linux/poky.git/meta/recipes-devtools/python, branch yocto-3.1.21

python3: upgrade 3.8.13 -> 3.8.14

2022-10-27T15:54:43+00:00

Security and bug fixes. * Drop CVE-2021-28861.patch as it was merged in 3.8.14 release. Fixes: * CVE-2020-10735 https://nvd.nist.gov/vuln/detail/CVE-2020-10735 * CVE-2021-28861 https://nvd.nist.gov/vuln/detail/CVE-2021-28861 * CVE-2018-25032 https://nvd.nist.gov/vuln/detail/CVE-2018-25032 Python 3.8.14 Release Date: Sept. 6, 2022 This is a security release of Python 3.8 Note: The release you're looking at is Python 3.8.14, a security bugfix release for the legacy 3.8 series. Python 3.10 is now the latest feature release series of Python 3. Security content in this release CVE-2020-10735: converting between int and str in bases other than 2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now raises a ValueError if the number of digits in string form is above a limit to avoid potential denial of service attacks due to the algorithmic complexity. gh-87389: http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. gh-93065: Fix contextvars HAMT implementation to handle iteration over deep trees to avoid a potential crash of the interpreter. gh-90355: Fix ensurepip environment isolation for the subprocess running pip. gh-80254: Raise ProgrammingError instead of segfaulting on recursive usage of cursors in sqlite3 converters. (From OE-Core rev: 25fafd35a4698daa0d4abb814a91601e68223128) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: Fix CVE-2021-28861 for python3

2022-09-16T16:53:28+00:00

Add patch to fix CVE-2021-28861 CVE-2021-28861.patch Link: https://github.com/python/cpython/commit/4dc2cae3abd75f386374d0635d00443b897d0672 (From OE-Core rev: cbf57b25c78ea9d56863d9546b51fc2c88adb8cf) Signed-off-by: Riyaz Khan Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python-pip: CVE-2021-3572 Incorrect handling of unicode separators in git references

2022-06-24T22:57:45+00:00

Source: https://github.com/pypa/pip MR: 113864 Type: Security Fix Disposition: Backport from https://github.com/pypa/pip/commit/e46bdda9711392fec0c45c1175bae6db847cb30b ChangeID: 717948e217d6219d1f03afb4d984342d7dea4636 Description: CVE-2021-3572 python-pip: Incorrect handling of unicode separators in git references. (From OE-Core rev: 841a8fb5b6351f79a4d756232a544d1a6480c562) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: ignore CVE-2015-20107

2022-05-09T10:51:59+00:00

CVE-2015-20107 describes an arbitrary command execution in the mailcap module, but this is by design in mailcap and needs to be worked around by the calling application. Upstream Python will be documenting this flaw in the library reference, and it is likely that the mailcap module will be deprecated and removed in the future. (From OE-Core rev: 1ed7bb74d35f08af3babf73c68ee01af5f28a50b) Signed-off-by: Ross Burton Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 85fac8408baf92d8b71946f5bfea92952b7eab01) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3-jinja2: Correct HOMEPAGE

2022-04-09T07:27:11+00:00

(From OE-Core rev: 7d429e8385ca01728d797abe8ab9575140734476) Signed-off-by: Peter Kjellerstedt Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 261778c1e3665b34c0d4e49bda63b520d5335587) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: ignore CVE-2022-26488

2022-03-31T20:09:33+00:00

This CVE is specific to Microsoft Windows, so we can ignore it. (From OE-Core rev: d966a07d1f04aa76a4970d4af141f817197be0d2) Signed-off-by: Ross Burton Signed-off-by: Alexandre Belloni (cherry picked from commit 2bd3c5a93988140d9927340b3af68785ae03db65) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.12 -> 3.8.13

2022-03-23T23:16:12+00:00

Security and bug fixes (including upgrades for security and bug fixes to bundled components). For changes see: https://docs.python.org/release/3.8.13/whatsnew/changelog.html#python-3-8-13-final CVE: CVE-2022-26488 License-Update: Add 2022 to copyright years * Update bpo-36852 patch to apply after change in 3.8.13 (From OE-Core rev: bcad36b6d34b3176dc313ed6af99897cc442bf2b) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.11 -> 3.8.12

2021-12-02T16:53:07+00:00

Release Date: Aug. 30, 2021 This is a security release of Python 3.8 Note: The release you're looking at is Python 3.8.12, a security bugfix release for the legacy 3.8 series. Python 3.10 is now the latest feature release series of Python 3. Get the latest release of 3.10.x here. Security content in this release contains four fixes. There are also four additional fixes for bugs that might have lead to denial-of-service attacks. Finally, while we're not providing binary installers anymore, for those users who produce installers, we upgraded the OpenSSL version used to 1.1.1l. Take a look at the change log for details. According to the release calendar specified in PEP 569, Python 3.8 is now in the "security fixes only" stage of its life cycle: 3.8 branch only accepts security fixes and releases of those are made irregularly in source-only form until October 2024. Python 3.8 isn't receiving regular bug fixes anymore, and binary installers are no longer provided for it. Python 3.8.10 was the last full bugfix release of Python 3.8 with binary installers. This release includes a fix for CVE-2021-29921. References: https://docs.python.org/release/3.8.12/whatsnew/changelog.html#changelog (From OE-Core rev: ff52cf448c5e26246f8637d0b8957c5c479fa389) Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3-magic: add missing DEPENDS

2021-11-15T11:53:55+00:00

Since file-native is ASSUME_PROVIDED magic.mgc is not being staged. As a result diffoscope-native is failing with: magic.MagicException: b'could not find any valid magic files! Fix this by adding dependency on file-replacement-native (From OE-Core rev: dcd8294f826f6e061cdd01c6c3594789ed46732e) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3-magic: add the missing rdepends

2021-11-15T11:53:55+00:00

Add the missing rdepends to fix below error: # python3 [snip] >>> import magic [snip] ModuleNotFoundError: No module named 'ctypes' ModuleNotFoundError: No module named 'tempfile' (From OE-Core rev: ba5562d34653fa6b5819dbc8ca80a42167c38c96) Signed-off-by: Mingli Yu Signed-off-by: Richard Purdie (cherry picked from commit 115791844124bdddfbaec9d75bb887ef35c41f20) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie