linux/poky.git/meta/recipes-devtools/python/python3, branch yocto-3.1.15

python3: Add a fix for a make install race

2021-10-23T22:14:17+00:00

Add a fix for reproducibility issues where pyc files for python-config.py may not always be generated. (From OE-Core rev: 917f800368c6d452670d3ccf74057afae98013b0) Signed-off-by: Richard Purdie (cherry picked from commit d1c3a87c48b598b6e5624d0affe8bd89320631bf) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: skip tests requiring tools-sdk

2021-07-10T21:46:19+00:00

Conditionally skip test_ctypes.test_find unless IMAGE_FEATURES contains 'tools-sdk' as these test cases require full packagegroup-core-buildessential Fixes: AssertionError: Failed ptests: {'python3': ['test_find_library_with_gcc', 'test_find_library_with_ld']} (From OE-Core rev: 63bc36dbd93c46be8adf7db00e3fc22897eb1846) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.8 -> 3.8.9

2021-07-02T06:44:59+00:00

Release Date: April 2, 2021 Note: The release you're looking at is Python 3.8.9, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. * Refresh test_local.py patch for upstream changes * Add DEPENDS on autoconf-archive: - bpo-43617: Improve configure.ac: Check for presence of autoconf-archive package and remove our copies of M4 macros. References: https://www.python.org/downloads/release/python-389/ https://docs.python.org/release/3.8.9/whatsnew/changelog.html#python-3-8-9 https://bugs.python.org/issue43617 (From OE-Core rev: fe037d895e045c5de7ea834c38d09a1c08d8b8a2) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.7 -> 3.8.8

2021-07-02T06:44:59+00:00

Release Date: Feb. 19, 2021 Note: The release you're looking at is Python 3.8.8, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. Notable changes in Python 3.8.8 Earlier Python versions allowed using both ; and & as query parameter separators in urllib.parse.parse_qs() and urllib.parse.parse_qsl(). Due to security concerns, and to conform with newer W3C recommendations, this has been changed to allow only a single separator key, with & as the default. This change also affects cgi.parse() and cgi.parse_multipart() as they use the affected functions internally. For more details, please see their respective documentation. (Contributed by Adam Goldschmidt, Senthil Kumaran and Ken Jin in bpo-42967.) License-Update: update copyright years Drop patches fixed in 3.8.8: - CVE-2021-3177 Fixes: CVE: CVE-2021-3426 CVE: CVE-2021-23336 References: https://www.python.org/downloads/release/python-388/ https://docs.python.org/release/3.8.8/whatsnew/changelog.html#changelog https://docs.python.org/3/whatsnew/3.8.html#notable-changes-in-python-3-8-8 https://nvd.nist.gov/vuln/detail/CVE-2021-3177 https://nvd.nist.gov/vuln/detail/CVE-2021-3426 (From OE-Core rev: fdfc3340b58e1af0c231eedaa07358f7d9c6483e) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.6 -> 3.8.7

2021-07-02T06:44:59+00:00

Release Date: Dec. 21, 2020 Note: The release you're looking at is Python 3.8.7, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. * Drop patch for CVE-2020-27619 fixed in 3.8.7 References: https://nvd.nist.gov/vuln/detail/CVE-2020-27619 https://www.python.org/downloads/release/python-387/ https://docs.python.org/release/3.8.7/whatsnew/changelog.html (From OE-Core rev: a90dde9b1800acf364fa272177945e0a4cbf6560) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.4 -> 3.8.5

2021-07-02T06:44:59+00:00

Release Date: July 20, 2020 Note: The release you're looking at is Python 3.8.5, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. Drop patches fixed in 3.8.5: - CVE-2019-20907 - CVE-2019-26116 References: https://nvd.nist.gov/vuln/detail/CVE-2019-20907 https://nvd.nist.gov/vuln/detail/CVE-2020-26116 https://www.python.org/downloads/release/python-385/ https://docs.python.org/release/3.8.5/whatsnew/changelog.html#changelog (From OE-Core rev: c68cc11071cfa49d9d986bf7a9e6e1dfff514a39) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.3 -> 3.8.4

2021-07-02T06:44:59+00:00

Release Date: July 13, 2020 Note: The release you're looking at is Python 3.8.4, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. * Drop patch for CVE-2020-14422 fixed in 3.8.4 * Refresh CVE-2021-23336 patch References: https://nvd.nist.gov/vuln/detail/CVE-2020-14422 https://www.python.org/downloads/release/python-384/ https://docs.python.org/release/3.8.4/whatsnew/changelog.html#changelog (From OE-Core rev: c2c6df391a2634e83930219d1b574dbf64066d8a) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.2 -> 3.8.3

2021-07-02T06:44:59+00:00

Release Date: May 13, 2020 Note: The release you're looking at is Python 3.8.3, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. Notable changes in Python 3.8.3: The constant values of future flags in the __future__ module are updated in order to prevent collision with compiler flags. Previously PyCF_ALLOW_TOP_LEVEL_AWAIT was clashing with CO_FUTURE_DIVISION. (Contributed by Batuhan Taskaya in bpo-39562) * Drop patch for CVE-2020-3492 fixed since 3.8.1 References: https://nvd.nist.gov/vuln/detail/CVE-2020-8492 https://www.python.org/downloads/release/python-383/ https://docs.python.org/release/3.8.3/whatsnew/changelog.html#changelog (From OE-Core rev: 2aec1b2b679d607f3b7760b87403aa39465cc1b7) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

Revert "python3: fix CVE-2021-23336"

2021-06-20T08:44:11+00:00

Causes build failures on autobuilder This reverts commit 8a59c47ce4c101b2470a06ecf101ca5ab7d1f82e. Signed-off-by: Richard Purdie

python3: fix CVE-2021-23336

2021-06-19T15:59:29+00:00

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. References: https://nvd.nist.gov/vuln/detail/CVE-2021-23336 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336 (From OE-Core rev: 8a59c47ce4c101b2470a06ecf101ca5ab7d1f82e) Signed-off-by: Lee Chee Yang Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie