Traceback (most recent call last): File "setup.py", line 56, in ... The improvement is flexible for test_requirements argument (used at `setup.py test'), where use easy_install also. [YOCTO #12084] (From OE-Core rev: 57414f4a1c549e6faaa110e6e95ff601b05b7361) Signed-off-by: Hongxu Jia Signed-off-by: Ross Burton Signed-off-by: Richard Purdie