linux/poky.git/meta/recipes-devtools/python, branch yocto-3.1.19

python-pip: CVE-2021-3572 Incorrect handling of unicode separators in git references

2022-06-24T22:57:45+00:00

Source: https://github.com/pypa/pip MR: 113864 Type: Security Fix Disposition: Backport from https://github.com/pypa/pip/commit/e46bdda9711392fec0c45c1175bae6db847cb30b ChangeID: 717948e217d6219d1f03afb4d984342d7dea4636 Description: CVE-2021-3572 python-pip: Incorrect handling of unicode separators in git references. (From OE-Core rev: 841a8fb5b6351f79a4d756232a544d1a6480c562) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: ignore CVE-2015-20107

2022-05-09T10:51:59+00:00

CVE-2015-20107 describes an arbitrary command execution in the mailcap module, but this is by design in mailcap and needs to be worked around by the calling application. Upstream Python will be documenting this flaw in the library reference, and it is likely that the mailcap module will be deprecated and removed in the future. (From OE-Core rev: 1ed7bb74d35f08af3babf73c68ee01af5f28a50b) Signed-off-by: Ross Burton Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 85fac8408baf92d8b71946f5bfea92952b7eab01) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3-jinja2: Correct HOMEPAGE

2022-04-09T07:27:11+00:00

(From OE-Core rev: 7d429e8385ca01728d797abe8ab9575140734476) Signed-off-by: Peter Kjellerstedt Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 261778c1e3665b34c0d4e49bda63b520d5335587) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: ignore CVE-2022-26488

2022-03-31T20:09:33+00:00

This CVE is specific to Microsoft Windows, so we can ignore it. (From OE-Core rev: d966a07d1f04aa76a4970d4af141f817197be0d2) Signed-off-by: Ross Burton Signed-off-by: Alexandre Belloni (cherry picked from commit 2bd3c5a93988140d9927340b3af68785ae03db65) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.12 -> 3.8.13

2022-03-23T23:16:12+00:00

Security and bug fixes (including upgrades for security and bug fixes to bundled components). For changes see: https://docs.python.org/release/3.8.13/whatsnew/changelog.html#python-3-8-13-final CVE: CVE-2022-26488 License-Update: Add 2022 to copyright years * Update bpo-36852 patch to apply after change in 3.8.13 (From OE-Core rev: bcad36b6d34b3176dc313ed6af99897cc442bf2b) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.11 -> 3.8.12

2021-12-02T16:53:07+00:00

Release Date: Aug. 30, 2021 This is a security release of Python 3.8 Note: The release you're looking at is Python 3.8.12, a security bugfix release for the legacy 3.8 series. Python 3.10 is now the latest feature release series of Python 3. Get the latest release of 3.10.x here. Security content in this release contains four fixes. There are also four additional fixes for bugs that might have lead to denial-of-service attacks. Finally, while we're not providing binary installers anymore, for those users who produce installers, we upgraded the OpenSSL version used to 1.1.1l. Take a look at the change log for details. According to the release calendar specified in PEP 569, Python 3.8 is now in the "security fixes only" stage of its life cycle: 3.8 branch only accepts security fixes and releases of those are made irregularly in source-only form until October 2024. Python 3.8 isn't receiving regular bug fixes anymore, and binary installers are no longer provided for it. Python 3.8.10 was the last full bugfix release of Python 3.8 with binary installers. This release includes a fix for CVE-2021-29921. References: https://docs.python.org/release/3.8.12/whatsnew/changelog.html#changelog (From OE-Core rev: ff52cf448c5e26246f8637d0b8957c5c479fa389) Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3-magic: add missing DEPENDS

2021-11-15T11:53:55+00:00

Since file-native is ASSUME_PROVIDED magic.mgc is not being staged. As a result diffoscope-native is failing with: magic.MagicException: b'could not find any valid magic files! Fix this by adding dependency on file-replacement-native (From OE-Core rev: dcd8294f826f6e061cdd01c6c3594789ed46732e) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3-magic: add the missing rdepends

2021-11-15T11:53:55+00:00

Add the missing rdepends to fix below error: # python3 [snip] >>> import magic [snip] ModuleNotFoundError: No module named 'ctypes' ModuleNotFoundError: No module named 'tempfile' (From OE-Core rev: ba5562d34653fa6b5819dbc8ca80a42167c38c96) Signed-off-by: Mingli Yu Signed-off-by: Richard Purdie (cherry picked from commit 115791844124bdddfbaec9d75bb887ef35c41f20) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: Add a fix for a make install race

2021-10-23T22:14:17+00:00

Add a fix for reproducibility issues where pyc files for python-config.py may not always be generated. (From OE-Core rev: 917f800368c6d452670d3ccf74057afae98013b0) Signed-off-by: Richard Purdie (cherry picked from commit d1c3a87c48b598b6e5624d0affe8bd89320631bf) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: Remove unused python3 recipe

2021-08-26T07:32:18+00:00

Currently in dunfell branch python3 version is 3.8.11. so, python3_3.8.10.bb is not needed. Hence, removed. (From OE-Core rev: 2b44de6e7b3e02b78e2b09294ac37799ad4cfadb) Signed-off-by: Purushottam Choudhary Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie