rpms/python3.12
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update to Python 3.12.14

Browse source
This commit is contained in:
Karolina Surma 2026-08-13 11:37:38 +02:00
commit 5590da1492
13 changed files with 34 additions and 970 deletions
Download patch file Download diff file Expand all files Collapse all files

84
python3.12.spec
View file

@ -13,11 +13,11 @@ URL: https://www.python.org/
# WARNING When rebasing to a new Python version,
# remember to update the python3-docs package as well
%global general_version %{pybasever}.13
%global general_version %{pybasever}.14
#global prerel ...
%global upstream_version %{general_version}%{?prerel}
Version: %{general_version}%{?prerel:~%{prerel}}
Release: 6%{?dist}
Release: 1%{?dist}
License: Python-2.0.1
@ -400,23 +400,6 @@ Patch461: 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.p
# stressed on OpenSSL 3.5.
Patch462: 00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
# 00464 # 1c713e02a26bf8865bb6421749d19d0766cac178
# Enable PAC and BTI protections for aarch64
#
# Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S
#
# The BTI flag must be applied in the assembler sources for this class
# of attacks to be mitigated on newer aarch64 processors.
#
# Upstream PR: https://github.com/python/cpython/pull/130864/files
#
# The upstream patch is incomplete but only for the case where
# frame pointers are not used on 3.13+.
#
# Since on Fedora we always compile with frame pointers the BTI/PAC
# hardware protections can be enabled without losing Perf unwinding.
Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch
# 00474 # 837ddca0372fa87ff9cee47142200caa21e77def
# CVE-2025-15366
#
@ -433,63 +416,11 @@ Patch474: 00474-cve-2025-15366.patch
# (cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
Patch475: 00475-cve-2025-15367.patch
# 00478 # eb93352dc8e31f4d52546b84daad875e6ff7f29e
# CVE-2026-4519
# 00494 # 430aab133397ed44cc9ee621fd311e02fee317b5
# Increase the timeout of test_large_content_length_truncated
#
# Reject leading dashes in webbrowser URLs (GH-146360)
Patch478: 00478-cve-2026-4519.patch
# 00479 # 97404b2cf62e545c2d41be7ccfed4e74da9ee665
# CVE-2026-1502
#
# Reject CR/LF in HTTP tunnel request headers
Patch479: 00479-cve-2026-1502.patch
# 00480 # 6f4eef3ba4d9818a53698e994550ee8db17a1e2e
# CVE-2026-4786
#
# Fix webbrowser `%%action` substitution bypass of dash-prefix check
Patch480: 00480-cve-2026-4786.patch
# 00482 # 69f14bc306fc62400d45565faa980b77858b9151
# CVE-2026-6100
#
# Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor
Patch482: 00482-cve-2026-6100.patch
# 00483 # 577c595137ce6ff92158ddaf2d7b7ea86437825d
# CVE-2026-2297
#
# Logging Bypass in Legacy .pyc File Handling
Patch483: 00483-cve-2026-2297.patch
# 00484 # 8b5133c1ab17a060cd134bea2a4b6e1831c47fed
# CVE-2026-3644
#
# Incomplete control character validation in http.cookies
Patch484: 00484-cve-2026-3644.patch
# 00485 # 12a5b206676927bcee131ab4f2bd6783d2f5914a
# CVE-2026-4224
#
# Stack overflow parsing XML with deeply nested DTD content models
Patch485: 00485-cve-2026-4224.patch
# 00490 # 3e8c5ad70d6a515107352d8779269240a0553f54
# gh-153030: Fix quadratic complexity in incremental parsing in HTMLParser
#
# When an unterminated construct (e.g. a tag or comment) spanned many
# feed() calls, rescanning the growing buffer and concatenating new data
# onto it were both quadratic. New data is now accumulated in a list and
# only joined and parsed once enough has piled up.
Patch490: 00490-cve-2026-15308.patch
# 00491 # 1ad95144c42a6933283352245c5df5a4c142e75f
# gh-149776: Skip UDP Lite tests if it's not supported
#
# Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if
# it's not supported.
Patch491: 00491-gh-149776-skip-udp-lite-tests-if-it-s-not-supported.patch
# It has started to fail randomly when run on s390x architecture.
Patch494: 00494-increase-the-timeout-of-test_large_content_length_truncated.patch
# (New patches go here ^^^)
#
@ -1827,6 +1758,9 @@ CheckPython optimized
# ======================================================
%changelog
* Thu Aug 13 2026 Karolina Surma <ksurma@redhat.com> - 3.12.14-1
- Update to Python 3.12.14
* Tue Jul 28 2026 Lukáš Zachar <lzachar@redhat.com> - 3.12.13-6
- Security fix for CVE-2026-15308
Resolves: rhbz#2498688