Security fix for CVE-2024-6923 (rhbz#2303158)

python3.11.spec

@@ -356,6 +356,25 @@ Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-par
 # 255.255.255.255/32 ("Limited broadcast").
 Patch431: 00431-gh-113171-gh-65056-fix-private-non-global-ip-address-ranges-gh-113179-gh-113186-gh-118177-gh-118472.patch
 
+# 00435 # d33a3c90daa3d5d2d7e67f6e9264e5438d9608a0
+# gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233)
+#
+# Per RFC 2047:
+#
+# > [...] these encoding schemes allow the
+# > encoding of arbitrary octet values, mail readers that implement this
+# > decoding should also ensure that display of the decoded data on the
+# > recipient's terminal will not cause unwanted side-effects
+#
+# It seems that the "quoted-word" scheme is a valid way to include
+# a newline character in a header value, just like we already allow
+# undecodable bytes or control characters.
+# They do need to be properly quoted when serialized to text, though.
+#
+# This should fail for custom fold() implementations that aren't careful
+# about newlines.
+Patch435: 00435-gh-121650-encode-newlines-in-headers-and-verify-headers-are-sound-gh-122233.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1668,6 +1687,7 @@ CheckPython optimized
 %changelog
 * Thu Aug 15 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-5
 - Security fix for CVE-2024-4032 (rhbz#2293391)
+- Security fix for CVE-2024-6923 (rhbz#2303158)
 
 * Tue Jul 23 2024 Lumír Balhar <lbalhar@redhat.com> - 3.11.9-4
 - Require systemtap-sdt-devel for sys/sdt.h