rpms/python3.11
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE 2026-3644, CVE-2026-4224

Browse source 
Resolves: rhbz#2457941, rhbz#2458221, rhbz#2458013, rhbz#2444704, rhbz#2448188, rhbz#2448204
This commit is contained in:
Charalampos Stratakis 2026-04-17 03:41:06 +02:00
commit f51f0ca45b
7 changed files with 535 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

42
python3.11.spec
View file

@ -17,7 +17,7 @@ URL: https://www.python.org/
#global prerel ...
%global upstream_version %{general_version}%{?prerel}
Version: %{general_version}%{?prerel:~%{prerel}}
Release: 3%{?dist}
Release: 4%{?dist}
License: Python-2.0.1
@ -373,6 +373,42 @@ Patch475: 00475-cve-2025-15367.patch
# Reject leading dashes in webbrowser URLs (GH-143931) (GH-146364)
Patch478: 00478-cve-2026-4519.patch
# 00479 # 6fe61dd71dec5b7c9de2b1994172981667d034a1
# CVE-2026-1502
#
# Reject CR/LF in HTTP tunnel request headers
Patch479: 00479-cve-2026-1502.patch
# 00480 # 9f4b1483ecfbc8c08117133c239fba544fcb42e7
# CVE-2026-4786
#
# Fix webbrowser `%%action` substitution bypass of dash-prefix check
Patch480: 00480-cve-2026-4786.patch
# 00482 # 2a21454e658935990766df8c3c48af9363e8422a
# CVE-2026-6100
#
# Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor
Patch482: 00482-cve-2026-6100.patch
# 00483 # cdb097a23eac5a09fb063a0e91001f69ff324205
# CVE-2026-2297
#
# Logging Bypass in Legacy .pyc File Handling
Patch483: 00483-cve-2026-2297.patch
# 00484 # cf0bd2f2cce15cb35558aa08de34e9d18a8089f7
# CVE-2026-3644
#
# Incomplete control character validation in http.cookies
Patch484: 00484-cve-2026-3644.patch
# 00485 # 54d821ba2f5a03ccced037978fcdb0a7c4d6878f
# CVE-2026-4224
#
# Stack overflow parsing XML with deeply nested DTD content models
Patch485: 00485-cve-2026-4224.patch
# (New patches go here ^^^)
#
# When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@ -1705,6 +1741,10 @@ CheckPython optimized
# ======================================================
%changelog
* Fri Apr 17 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.11.15-4
- Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE 2026-3644, CVE-2026-4224
Resolves: rhbz#2457941, rhbz#2458221, rhbz#2458013, rhbz#2444704, rhbz#2448188, rhbz#2448204
* Sat Apr 11 2026 Miro Hrončok <mhroncok@redhat.com> - 3.11.15-3
- Explicitly build with OpenSSL 3