Update to Python 3.11.16

Skip UDP Lite tests if it's not supported
- Fixes FTBFS on Linux kernel 7.1 and newer
2026-08-14 11:29:55 +02:00 · 2026-07-30 17:24:31 +02:00 · 2026-07-16 22:47:27 +00:00 · 2026-07-03 12:24:01 +02:00 · 2026-07-02 10:54:53 +02:00
13 changed files with 57 additions and 668 deletions
--- a/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
+++ b/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
@ -20,10 +20,10 @@ Co-authored-by: stratakis <cstratak@redhat.com>
 create mode 100644 Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst

 diff --git a/Makefile.pre.in b/Makefile.pre.in
-index 81d4d50f82..0bd3447638 100644
+index ad29e1a0ca..79b07194bb 100644
 --- a/Makefile.pre.in
 +++ b/Makefile.pre.in
-@@ -1453,7 +1453,7 @@ Python/frozen.o: $(FROZEN_FILES_OUT)
+@@ -1458,7 +1458,7 @@ Python/frozen.o: $(FROZEN_FILES_OUT)
 # an include guard, so we can't use a pipeline to transform its output.
 Include/pydtrace_probes.h: $(srcdir)/Include/pydtrace.d
 	$(MKDIR_P) Include
@ -32,7 +32,7 @@ index 81d4d50f82..0bd3447638 100644
 	: sed in-place edit with POSIX-only tools
 	sed 's/PYTHON_/PyDTrace_/' $@ > $@.tmp
 	mv $@.tmp $@
-@@ -1463,7 +1463,7 @@ Python/import.o: $(srcdir)/Include/pydtrace.h
+@@ -1468,7 +1468,7 @@ Python/import.o: $(srcdir)/Include/pydtrace.h
 Modules/gcmodule.o: $(srcdir)/Include/pydtrace.h
 
 Python/pydtrace.o: $(srcdir)/Include/pydtrace.d $(DTRACE_DEPS)
--- a/00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
+++ b/00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
@ -22,10 +22,10 @@ Co-authored-by: Petr Viktorin <encukou@gmail.com>
 create mode 100644 Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst

 diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
-index 0b169c37d5..921c41bd0d 100644
+index aa8ce81db6..61cde99753 100644
 --- a/Lib/test/test_ssl.py
 +++ b/Lib/test/test_ssl.py
-@@ -2633,16 +2633,18 @@ def run(self):
+@@ -2635,16 +2635,18 @@ def run(self):
                         self.write(msg.lower())
                 except OSError as e:
                     # handles SSLError and socket errors
@ -53,7 +53,7 @@ index 0b169c37d5..921c41bd0d 100644
                     try:
                         self.write(b"ERROR\n")
                     except OSError:
-@@ -3337,8 +3339,8 @@ def test_wrong_cert_tls13(self):
+@@ -3339,8 +3341,8 @@ def test_wrong_cert_tls13(self):
                                         suppress_ragged_eofs=False) as s:
             s.connect((HOST, server.port))
             with self.assertRaisesRegex(
@ -64,7 +64,7 @@ index 0b169c37d5..921c41bd0d 100644
             ):
                 # TLS 1.3 perform client cert exchange after handshake
                 s.write(b'data')
-@@ -4610,8 +4612,8 @@ def msg_cb(conn, direction, version, content_type, msg_type, data):
+@@ -4612,8 +4614,8 @@ def msg_cb(conn, direction, version, content_type, msg_type, data):
                 # test sometimes fails with EOF error. Test passes as long as
                 # server aborts connection with an error.
                 with self.assertRaisesRegex(
@ -84,7 +84,7 @@ index 0000000000..75d926ab59
 +Fix the :mod:`ssl` module error handling of connection terminate by peer.
 +It now throws an OSError with the appropriate error code instead of an EOFError.
 diff --git a/Modules/_ssl.c b/Modules/_ssl.c
-index 6275d94d64..ee7b131920 100644
+index 9c2e8c391d..174e5dfce5 100644
 --- a/Modules/_ssl.c
 +++ b/Modules/_ssl.c
@@ -576,7 +576,7 @@ PySSL_ChainExceptions(PySSLSocket *sslsock) {
--- a/00478-cve-2026-4519.patch
+++ b/00478-cve-2026-4519.patch
@ -1,121 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: tomcruiseqi <tom33qi@gmail.com>
-Date: Wed, 25 Mar 2026 02:23:28 +0800
-Subject: 00478: CVE-2026-4519
-
-Reject leading dashes in webbrowser URLs (GH-143931) (GH-146364)
-
-(cherry picked from commit 82a24a4442312bdcfc4c799885e8b3e00990f02b)
-
-Co-authored-by: Seth Michael Larson <seth@python.org>
---
- Lib/test/test_webbrowser.py                        |  5 +++++
- Lib/webbrowser.py                                  | 14 ++++++++++++++
- .../2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst |  1 +
- 3 files changed, 20 insertions(+)
- create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
-
-diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
-index 9d608d63a0..0ac985f56c 100644
--- a/Lib/test/test_webbrowser.py
-+++ b/Lib/test/test_webbrowser.py
-@@ -59,6 +59,11 @@ def test_open(self):
-                    options=[],
-                    arguments=[URL])
- 
-+    def test_reject_dash_prefixes(self):
-+        browser = self.browser_class(name=CMD_NAME)
-+        with self.assertRaises(ValueError):
-+            browser.open(f"--key=val {URL}")
-+
- 
- class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase):
- 
-diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
-index 5d72524c08..0fd0aeb3c1 100755
--- a/Lib/webbrowser.py
-+++ b/Lib/webbrowser.py
-@@ -155,6 +155,12 @@ def open_new(self, url):
-     def open_new_tab(self, url):
-         return self.open(url, 2)
- 
-+    @staticmethod
-+    def _check_url(url):
-+        """Ensures that the URL is safe to pass to subprocesses as a parameter"""
-+        if url and url.lstrip().startswith("-"):
-+            raise ValueError(f"Invalid URL: {url}")
-+
- 
- class GenericBrowser(BaseBrowser):
-     """Class for all browsers started with a command
-@@ -172,6 +178,7 @@ def __init__(self, name):
- 
-     def open(self, url, new=0, autoraise=True):
-         sys.audit("webbrowser.open", url)
-+        self._check_url(url)
-         cmdline = [self.name] + [arg.replace("%s", url)
-                                  for arg in self.args]
-         try:
-@@ -192,6 +199,7 @@ def open(self, url, new=0, autoraise=True):
-         cmdline = [self.name] + [arg.replace("%s", url)
-                                  for arg in self.args]
-         sys.audit("webbrowser.open", url)
-+        self._check_url(url)
-         try:
-             if sys.platform[:3] == 'win':
-                 p = subprocess.Popen(cmdline)
-@@ -257,6 +265,7 @@ def _invoke(self, args, remote, autoraise, url=None):
- 
-     def open(self, url, new=0, autoraise=True):
-         sys.audit("webbrowser.open", url)
-+        self._check_url(url)
-         if new == 0:
-             action = self.remote_action
-         elif new == 1:
-@@ -358,6 +367,7 @@ class Konqueror(BaseBrowser):
- 
-     def open(self, url, new=0, autoraise=True):
-         sys.audit("webbrowser.open", url)
-+        self._check_url(url)
-         # XXX Currently I know no way to prevent KFM from opening a new win.
-         if new == 2:
-             action = "newTab"
-@@ -442,6 +452,7 @@ def _remote(self, action):
- 
-     def open(self, url, new=0, autoraise=True):
-         sys.audit("webbrowser.open", url)
-+        self._check_url(url)
-         if new:
-             ok = self._remote("LOADNEW " + url)
-         else:
-@@ -605,6 +616,7 @@ def register_standard_browsers():
-     class WindowsDefault(BaseBrowser):
-         def open(self, url, new=0, autoraise=True):
-             sys.audit("webbrowser.open", url)
-+            self._check_url(url)
-             try:
-                 os.startfile(url)
-             except OSError:
-@@ -637,6 +649,7 @@ def __init__(self, name):
- 
-         def open(self, url, new=0, autoraise=True):
-             sys.audit("webbrowser.open", url)
-+            self._check_url(url)
-             assert "'" not in url
-             # hack for local urls
-             if not ':' in url:
-@@ -689,6 +702,7 @@ def _name(self, val):
- 
-         def open(self, url, new=0, autoraise=True):
-             sys.audit("webbrowser.open", url)
-+            self._check_url(url)
-             if self.name == 'default':
-                 script = 'open location "%s"' % url.replace('"', '%22') # opens in default browser
-             else:
-diff --git a/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
-new file mode 100644
-index 0000000000..0f27eae99a
--- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
-@@ -0,0 +1 @@
-+Reject leading dashes in URLs passed to :func:`webbrowser.open`
--- a/00479-cve-2026-1502.patch
+++ b/00479-cve-2026-1502.patch
@ -1,106 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Seth Larson <seth@python.org>
-Date: Fri, 10 Apr 2026 10:21:42 -0500
-Subject: 00479: CVE-2026-1502
-
-Reject CR/LF in HTTP tunnel request headers
-
-Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
---
- Lib/http/client.py                            | 11 ++++-
- Lib/test/test_httplib.py                      | 45 +++++++++++++++++++
- ...-03-20-09-29-42.gh-issue-146211.PQVbs7.rst |  2 +
- 3 files changed, 57 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst
-
-diff --git a/Lib/http/client.py b/Lib/http/client.py
-index c977612732..8cf783ab30 100644
--- a/Lib/http/client.py
-+++ b/Lib/http/client.py
-@@ -941,12 +941,21 @@ def _wrap_ipv6(self, ip):
-         return ip
- 
-     def _tunnel(self):
-+        if _contains_disallowed_url_pchar_re.search(self._tunnel_host):
-+            raise ValueError('Tunnel host can\'t contain control characters %r'
-+                             % (self._tunnel_host,))
-         connect = b"CONNECT %s:%d HTTP/1.0\r\n" % (
-             self._wrap_ipv6(self._tunnel_host.encode("ascii")),
-             self._tunnel_port)
-         headers = [connect]
-         for header, value in self._tunnel_headers.items():
-            headers.append(f"{header}: {value}\r\n".encode("latin-1"))
-+            header_bytes = header.encode("latin-1")
-+            value_bytes = value.encode("latin-1")
-+            if not _is_legal_header_name(header_bytes):
-+                raise ValueError('Invalid header name %r' % (header_bytes,))
-+            if _is_illegal_header_value(value_bytes):
-+                raise ValueError('Invalid header value %r' % (value_bytes,))
-+            headers.append(b"%s: %s\r\n" % (header_bytes, value_bytes))
-         headers.append(b"\r\n")
-         # Making a single send() call instead of one per line encourages
-         # the host OS to use a more optimal packet size instead of
-diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
-index 55363413b3..a4ab909ca9 100644
--- a/Lib/test/test_httplib.py
-+++ b/Lib/test/test_httplib.py
-@@ -371,6 +371,51 @@ def test_invalid_headers(self):
-                 with self.assertRaisesRegex(ValueError, 'Invalid header'):
-                     conn.putheader(name, value)
- 
-+    def test_invalid_tunnel_headers(self):
-+        cases = (
-+            ('Invalid\r\nName', 'ValidValue'),
-+            ('Invalid\rName', 'ValidValue'),
-+            ('Invalid\nName', 'ValidValue'),
-+            ('\r\nInvalidName', 'ValidValue'),
-+            ('\rInvalidName', 'ValidValue'),
-+            ('\nInvalidName', 'ValidValue'),
-+            (' InvalidName', 'ValidValue'),
-+            ('\tInvalidName', 'ValidValue'),
-+            ('Invalid:Name', 'ValidValue'),
-+            (':InvalidName', 'ValidValue'),
-+            ('ValidName', 'Invalid\r\nValue'),
-+            ('ValidName', 'Invalid\rValue'),
-+            ('ValidName', 'Invalid\nValue'),
-+            ('ValidName', 'InvalidValue\r\n'),
-+            ('ValidName', 'InvalidValue\r'),
-+            ('ValidName', 'InvalidValue\n'),
-+        )
-+        for name, value in cases:
-+            with self.subTest((name, value)):
-+                conn = client.HTTPConnection('example.com')
-+                conn.set_tunnel('tunnel', headers={
-+                    name: value
-+                })
-+                conn.sock = FakeSocket('')
-+                with self.assertRaisesRegex(ValueError, 'Invalid header'):
-+                    conn._tunnel()  # Called in .connect()
-+
-+    def test_invalid_tunnel_host(self):
-+        cases = (
-+            'invalid\r.host',
-+            '\ninvalid.host',
-+            'invalid.host\r\n',
-+            'invalid.host\x00',
-+            'invalid host',
-+        )
-+        for tunnel_host in cases:
-+            with self.subTest(tunnel_host):
-+                conn = client.HTTPConnection('example.com')
-+                conn.set_tunnel(tunnel_host)
-+                conn.sock = FakeSocket('')
-+                with self.assertRaisesRegex(ValueError, 'Tunnel host can\'t contain control characters'):
-+                    conn._tunnel()  # Called in .connect()
-+
-     def test_headers_debuglevel(self):
-         body = (
-             b'HTTP/1.1 200 OK\r\n'
-diff --git a/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst b/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst
-new file mode 100644
-index 0000000000..4993633b8e
--- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst
-@@ -0,0 +1,2 @@
-+Reject CR/LF characters in tunnel request headers for the
-+HTTPConnection.set_tunnel() method.
--- a/00480-cve-2026-4786.patch
+++ b/00480-cve-2026-4786.patch
@ -1,63 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Stan Ulbrych <stan@python.org>
-Date: Mon, 13 Apr 2026 22:41:51 +0100
-Subject: 00480: CVE-2026-4786
-
-Fix webbrowser `%action` substitution bypass of dash-prefix check
---
- Lib/test/test_webbrowser.py                               | 8 ++++++++
- Lib/webbrowser.py                                         | 5 +++--
- .../2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst        | 2 ++
- 3 files changed, 13 insertions(+), 2 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
-
-diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
-index 0ac985f56c..d629f889db 100644
--- a/Lib/test/test_webbrowser.py
-+++ b/Lib/test/test_webbrowser.py
-@@ -99,6 +99,14 @@ def test_open_new_tab(self):
-                    options=[],
-                    arguments=[URL])
- 
-+    def test_reject_action_dash_prefixes(self):
-+        browser = self.browser_class(name=CMD_NAME)
-+        with self.assertRaises(ValueError):
-+            browser.open('%action--incognito')
-+        # new=1: action is "--new-window", so "%action" itself expands to
-+        # a dash-prefixed flag even with no dash in the original URL.
-+        with self.assertRaises(ValueError):
-+            browser.open('%action', new=1)
- 
- class MozillaCommandTest(CommandTestMixin, unittest.TestCase):
- 
-diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
-index 0fd0aeb3c1..026bdfbd7b 100755
--- a/Lib/webbrowser.py
-+++ b/Lib/webbrowser.py
-@@ -265,7 +265,6 @@ def _invoke(self, args, remote, autoraise, url=None):
- 
-     def open(self, url, new=0, autoraise=True):
-         sys.audit("webbrowser.open", url)
-        self._check_url(url)
-         if new == 0:
-             action = self.remote_action
-         elif new == 1:
-@@ -279,7 +278,9 @@ def open(self, url, new=0, autoraise=True):
-             raise Error("Bad 'new' parameter to open(); " +
-                         "expected 0, 1, or 2, got %s" % new)
- 
-        args = [arg.replace("%s", url).replace("%action", action)
-+        self._check_url(url.replace("%action", action))
-+
-+        args = [arg.replace("%action", action).replace("%s", url)
-                 for arg in self.remote_args]
-         args = [arg for arg in args if arg]
-         success = self._invoke(args, True, autoraise, url)
-diff --git a/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst b/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
-new file mode 100644
-index 0000000000..45cdeebe1b
--- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
-@@ -0,0 +1,2 @@
-+A bypass in :mod:`webbrowser` allowed URLs prefixed with ``%action`` to pass
-+the dash-prefix safety check.
--- a/00482-cve-2026-6100.patch
+++ b/00482-cve-2026-6100.patch
@ -1,48 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Stan Ulbrych <stan@python.org>
-Date: Mon, 13 Apr 2026 22:42:36 +0100
-Subject: 00482: CVE-2026-6100
-
-Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor
---
- .../Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst  | 5 +++++
- Modules/_bz2module.c                                         | 1 +
- Modules/_lzmamodule.c                                        | 1 +
- 3 files changed, 7 insertions(+)
- create mode 100644 Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
-
-diff --git a/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst b/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
-new file mode 100644
-index 0000000000..349d1cf3ca
--- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
-@@ -0,0 +1,5 @@
-+Fix a dangling input pointer in :class:`lzma.LZMADecompressor`,
-+and :class:`bz2.BZ2Decompressor`
-+when memory allocation fails with :exc:`MemoryError`, which could let a
-+subsequent :meth:`!decompress` call read or write through a stale pointer to
-+the already-released caller buffer.
-diff --git a/Modules/_bz2module.c b/Modules/_bz2module.c
-index 798e9efc62..b08ac5e44e 100644
--- a/Modules/_bz2module.c
-+++ b/Modules/_bz2module.c
-@@ -595,6 +595,7 @@ decompress(BZ2Decompressor *d, char *data, size_t len, Py_ssize_t max_length)
-     return result;
- 
- error:
-+    bzs->next_in = NULL;
-     Py_XDECREF(result);
-     return NULL;
- }
-diff --git a/Modules/_lzmamodule.c b/Modules/_lzmamodule.c
-index 97453a2808..51106a6a07 100644
--- a/Modules/_lzmamodule.c
-+++ b/Modules/_lzmamodule.c
-@@ -1105,6 +1105,7 @@ decompress(Decompressor *d, uint8_t *data, size_t len, Py_ssize_t max_length)
-     return result;
- 
- error:
-+    lzs->next_in = NULL;
-     Py_XDECREF(result);
-     return NULL;
- }
--- a/00483-cve-2026-2297.patch
+++ b/00483-cve-2026-2297.patch
@ -1,33 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Steve Dower <steve.dower@python.org>
-Date: Wed, 4 Mar 2026 19:55:52 +0000
-Subject: 00483: CVE-2026-2297
-
-Logging Bypass in Legacy .pyc File Handling
---
- Lib/importlib/_bootstrap_external.py                            | 2 +-
- .../Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst     | 2 ++
- 2 files changed, 3 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
-
-diff --git a/Lib/importlib/_bootstrap_external.py b/Lib/importlib/_bootstrap_external.py
-index e53f6acf38..588da3c7ad 100644
--- a/Lib/importlib/_bootstrap_external.py
-+++ b/Lib/importlib/_bootstrap_external.py
-@@ -1126,7 +1126,7 @@ def get_filename(self, fullname):
- 
-     def get_data(self, path):
-         """Return the data from path as raw bytes."""
-        if isinstance(self, (SourceLoader, ExtensionFileLoader)):
-+        if isinstance(self, (SourceLoader, SourcelessFileLoader, ExtensionFileLoader)):
-             with _io.open_code(str(path)) as file:
-                 return file.read()
-         else:
-diff --git a/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst b/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
-new file mode 100644
-index 0000000000..edeb9e640c
--- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
-@@ -0,0 +1,2 @@
-+Fixes CVE-2026-2297 by ensuring that ``SourcelessFileLoader`` uses
-+:func:`io.open_code` when opening ``.pyc`` files.
--- a/00484-cve-2026-3644.patch
+++ b/00484-cve-2026-3644.patch
@ -1,146 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
-Date: Mon, 16 Mar 2026 13:43:43 +0000
-Subject: 00484: CVE-2026-3644
-
-Incomplete control character validation in http.cookies
-
-Co-authored-by: Victor Stinner <victor.stinner@gmail.com>
---
- Lib/http/cookies.py                           | 24 ++++++++++--
- Lib/test/test_http_cookies.py                 | 38 +++++++++++++++++++
- ...-03-06-17-03-38.gh-issue-145599.kchwZV.rst |  4 ++
- 3 files changed, 62 insertions(+), 4 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
-
-diff --git a/Lib/http/cookies.py b/Lib/http/cookies.py
-index 5cfa7a8072..6b36ffa9f8 100644
--- a/Lib/http/cookies.py
-+++ b/Lib/http/cookies.py
-@@ -335,9 +335,16 @@ def update(self, values):
-             key = key.lower()
-             if key not in self._reserved:
-                 raise CookieError("Invalid attribute %r" % (key,))
-+            if _has_control_character(key, val):
-+                raise CookieError("Control characters are not allowed in "
-+                                  f"cookies {key!r} {val!r}")
-             data[key] = val
-         dict.update(self, data)
- 
-+    def __ior__(self, values):
-+        self.update(values)
-+        return self
-+
-     def isReservedKey(self, K):
-         return K.lower() in self._reserved
- 
-@@ -363,9 +370,15 @@ def __getstate__(self):
-         }
- 
-     def __setstate__(self, state):
-        self._key = state['key']
-        self._value = state['value']
-        self._coded_value = state['coded_value']
-+        key = state['key']
-+        value = state['value']
-+        coded_value = state['coded_value']
-+        if _has_control_character(key, value, coded_value):
-+            raise CookieError("Control characters are not allowed in cookies "
-+                              f"{key!r} {value!r} {coded_value!r}")
-+        self._key = key
-+        self._value = value
-+        self._coded_value = coded_value
- 
-     def output(self, attrs=None, header="Set-Cookie:"):
-         return "%s %s" % (header, self.OutputString(attrs))
-@@ -377,13 +390,16 @@ def __repr__(self):
- 
-     def js_output(self, attrs=None):
-         # Print javascript
-+        output_string = self.OutputString(attrs)
-+        if _has_control_character(output_string):
-+            raise CookieError("Control characters are not allowed in cookies")
-         return """
-         <script type="text/javascript">
-         <!-- begin hiding
-         document.cookie = \"%s\";
-         // end hiding -->
-         </script>
-        """ % (self.OutputString(attrs).replace('"', r'\"'))
-+        """ % (output_string.replace('"', r'\"'))
- 
-     def OutputString(self, attrs=None):
-         # Build up our result
-diff --git a/Lib/test/test_http_cookies.py b/Lib/test/test_http_cookies.py
-index 2438c57ef4..f9a846f8fa 100644
--- a/Lib/test/test_http_cookies.py
-+++ b/Lib/test/test_http_cookies.py
-@@ -527,6 +527,14 @@ def test_control_characters(self):
-             with self.assertRaises(cookies.CookieError):
-                 morsel["path"] = c0
- 
-+            # .__setstate__()
-+            with self.assertRaises(cookies.CookieError):
-+                morsel.__setstate__({'key': c0, 'value': 'val', 'coded_value': 'coded'})
-+            with self.assertRaises(cookies.CookieError):
-+                morsel.__setstate__({'key': 'key', 'value': c0, 'coded_value': 'coded'})
-+            with self.assertRaises(cookies.CookieError):
-+                morsel.__setstate__({'key': 'key', 'value': 'val', 'coded_value': c0})
-+
-             # .setdefault()
-             with self.assertRaises(cookies.CookieError):
-                 morsel.setdefault("path", c0)
-@@ -541,6 +549,18 @@ def test_control_characters(self):
-             with self.assertRaises(cookies.CookieError):
-                 morsel.set("path", "val", c0)
- 
-+            # .update()
-+            with self.assertRaises(cookies.CookieError):
-+                morsel.update({"path": c0})
-+            with self.assertRaises(cookies.CookieError):
-+                morsel.update({c0: "val"})
-+
-+            # .__ior__()
-+            with self.assertRaises(cookies.CookieError):
-+                morsel |= {"path": c0}
-+            with self.assertRaises(cookies.CookieError):
-+                morsel |= {c0: "val"}
-+
-     def test_control_characters_output(self):
-         # Tests that even if the internals of Morsel are modified
-         # that a call to .output() has control character safeguards.
-@@ -561,6 +581,24 @@ def test_control_characters_output(self):
-             with self.assertRaises(cookies.CookieError):
-                 cookie.output()
- 
-+        # Tests that .js_output() also has control character safeguards.
-+        for c0 in support.control_characters_c0():
-+            morsel = cookies.Morsel()
-+            morsel.set("key", "value", "coded-value")
-+            morsel._key = c0  # Override private variable.
-+            cookie = cookies.SimpleCookie()
-+            cookie["cookie"] = morsel
-+            with self.assertRaises(cookies.CookieError):
-+                cookie.js_output()
-+
-+            morsel = cookies.Morsel()
-+            morsel.set("key", "value", "coded-value")
-+            morsel._coded_value = c0  # Override private variable.
-+            cookie = cookies.SimpleCookie()
-+            cookie["cookie"] = morsel
-+            with self.assertRaises(cookies.CookieError):
-+                cookie.js_output()
-+
- 
- def load_tests(loader, tests, pattern):
-     tests.addTest(doctest.DocTestSuite(cookies))
-diff --git a/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst b/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
-new file mode 100644
-index 0000000000..fc2e503779
--- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
-@@ -0,0 +1,4 @@
-+Reject control characters in :class:`http.cookies.Morsel`
-+:meth:`~http.cookies.Morsel.update` and
-+:meth:`~http.cookies.BaseCookie.js_output`.
-+This addresses `CVE-2026-3644 <https://www.cve.org/CVERecord?id=CVE-2026-3644>`_.
--- a/00485-cve-2026-4224.patch
+++ b/00485-cve-2026-4224.patch
@ -1,98 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Stan Ulbrych <stan@python.org>
-Date: Wed, 8 Apr 2026 11:27:39 +0100
-Subject: 00485: CVE-2026-4224
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Stack overflow parsing XML with deeply nested DTD content models
-
-Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
---
- Lib/test/test_pyexpat.py                       | 18 ++++++++++++++++++
- ...6-03-14-17-31-39.gh-issue-145986.ifSSr8.rst |  4 ++++
- Modules/pyexpat.c                              |  9 ++++++++-
- 3 files changed, 30 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
-
-diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py
-index 9aa2fcedad..8afce3ffe1 100644
--- a/Lib/test/test_pyexpat.py
-+++ b/Lib/test/test_pyexpat.py
-@@ -675,6 +675,24 @@ def test_change_size_2(self):
-         parser.Parse(xml2, True)
-         self.assertEqual(self.n, 4)
- 
-+class ElementDeclHandlerTest(unittest.TestCase):
-+    def test_deeply_nested_content_model(self):
-+        # This should raise a RecursionError and not crash.
-+        # See https://github.com/python/cpython/issues/145986.
-+        N = 500_000
-+        data = (
-+            b'<!DOCTYPE root [\n<!ELEMENT root '
-+            + b'(a, ' * N + b'a' + b')' * N
-+            + b'>\n]>\n<root/>\n'
-+        )
-+
-+        parser = expat.ParserCreate()
-+        parser.ElementDeclHandler = lambda _1, _2: None
-+        with support.infinite_recursion():
-+            with self.assertRaises(RecursionError):
-+                parser.Parse(data)
-+
-+
- class MalformedInputTest(unittest.TestCase):
-     def test1(self):
-         xml = b"\0\r\n"
-diff --git a/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst b/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
-new file mode 100644
-index 0000000000..cb9dbadb72
--- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
-@@ -0,0 +1,4 @@
-+:mod:`xml.parsers.expat`: Fixed a crash caused by unbounded C recursion when
-+converting deeply nested XML content models with
-+:meth:`~xml.parsers.expat.xmlparser.ElementDeclHandler`.
-+This addresses `CVE-2026-4224 <https://www.cve.org/CVERecord?id=CVE-2026-4224>`_.
-diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
-index 7b76ddfabd..13c4e8e0ad 100644
--- a/Modules/pyexpat.c
-+++ b/Modules/pyexpat.c
-@@ -3,6 +3,7 @@
- #endif
- 
- #include "Python.h"
-+#include "pycore_ceval.h"           // _Py_EnterRecursiveCall()
- #include "pycore_runtime.h"         // _Py_ID()
- #include <ctype.h>
- 
-@@ -578,6 +579,10 @@ static PyObject *
- conv_content_model(XML_Content * const model,
-                    PyObject *(*conv_string)(const XML_Char *))
- {
-+    if (_Py_EnterRecursiveCall(" in conv_content_model")) {
-+        return NULL;
-+    }
-+
-     PyObject *result = NULL;
-     PyObject *children = PyTuple_New(model->numchildren);
-     int i;
-@@ -589,7 +594,7 @@ conv_content_model(XML_Content * const model,
-                                                  conv_string);
-             if (child == NULL) {
-                 Py_XDECREF(children);
-                return NULL;
-+                goto done;
-             }
-             PyTuple_SET_ITEM(children, i, child);
-         }
-@@ -597,6 +602,8 @@ conv_content_model(XML_Content * const model,
-                                model->type, model->quant,
-                                conv_string,model->name, children);
-     }
-+done:
-+    _Py_LeaveRecursiveCall();
-     return result;
- }
- 
--- a/00494-increase-the-timeout-of-test_large_content_length_truncated.patch
+++ b/00494-increase-the-timeout-of-test_large_content_length_truncated.patch
@ -0,0 +1,23 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Karolina Surma <ksurma@redhat.com>
+Date: Fri, 14 Aug 2026 09:38:26 +0200
+Subject: 00494: Increase the timeout of test_large_content_length_truncated
+
+It has started to fail randomly when run on s390x architecture.
+---
+ Lib/test/test_httpservers.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
+index b0b09daab0..59434936b7 100644
+--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
+@@ -899,7 +899,7 @@ def test_large_content_length(self):
+             self.assertEqual(res.read(), b'%d %d' % (size, size) + self.linesep)
+ 
+     def test_large_content_length_truncated(self):
+-        with support.swap_attr(self.request_handler, 'timeout', 0.001):
+        with support.swap_attr(self.request_handler, 'timeout', support.LOOPBACK_TIMEOUT):
+             for w in range(18, 65):
+                 size = 1 << w
+                 headers = {'Content-Length' : str(size)}
--- a/plan.fmf
+++ b/plan.fmf
@ -34,6 +34,9 @@ discover:
    - name: marshalparser
      path: /marshalparser
      test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh"
+    - name: required_symbols
+      path: /required-symbols
+      test: "VERSION=${pybasever} ./check.sh"

 prepare:
  - name: Install dependencies
@ -51,8 +54,9 @@ prepare:
    - virtualenv  # for virtualenv tests
    - glibc-all-langpacks # for locale tests
    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
+    - binutils  # for nm (symbol inspection)
    - rpm  # for debugging
-    - dnf  # for upgrade
+    - dnf  # for upgrade and downgrade
  - name: Update packages
    how: shell
    script: dnf upgrade -y
--- a/python3.11.spec
+++ b/python3.11.spec
@ -13,11 +13,11 @@ URL: https://www.python.org/

 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.15
+%global general_version %{pybasever}.16
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 4%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1


@ -367,47 +367,11 @@ Patch474: 00474-cve-2025-15366.patch
 # (cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
 Patch475: 00475-cve-2025-15367.patch

-# 00478 # 40c5c88950b10eaf1c10c5afcc39887b8e23c997
-# CVE-2026-4519
+# 00494 # 430aab133397ed44cc9ee621fd311e02fee317b5
+# Increase the timeout of test_large_content_length_truncated
 #
-# Reject leading dashes in webbrowser URLs (GH-143931) (GH-146364)
-Patch478: 00478-cve-2026-4519.patch
-
-# 00479 # 6fe61dd71dec5b7c9de2b1994172981667d034a1
-# CVE-2026-1502
-#
-# Reject CR/LF in HTTP tunnel request headers
-Patch479: 00479-cve-2026-1502.patch
-
-# 00480 # 9f4b1483ecfbc8c08117133c239fba544fcb42e7
-# CVE-2026-4786
-#
-# Fix webbrowser `%%action` substitution bypass of dash-prefix check
-Patch480: 00480-cve-2026-4786.patch
-
-# 00482 # 2a21454e658935990766df8c3c48af9363e8422a
-# CVE-2026-6100
-#
-# Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor
-Patch482: 00482-cve-2026-6100.patch
-
-# 00483 # cdb097a23eac5a09fb063a0e91001f69ff324205
-# CVE-2026-2297
-#
-# Logging Bypass in Legacy .pyc File Handling
-Patch483: 00483-cve-2026-2297.patch
-
-# 00484 # cf0bd2f2cce15cb35558aa08de34e9d18a8089f7
-# CVE-2026-3644
-#
-# Incomplete control character validation in http.cookies
-Patch484: 00484-cve-2026-3644.patch
-
-# 00485 # 54d821ba2f5a03ccced037978fcdb0a7c4d6878f
-# CVE-2026-4224
-#
-# Stack overflow parsing XML with deeply nested DTD content models
-Patch485: 00485-cve-2026-4224.patch
+# It has started to fail randomly when run on s390x architecture.
+Patch494: 00494-increase-the-timeout-of-test_large_content_length_truncated.patch

 # (New patches go here ^^^)
 #
@ -1741,6 +1705,19 @@ CheckPython optimized
 # ======================================================

 %changelog
+* Thu Aug 13 2026 Karolina Surma <ksurma@redhat.com> - 3.11.16-1
+- Update to Python 3.11.16
+
+* Thu Jul 30 2026 Miro Hrončok <mhroncok@redhat.com> - 3.11.15-7
+ - Skip UDP Lite tests if it's not supported
+ - Fixes FTBFS on Linux kernel 7.1 and newer
+
+* Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.15-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Thu Jul 02 2026 Miro Hrončok <mhroncok@redhat.com> - 3.11.15-5
+- Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+
+
 * Fri Apr 17 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.11.15-4
 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE 2026-3644, CVE-2026-4224
 Resolves: rhbz#2457941, rhbz#2458221, rhbz#2458013, rhbz#2444704, rhbz#2448188, rhbz#2448204
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (Python-3.11.15.tar.xz) = 1667f4839acfd23d05917a12993983b7dc3ab4438a37c72496fd040ac6981f4dea9dc95461ca701a6862beedb56c423fb83398b8b18e39e1efe12f539fced1c1
-SHA512 (Python-3.11.15.tar.xz.asc) = 673822ca037acb521bf7d3e7433f83cc2d60c8d102cfbf6695234e2a50ce12a7003040ad4017438510ebbb1ff0ba6727253fae250b07bc0e3d24b5578e80be52
+SHA512 (Python-3.11.16.tar.xz) = f4e168d35596c2df080663d8e8b3472f03bace987d46b49b8410f2425ba193215b9880c7d03d4653ec31c83b72209d95866fc1cb6d666799145075b092f64a48
+SHA512 (Python-3.11.16.tar.xz.asc) = b31b3205e68951478fe76f4884a124ebb4955a711b6105754d4179acb48b16a5439ec8c35383a84787cd673fa1143f2f047c6d65944909b0f1a8e3c75a0e2efe
Author	SHA1	Message	Date
Karolina Surma	278eb3fa41	Update to Python 3.11.16	2026-08-14 11:29:55 +02:00
Miro Hrončok	dadebe1c22	Skip UDP Lite tests if it's not supported - Fixes FTBFS on Linux kernel 7.1 and newer	2026-07-30 17:24:31 +02:00
Fedora Release Engineering	79c55d4ad7	Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild	2026-07-16 22:47:27 +00:00
Lumír Balhar	55cc855c79	Run a new test to monitor changes in required symbols Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>	2026-07-03 12:24:01 +02:00
Miro Hrončok	fc0070dafa	Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+	2026-07-02 10:54:53 +02:00