rpms/python3.11
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update to 3.11.10

Browse source
This commit is contained in:
Tomáš Hrnčiar 2024-09-09 10:22:00 +02:00 • committed by Miro Hrončok
commit 6116f5c4e8
6 changed files with 7 additions and 1423 deletions
Download patch file Download diff file Expand all files Collapse all files

67
python3.11.spec
View file

@ -13,11 +13,11 @@ URL: https://www.python.org/
# WARNING When rebasing to a new Python version,
# remember to update the python3-docs package as well
%global general_version %{pybasever}.9
%global general_version %{pybasever}.10
#global prerel ...
%global upstream_version %{general_version}%{?prerel}
Version: %{general_version}%{?prerel:~%{prerel}}
Release: 6%{?dist}
Release: 1%{?dist}
License: Python-2.0.1
@ -319,66 +319,6 @@ Patch251: 00251-change-user-install-location.patch
# https://github.com/GrahamDumpleton/mod_wsgi/issues/730
Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
# 00415 # 744762808f7303a55fa941f65cacb94fd7099e5e
# [CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() (#111116)
#
# Detect email address parsing errors and return empty tuple to
# indicate the parsing error (old API). Add an optional 'strict'
# parameter to getaddresses() and parseaddr() functions. Patch by
# Thomas Dwyer.
Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
# 00431 # 4e176bf669bb71e518ee3e79a492ae02ec6397bc
# gh-113171: gh-65056: Fix "private" (non-global) IP address ranges (GH-113179) (GH-113186) (GH-118177) (GH-118472)
#
# The _private_networks variables, used by various is_private
# implementations, were missing some ranges and at the same time had
# overly strict ranges (where there are more specific ranges considered
# globally reachable by the IANA registries).
#
# This patch updates the ranges with what was missing or otherwise
# incorrect.
#
# 100.64.0.0/10 is left alone, for now, as it's been made special in [1].
#
# The _address_exclude_many() call returns 8 networks for IPv4, 121
# networks for IPv6.
#
# [1] https://github.com/python/cpython/issues/61602
#
# In 3.10 and below, is_private checks whether the network and broadcast
# address are both private.
# In later versions (where the test wss backported from), it checks
# whether they both are in the same private network.
#
# For 0.0.0.0/0, both 0.0.0.0 and 255.225.255.255 are private,
# but one is in 0.0.0.0/8 ("This network") and the other in
# 255.255.255.255/32 ("Limited broadcast").
Patch431: 00431-gh-113171-gh-65056-fix-private-non-global-ip-address-ranges-gh-113179-gh-113186-gh-118177-gh-118472.patch
# 00435 # d33a3c90daa3d5d2d7e67f6e9264e5438d9608a0
# gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233)
#
# Per RFC 2047:
#
# > [...] these encoding schemes allow the
# > encoding of arbitrary octet values, mail readers that implement this
# > decoding should also ensure that display of the decoded data on the
# > recipient's terminal will not cause unwanted side-effects
#
# It seems that the "quoted-word" scheme is a valid way to include
# a newline character in a header value, just like we already allow
# undecodable bytes or control characters.
# They do need to be properly quoted when serialized to text, though.
#
# This should fail for custom fold() implementations that aren't careful
# about newlines.
Patch435: 00435-gh-121650-encode-newlines-in-headers-and-verify-headers-are-sound-gh-122233.patch
# 00436 # 1acd6db660ad1124ab7ae449a841608dd9d9062d
# [CVE-2024-8088] gh-122905: Sanitize names in zipfile.Path.
Patch436: 00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch
# (New patches go here ^^^)
#
# When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@ -1694,6 +1634,9 @@ CheckPython optimized
# ======================================================
%changelog
* Mon Sep 09 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.10-1
- Update to 3.11.10
* Fri Aug 23 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-6
- Security fix for CVE-2024-8088
- Fixes: rhbz#2307460