linux/poky.git/meta/recipes-devtools/python, branch dunfell-23.0.29

python3: update to 3.8.18

2023-10-04T15:17:51+00:00

https://docs.python.org/release/3.8.18/whatsnew/changelog.html#changelog Release date: 2023-08-24 Security gh-108310: Fixed an issue where instances of ssl.SSLSocket were vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and treating sent unencrypted data as if it were post-handshake TLS encrypted data. Security issue reported as CVE-2023-40217 by Aapo Oksman. Patch by Gregory P. Smith. Library gh-107845: tarfile.data_filter() now takes the location of symlinks into account when determining their target, so it will no longer reject some valid tarballs with LinkOutsideDestinationError. Tools/Demos gh-107565: Update multissltests and GitHub CI workflows to use OpenSSL 1.1.1v, 3.0.10, and 3.1.2. (From OE-Core rev: 9205496344bede4a16372ca7a02c2819a976640b) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

python3: ignore CVE-2023-36632

2023-08-16T13:55:12+00:00

This CVE shouldn't have been filed as the "exploit" is described in the documentation as how the library behaves. (From OE-Core rev: b66a677b76c7f15eb5c426f8dc7ac42e1e2e3f40) Signed-off-by: Ross Burton Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit c652f094d86c4efb7ff99accba63b8169493ab18) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: fix CVE-2023-24329 urllib.parse url blocklisting bypass

2023-07-23T02:24:17+00:00

(From OE-Core rev: 307f23e066e06793ec60f0cddf8ff1c64c02d834) Signed-off-by: Vivek Kumbhar Signed-off-by: Steve Sakoman

python3: upgrade to 3.8.17

2023-07-12T15:13:58+00:00

License-Update: update year to 2023 https://github.com/python/cpython/commit/30afa75ad8deca57a2bd0218f8fd6b3437c89507 Release Notes for 3.8.15: Security content in this release CVE-2022-40674: bundled libexpat was upgraded from 2.4.7 to 2.4.9 which fixes a heap use-after-free vulnerability in function doContent gh-97616: a fix for a possible buffer overflow in list *= int gh-97612: a fix for possible shell injection in the example script get-remote-certificate.py (this issue originally had a CVE assigned to it, which its author withdrew) gh-96577: a fix for a potential buffer overrun in msilib https://www.python.org/downloads/release/python-3815/ Release Notes for 3.8.16: Security content in this release gh-98739: Updated bundled libexpat to 2.5.0 to fix CVE-2022-43680 (heap use-after-free). gh-98517: Port XKCP’s fix for the buffer overflows in SHA-3 to fix CVE-2022-37454. gh-98433: The IDNA codec decoder used on DNS hostnames by socket or asyncio related name resolution functions no longer involves a quadratic algorithm to fix CVE-2022-45061. This prevents a potential CPU denial of service if an out-of-spec excessive length hostname involving bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects potentially allow for an attacker to supply such a name. gh-68966: The deprecated mailcap module now refuses to inject unsafe text (filenames, MIME types, parameters) into shell commands to address CVE-2015-20107. Instead of using such text, it will warn and act as if a match was not found (or for test commands, as if the test failed). gh-100001: python -m http.server no longer allows terminal control characters sent within a garbage request to be printed to the stderr server log. gh-87604: Avoid publishing list of active per-interpreter audit hooks via the gc module. https://www.python.org/downloads/release/python-3816/ Release Notes for 3.8.17: Security content in this release gh-103142: The version of OpenSSL used in Windows and Mac installers has been upgraded to 1.1.1u to address CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464, as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 fixed previously in 1.1.1t (gh-101727). gh-102153: urllib.parse.urlsplit() now strips leading C0 control and space characters following the specification for URLs defined by WHATWG in response to CVE-2023-24329. gh-99889: Fixed a security in flaw in uu.decode() that could allow for directory traversal based on the input if no out_file was specified. gh-104049: Do not expose the local on-disk location in directory indexes produced by http.client.SimpleHTTPRequestHandler. gh-103935: trace.__main__ now uses io.open_code() for files to be executed instead of raw open(). gh-101283: subprocess.Popen now uses a safer approach to find cmd.exe when launching with shell=True. gh-102953: The extraction methods in tarfile, and shutil.unpack_archive(), have a new filter argument that allows limiting tar features than may be surprising or dangerous, such as creating files outside the destination directory. See Extraction filters for details. https://www.python.org/downloads/release/python-3817/ (From OE-Core rev: 01a1f016a6558566a36098a993adaf4b40e30c78) Signed-off-by: Chee Yang Lee Signed-off-by: Steve Sakoman

python3: fix packaging of Windows distutils installer stubs

2023-02-13T07:44:09+00:00

The python3 Windows distutils installer stubs were split into a separate package in poky commit dc1ab6482cfb30c714e7cbb421920943439a3fd6. This has regressed during the upgrade to Python 3.8.2 in yocto-3.1 [YOCTO #13889] https://bugzilla.yoctoproject.org/show_bug.cgi?id=13889 (From OE-Core rev: 4f069121ddb99bb6e2f186724cd60ca07f74f503) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: Fix CVE-2022-37454

2022-12-23T23:05:44+00:00

Add below patch to fix CVE-2022-37454 CVE-2022-37454.patch Link: https://security-tracker.debian.org/tracker/CVE-2022-37454 Link: https://github.com/python/cpython/commit/948c6794711458fd148a3fa62296cadeeb2ed631 (From OE-Core rev: 6a8ef6cc3604008860dcb6aa5d7155b914d7c391) Signed-off-by: Pawan Badganchi Signed-off-by: pawan Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: Fix CVE-2022-45061

2022-12-07T15:06:36+00:00

Fix CVE-2022-45061, referenced as https://github.com/python/cpython/issues/98433 patch taken from https://github.com/python/cpython/pull/99231/commits/064ec20bf7a181ba5fa961aaa12973812aa6ca5d (From OE-Core rev: 4498ca9a299bd5d9a7173ec67daf17cb66b6d286) Signed-off-by: Omkar Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.13 -> 3.8.14

2022-10-27T15:54:43+00:00

Security and bug fixes. * Drop CVE-2021-28861.patch as it was merged in 3.8.14 release. Fixes: * CVE-2020-10735 https://nvd.nist.gov/vuln/detail/CVE-2020-10735 * CVE-2021-28861 https://nvd.nist.gov/vuln/detail/CVE-2021-28861 * CVE-2018-25032 https://nvd.nist.gov/vuln/detail/CVE-2018-25032 Python 3.8.14 Release Date: Sept. 6, 2022 This is a security release of Python 3.8 Note: The release you're looking at is Python 3.8.14, a security bugfix release for the legacy 3.8 series. Python 3.10 is now the latest feature release series of Python 3. Security content in this release CVE-2020-10735: converting between int and str in bases other than 2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now raises a ValueError if the number of digits in string form is above a limit to avoid potential denial of service attacks due to the algorithmic complexity. gh-87389: http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. gh-93065: Fix contextvars HAMT implementation to handle iteration over deep trees to avoid a potential crash of the interpreter. gh-90355: Fix ensurepip environment isolation for the subprocess running pip. gh-80254: Raise ProgrammingError instead of segfaulting on recursive usage of cursors in sqlite3 converters. (From OE-Core rev: 25fafd35a4698daa0d4abb814a91601e68223128) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: Fix CVE-2021-28861 for python3

2022-09-16T16:53:28+00:00

Add patch to fix CVE-2021-28861 CVE-2021-28861.patch Link: https://github.com/python/cpython/commit/4dc2cae3abd75f386374d0635d00443b897d0672 (From OE-Core rev: cbf57b25c78ea9d56863d9546b51fc2c88adb8cf) Signed-off-by: Riyaz Khan Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python-pip: CVE-2021-3572 Incorrect handling of unicode separators in git references

2022-06-24T22:57:45+00:00

Source: https://github.com/pypa/pip MR: 113864 Type: Security Fix Disposition: Backport from https://github.com/pypa/pip/commit/e46bdda9711392fec0c45c1175bae6db847cb30b ChangeID: 717948e217d6219d1f03afb4d984342d7dea4636 Description: CVE-2021-3572 python-pip: Incorrect handling of unicode separators in git references. (From OE-Core rev: 841a8fb5b6351f79a4d756232a544d1a6480c562) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie