linux/poky.git/meta/recipes-devtools/python/python3, branch kirkstone

python3: upgrade 3.10.19 -> 3.10.20

2026-04-10T10:53:18+00:00

Drop upstreamed patches. Release information: * https://www.python.org/downloads/release/python-31020/ * The release you're looking at is Python 3.10.20, a security bugfix release for the legacy 3.10 series. Handles CVE-2024-6923 CVE-2025-6075 CVE-2025-12084 CVE-2025-13836 CVE-2025-13837 CVE-2025-15282 CVE-2025-59375 CVE-2026-0865 CVE-2026-24515 CVE-2026-25210 (From OE-Core rev: 51e1581d337b674272c1a71dfc366387577bc5df) Signed-off-by: Vijay Anusuri [YC: rebased on top of kirkstone] Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

python3: patch CVE-2025-12084

2026-02-27T15:54:01+00:00

Pick patch for this CVE merged into 3.10 branch. (From OE-Core rev: 8888cd14eb102574d530b6c683ce5beaad1aaa39) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

python3: patch CVE-2025-13837

2026-02-27T15:54:01+00:00

Pick patch from 3.12 branch per NVD report. (From OE-Core rev: cfbac1d5edae4b0204ec4c01b5f710d100ceb2ad) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

python3: fix CVE-2025-13836

2026-01-26T09:49:25+00:00

Upstream-Status: Backport from https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15 (From OE-Core rev: d3bcb5ded27003612ad591764f648e83e91c27ca) Signed-off-by: Hitendra Prajapati Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

python3: fix CVE-2025-6075

2025-12-01T14:50:49+00:00

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-6075 Upstream-patch: https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca (From OE-Core rev: 9a7f33d85355ffbe382aa175c04c64541e77b441) Signed-off-by: Praveen Kumar Signed-off-by: Steve Sakoman

python3: upgrade 3.10.18 -> 3.10.19

2025-10-24T13:47:20+00:00

Drop upstreamed patch and refresh remaining patches. Release information: * https://www.python.org/downloads/release/python-31019/ * The release you're looking at is Python 3.10.19, a security bugfix release for the legacy 3.10 series. Handles CVE-2025-59375, CVE-2025-47273 and CVE-2024-6345. (From OE-Core rev: 9b3dbd691f6ebdbdfe88cef3d3a676ddd1399c63) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: patch CVE-2025-8194

2025-08-18T20:18:01+00:00

Pick commit from 3.12 branch mentioned in NVD report. https://nvd.nist.gov/vuln/detail/CVE-2025-8194 (From OE-Core rev: 4ae9daf3d05530952a8b002257dd9afda2e077e4) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: upgrade 3.10.16 -> 3.10.18

2025-06-13T15:42:35+00:00

Drop upstreamed patch and refresh remaining patches. * https://www.python.org/downloads/release/python-31017/ Security content in this release * gh-131809: Upgrade vendored expat to 2.7.1 * gh-80222: Folding of quoted string in display_name violates RFC * gh-121284: Invalid RFC 2047 address header after refolding with email.policy.default * gh-131261: Update libexpat to 2.7.0 * gh-105704: CVE-2025-0938 urlparse does not flag hostname containing [ or ] as incorrect * gh-119511: OOM vulnerability in the imaplib module * https://www.python.org/downloads/release/python-31018/ Security content in this release * gh-135034: [CVE 2024-12718] [CVE 2025-4138] [CVE 2025-4330] [CVE 2025-4435] [CVE 2025-4517] Fixes multiple issues that allowed tarfile extraction filters (filter="data" and filter="tar") to be bypassed using crafted symlinks and hard links. * gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler. * gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service. gh-133767 got meawhile CVE-2025-4516 assigned. (From OE-Core rev: 838a8b5ca148dfa6c6c2c76f1705d1e358a31648) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: patch CVE-2025-0938

2025-04-01T16:02:41+00:00

Pick commit mentioned in NDV CVE report https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab which is on 3.10 branch. (From OE-Core rev: 70036b4ea0ab968adab82fc632bb967f95203de2) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: Treat UID/GID overflow as failure

2025-02-15T14:04:44+00:00

This fixes ptest failures on 32bit architectures AssertionError: Failed ptests: {'python3': ['test_extractall_none_gid', 'test_extractall_none_gname', 'test_extractall_none_mode', 'test_extractall_none_mtime', 'test_extractall_none_uid', 'test_extractall_none_uname', 'setUpClass', 'python3']} (From OE-Core rev: 838f3cff2a123fb7d5833b6760772ded6efb60bd) Signed-off-by: Khem Raj Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 43104b547cb79693c83df0882773ae8dd74b1d35) Signed-off-by: Haixiao Yan Signed-off-by: Steve Sakoman