linux/poky.git/meta/recipes-devtools/python, branch kirkstone-4.0.18

python3-urllib3: update to v1.26.18

2024-04-05T14:23:59+00:00

https://github.com/urllib3/urllib3/releases/tag/1.26.18 Major changes in python3-urllib3 1.26.18: - Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses. (CVE-2023-45803) (cherry picked from OE-Core rev: 74da05b63634c248910594456dae286947f33da5) (From OE-Core rev: c473f32184ea0ab41f6eb4c8dcc1d7bb5fd7b16f) Signed-off-by: Tan Wen Yan Signed-off-by: Steve Sakoman Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

python3-cryptography: Backport fix for CVE-2024-26130

2024-03-25T14:11:25+00:00

Upstream-Status: Backport from https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55 (From OE-Core rev: 7864c4605cde4851df644dd1d2867bd28d155710) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

python3-pycryptodome: Fix CVE-2023-52323

2024-02-15T13:51:57+00:00

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. References: https://security-tracker.debian.org/tracker/CVE-2023-52323 https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst (From OE-Core rev: 04c9b6b081914005209bac8eeb9f417e7b989cca) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman

python3-jinja2: upgrade 3.1.2 -> 3.1.3

2024-02-07T13:30:05+00:00

Changelog: ========== -Fix compiler error when checking if required blocks in parent templates are empty. -xmlattr filter does not allow keys with spaces. -Make error messages stemming from invalid nesting of {% trans %} blocks more helpful (cherry picked from OE-Core rev: 8a0524464583d69df7746253f5020c2c125a8e1f) (From OE-Core rev: 0f0dcf520505d809599a63961ecb5b1e74053b24) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

python3-jinja2: upgrade 3.1.1 -> 3.1.2

2024-02-07T13:30:05+00:00

(cherry picked from OE-Core rev: 1e58fa1fff649a4ab07290d2b0e5a8d69d51ef16) (From OE-Core rev: 90960bdef877c5dc03cc2cb03c77139d6d1e2f8f) Signed-off-by: Alexander Kanavin Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

python3-ptest: skip test_storlines

2023-12-23T02:36:55+00:00

[YOCTO #14933] test_storlines is yet another Python ptest that fails intermittently on the Yocto AB, so disable it during ptests for now. (From OE-Core rev: b71d5ec10f8e64fc6102c66dfc36151f2b0b3c86) Signed-off-by: Trevor Gamblin Signed-off-by: Alexandre Belloni (cherry picked from commit d7b9f8157e6214a83b5495e8a32e11540ae65ff8) Signed-off-by: Steve Sakoman

python3-cryptography: fix CVE-2023-49083

2023-12-12T14:20:34+00:00

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6. References: https://nvd.nist.gov/vuln/detail/CVE-2023-49083 https://security-tracker.debian.org/tracker/CVE-2023-49083 (From OE-Core rev: 2d104f78cd13a10640bc284c7fc8358bf305279c) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman

python3-jinja2: Fixed ptest result output as per the standard

2023-11-14T16:49:11+00:00

There was an extra space between the result and ':'. After removing extra space, the ptest result will be: result : testname -> result: testname (From OE-Core rev: 4bb6373e5f4a1330a063d1afe855d6c24d5461e7) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman

python3-urllib3: 1.26.15 -> 1.26.17

2023-10-18T15:13:24+00:00

1.26.17 (2023-10-02) Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect. (CVE-2023-43804) 1.26.16 (2023-05-23) Fixed thread-safety issue where accessing a PoolManager with many distinct origins would cause connection pools to be closed while requests are in progress (#2954) (From OE-Core rev: 27a1de55a46b7b313eb2a6370e9d779a7cd49154) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

python3-urllib3: upgrade 1.26.14 -> 1.26.15

2023-10-18T15:13:24+00:00

Changelog: ========== * Fix socket timeout value when "HTTPConnection" is reused ('#2645 '__) * Remove "!" character from the unreserved characters in IPv6 Zone ID parsing ('#2899 '__) * Fix IDNA handling of '\x80' byte ('#2901 '__) (From OE-Core rev: a335ccbcc9913e79bfe958c41690b7efa189ae93) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie (cherry picked from commit 8e062efbac29a81831c3060bcae601dc533d65dd) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman