linux/poky.git/meta/recipes-devtools/python, branch yocto-4.0.23

python3: ignore fixed CVEs

2024-11-02T13:32:36+00:00

These CVEs were fixed in 3.10.15 Commit 487e8cdf1df6feba6d88fa29e11791f4ebaaa362 removed patches in favor of version upgrade, which caused the CVEs to re-appear in reports. (From OE-Core rev: 2cf10084c56c83da3deff4e65e619afab80e08e1) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: Upgrade 3.10.14 -> 3.10.15

2024-09-27T12:57:35+00:00

Includes security fixes for CVE-2024-4030, CVE-2024-7592, CVE-2024-4032, CVE-2024-8088 CVE-2024-6232, CVE-2024-6923, CVE-2023-27043 and other bug fixes. Removed below patches, as the fixes included in 3.10.15 upgrade: 1. CVE-2023-27043.patch 2. CVE-2024-6232.patch 3. CVE-2024-7592.patch 4. CVE-2024-8088.patch Release Notes: https://www.python.org/downloads/release/python-31015/ (From OE-Core rev: e64ead97ae3d680f97bf85422f777cd77ae7c434) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

python3: fix CVE-2023-27043

2024-09-16T13:09:56+00:00

Upstream-Status: Backport from https://github.com/python/cpython/commit/2a9273a0e4466e2f057f9ce6fe98cd8ce570331b (From OE-Core rev: 793c22623e8b3da2ca8e28fe662d8428b0f805a7) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman

python3: CVE-2024-6232 CVE-2024-7592 fixes

2024-09-16T13:09:56+00:00

Upstream-Status: Backport from https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a Upstream-Status: Backport from https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4 (From OE-Core rev: 3e5697687c8fb0aa6312773b233442b8df974feb) Signed-off-by: Hugo SIMELIERE Signed-off-by: Steve Sakoman

python3: Security fix for CVE-2024-8088

2024-09-07T12:38:17+00:00

CVE fixed: - CVE-2024-8088: python: cpython: denial of service in zipfile Upstream-Status: Backport from https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db (From OE-Core rev: 295addec33c83443423a3ef87905c3a70f44a4e7) Signed-off-by: Rohini Sangam Signed-off-by: Siddharth Doshi Signed-off-by: Steve Sakoman

python3: add PACKAGECONFIG[editline]

2024-08-28T13:49:22+00:00

Backport PACKAGECONFIG[editline] from Scarthgap to Kirkstone because libedit has feature parity with readline but is more permissively licensed (BSD verses GPLv3). This patch provides means of enabling editline in a distribution without GPLv3 and in this case improves Python REPL keyboard support. (From OE-Core rev: 12dc7d2081a1aaec90ffb3ed6718d757ce14b5ab) Signed-off-by: Leon Anavi Signed-off-by: Steve Sakoman

python3-pycryptodome(x): use python_setuptools_build_meta build class

2024-08-16T15:09:14+00:00

This package can be built using pep517 classes now. (From OE-Core rev: 6c1000a2bbfe5e618e42bc5be2058332337d4177) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit a32fa3e64d1daf5846c29403e9f258aea42212d3) Signed-off-by: Steve Sakoman

python3-certifi: Fix CVE-2024-39689

2024-08-16T15:09:14+00:00

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.07.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.07.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues." References: https://nvd.nist.gov/vuln/detail/CVE-2024-39689 Upstream-patch: https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463 (From OE-Core rev: 96c1e12dc6cb4c321a09a6ddcc4c9f27c30b4564) Signed-off-by: Soumya Sambu Signed-off-by: Steve Sakoman

python3-jinja2: Upgrade 3.1.3 -> 3.1.4

2024-07-24T14:51:58+00:00

Switch to use flit core since upstream changed. They also changed the capitalisation under pypi. The license didn't change but the file was renamed, probably as it wasn't rst. (From OE-Core rev: 58ee84c274b0c93902aad5d4f434daec5da55134) Signed-off-by: Richard Purdie (cherry picked from commit e352680528b18c3cdae26233bef7cddc2771d42d) Upgrade fixes CVE-2024-34064 Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

python3: Upgrade 3.10.13 -> 3.10.14

2024-05-15T16:44:14+00:00

Addresses CVEs: * CVE-2023-52425 (bundled expat) * CVE-2023-6597 (https://github.com/python/cpython/pull/112840) News: https://github.com/python/cpython/blob/3.10/Misc/NEWS.d/3.10.14.rst (From OE-Core rev: e0b77aa347c03f520802c8235ae0389bb855c146) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman