linux/poky.git/meta/recipes-devtools/python, branch yocto-3.1.23

python3: fix packaging of Windows distutils installer stubs

2023-02-13T07:44:09+00:00

The python3 Windows distutils installer stubs were split into a separate package in poky commit dc1ab6482cfb30c714e7cbb421920943439a3fd6. This has regressed during the upgrade to Python 3.8.2 in yocto-3.1 [YOCTO #13889] https://bugzilla.yoctoproject.org/show_bug.cgi?id=13889 (From OE-Core rev: 4f069121ddb99bb6e2f186724cd60ca07f74f503) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: Fix CVE-2022-37454

2022-12-23T23:05:44+00:00

Add below patch to fix CVE-2022-37454 CVE-2022-37454.patch Link: https://security-tracker.debian.org/tracker/CVE-2022-37454 Link: https://github.com/python/cpython/commit/948c6794711458fd148a3fa62296cadeeb2ed631 (From OE-Core rev: 6a8ef6cc3604008860dcb6aa5d7155b914d7c391) Signed-off-by: Pawan Badganchi Signed-off-by: pawan Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: Fix CVE-2022-45061

2022-12-07T15:06:36+00:00

Fix CVE-2022-45061, referenced as https://github.com/python/cpython/issues/98433 patch taken from https://github.com/python/cpython/pull/99231/commits/064ec20bf7a181ba5fa961aaa12973812aa6ca5d (From OE-Core rev: 4498ca9a299bd5d9a7173ec67daf17cb66b6d286) Signed-off-by: Omkar Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.13 -> 3.8.14

2022-10-27T15:54:43+00:00

Security and bug fixes. * Drop CVE-2021-28861.patch as it was merged in 3.8.14 release. Fixes: * CVE-2020-10735 https://nvd.nist.gov/vuln/detail/CVE-2020-10735 * CVE-2021-28861 https://nvd.nist.gov/vuln/detail/CVE-2021-28861 * CVE-2018-25032 https://nvd.nist.gov/vuln/detail/CVE-2018-25032 Python 3.8.14 Release Date: Sept. 6, 2022 This is a security release of Python 3.8 Note: The release you're looking at is Python 3.8.14, a security bugfix release for the legacy 3.8 series. Python 3.10 is now the latest feature release series of Python 3. Security content in this release CVE-2020-10735: converting between int and str in bases other than 2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now raises a ValueError if the number of digits in string form is above a limit to avoid potential denial of service attacks due to the algorithmic complexity. gh-87389: http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. gh-93065: Fix contextvars HAMT implementation to handle iteration over deep trees to avoid a potential crash of the interpreter. gh-90355: Fix ensurepip environment isolation for the subprocess running pip. gh-80254: Raise ProgrammingError instead of segfaulting on recursive usage of cursors in sqlite3 converters. (From OE-Core rev: 25fafd35a4698daa0d4abb814a91601e68223128) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: Fix CVE-2021-28861 for python3

2022-09-16T16:53:28+00:00

Add patch to fix CVE-2021-28861 CVE-2021-28861.patch Link: https://github.com/python/cpython/commit/4dc2cae3abd75f386374d0635d00443b897d0672 (From OE-Core rev: cbf57b25c78ea9d56863d9546b51fc2c88adb8cf) Signed-off-by: Riyaz Khan Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python-pip: CVE-2021-3572 Incorrect handling of unicode separators in git references

2022-06-24T22:57:45+00:00

Source: https://github.com/pypa/pip MR: 113864 Type: Security Fix Disposition: Backport from https://github.com/pypa/pip/commit/e46bdda9711392fec0c45c1175bae6db847cb30b ChangeID: 717948e217d6219d1f03afb4d984342d7dea4636 Description: CVE-2021-3572 python-pip: Incorrect handling of unicode separators in git references. (From OE-Core rev: 841a8fb5b6351f79a4d756232a544d1a6480c562) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: ignore CVE-2015-20107

2022-05-09T10:51:59+00:00

CVE-2015-20107 describes an arbitrary command execution in the mailcap module, but this is by design in mailcap and needs to be worked around by the calling application. Upstream Python will be documenting this flaw in the library reference, and it is likely that the mailcap module will be deprecated and removed in the future. (From OE-Core rev: 1ed7bb74d35f08af3babf73c68ee01af5f28a50b) Signed-off-by: Ross Burton Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 85fac8408baf92d8b71946f5bfea92952b7eab01) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3-jinja2: Correct HOMEPAGE

2022-04-09T07:27:11+00:00

(From OE-Core rev: 7d429e8385ca01728d797abe8ab9575140734476) Signed-off-by: Peter Kjellerstedt Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 261778c1e3665b34c0d4e49bda63b520d5335587) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: ignore CVE-2022-26488

2022-03-31T20:09:33+00:00

This CVE is specific to Microsoft Windows, so we can ignore it. (From OE-Core rev: d966a07d1f04aa76a4970d4af141f817197be0d2) Signed-off-by: Ross Burton Signed-off-by: Alexandre Belloni (cherry picked from commit 2bd3c5a93988140d9927340b3af68785ae03db65) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.12 -> 3.8.13

2022-03-23T23:16:12+00:00

Security and bug fixes (including upgrades for security and bug fixes to bundled components). For changes see: https://docs.python.org/release/3.8.13/whatsnew/changelog.html#python-3-8-13-final CVE: CVE-2022-26488 License-Update: Add 2022 to copyright years * Update bpo-36852 patch to apply after change in 3.8.13 (From OE-Core rev: bcad36b6d34b3176dc313ed6af99897cc442bf2b) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie