linux/poky.git/meta/recipes-devtools/python, branch yocto-4.0.10

python3-cryptography: fix for CVE-2023-23931

2023-05-10T14:19:56+00:00

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8. (From OE-Core rev: 368e450c2d800790a05924519f34c579e28e9cbb) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman

python3-git: fix indent error

2023-03-23T22:45:33+00:00

It fails to import anything from git/remote.py: File "/path_to/python3-git-native/3.1.27-r0/GitPython-3.1.27/git/remote.py", line 700 url = Git.polish_url(url) ^ IndentationError: unexpected indent (From OE-Core rev: 48633d8920210e55e0b9ee3004f0502f9f0eec48) Signed-off-by: Kai Kang Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: fix CVE-2023-24329

2023-03-23T22:45:33+00:00

Backport fix from cpython 3.11 branch. (From OE-Core rev: 37defd828cc6a8267139928730d766167905d21a) Signed-off-by: Joe Slater Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3-setuptools-rust-native: Add direct dependency of native python3 modules

2023-03-20T17:20:44+00:00

Add direct dependency of below native python3 modules to fix the compile issue python3-semantic-version-native python3-setuptools-native python3-setuptools-scm-native python3-toml-native python3-typing-extensions-native python3-wheel-native This issue is not seen in the upstream yocto but in the project, where the python modules are not built by any other dependency. They have to be explicitly pulled. This fixes below error: File "/python3-setuptools-rust-native/1.1.2-r0/recipe-sysroot-native/usr/lib/python3.10/site-packages/setuptools/config.py", line 422, in _parse_attr module = importlib.import_module(module_name) File "/python3-setuptools-rust-native/1.1.2-r0/recipe-sysroot-native/usr/lib/python3.10/importlib/__init__.py", line 126, in import_module return _bootstrap._gcd_import(name[level:], package, level) File "", line 1050, in _gcd_import File "", line 1027, in _find_and_load File "", line 1006, in _find_and_load_unlocked File "", line 688, in _load_unlocked File "", line 883, in exec_module File "", line 241, in _call_with_frames_removed File "/python3-setuptools-rust-native/1.1.2-r0/setuptools-rust-1.1.2/setuptools_rust/__init__.py", line 1, in from .build import build_rust File "/python3-setuptools-rust-native/1.1.2-r0/setuptools-rust-1.1.2/setuptools_rust/build.py", line 23, in from typing_extensions import Literal ModuleNotFoundError: No module named 'typing_extensions' (From OE-Core rev: 0ae1ed426e97d9d53fb31a9751de5a3f1898b16b) Signed-off-by: Poonam Jadhav Signed-off-by: Poonam Jadhav Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3-pytest: depend on python3-tomli instead of python3-toml

2023-02-15T21:46:55+00:00

Since version 7.0.0 [1], pytest switched from the toml package to the tomli package for parsing pyproject.toml configuration files [2]. This change is not immediately noticable during tests, because the toml/tomli module is only important if a pyproject.toml is actually present in a project. [1] https://docs.pytest.org/en/latest/changelog.html#pytest-7-0-0rc1-2021-12-06 [2] https://github.com/pytest-dev/pytest/issues/8789 (From OE-Core rev: e5e590ed9e118283ad67bcfb059b3375cf847b33) Signed-off-by: Arnout Vandecappelle Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3-certifi: fix for CVE-2022-23491

2023-02-15T21:46:55+00:00

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion. Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-23491 (From OE-Core rev: 8ee4adb8675c690962e5820669098a95f74c07c7) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3-git: fix for CVE-2022-24439

2023-01-26T23:37:05+00:00

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. CVE: CVE-2022-24439 Upstream-Status: Backport Reference: https://github.com/gitpython-developers/GitPython/discussions/1529 https://github.com/gitpython-developers/GitPython/pull/1518 https://github.com/gitpython-developers/GitPython/pull/1521 (From OE-Core rev: 55f93e3786290dfa5ac72b5969bb2793f6a98bde) Signed-off-by: Narpat Mali Signed-off-by: Richard Purdie

python3-wheel: fix for CVE-2022-40898

2023-01-26T23:37:05+00:00

An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. CVE: CVE-2022-40898 Upstream-Status: Backport [https://github.com/pypa/wheel/commit/88f02bc335d5404991e532e7f3b0fc80437bf4e0] (From OE-Core rev: 0974291e545aec68755dfb634c75dca37cca1ea9) Signed-off-by: Narpat Mali Signed-off-by: Richard Purdie

python3-setuptools: fix for CVE-2022-40897

2023-01-26T23:37:05+00:00

Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. CVE: CVE-2022-40897 Upstream-Status: Backport [https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be] (From OE-Core rev: f574d8d57ff3fbc38e350e7a90913993081c4fdf) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.10.8 -> 3.10.9

2022-12-23T23:05:50+00:00

Security and bug fixes. Drop patch for CVE-2022-42919 and CVE-2022-37454 which were merged in 3.10.9 Fixes: * CVE-2022-45061 (gh-98433) https://nvd.nist.gov/vuln/detail/CVE-2022-45061 List of changes: https://docs.python.org/3.10/whatsnew/changelog.html#python-3-10-9-final (From OE-Core rev: f98b9c71686eb5ce5115ee73155a7d0389831ef0) Signed-off-by: Florin Diaconescu Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie