rpms/python3.12
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224

Browse source 
Resolves: rhbz#2444705, rhbz#2448189, rhbz#2448205, rhbz#2457942, rhbz#2458014, rhbz#2458222
This commit is contained in:
Charalampos Stratakis 2026-04-16 05:33:50 +02:00
commit 5b0b65def8
7 changed files with 550 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

42
python3.12.spec
View file

@ -17,7 +17,7 @@ URL: https://www.python.org/
#global prerel ...
%global upstream_version %{general_version}%{?prerel}
Version: %{general_version}%{?prerel:~%{prerel}}
Release: 2%{?dist}
Release: 3%{?dist}
License: Python-2.0.1
@ -439,6 +439,42 @@ Patch475: 00475-cve-2025-15367.patch
# Reject leading dashes in webbrowser URLs (GH-146360)
Patch478: 00478-cve-2026-4519.patch
# 00479 # 97404b2cf62e545c2d41be7ccfed4e74da9ee665
# CVE-2026-1502
#
# Reject CR/LF in HTTP tunnel request headers
Patch479: 00479-cve-2026-1502.patch
# 00480 # 6f4eef3ba4d9818a53698e994550ee8db17a1e2e
# CVE-2026-4786
#
# Fix webbrowser `%%action` substitution bypass of dash-prefix check
Patch480: 00480-cve-2026-4786.patch
# 00482 # 69f14bc306fc62400d45565faa980b77858b9151
# CVE-2026-6100
#
# Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor
Patch482: 00482-cve-2026-6100.patch
# 00483 # 577c595137ce6ff92158ddaf2d7b7ea86437825d
# CVE-2026-2297
#
# Logging Bypass in Legacy .pyc File Handling
Patch483: 00483-cve-2026-2297.patch
# 00484 # 8b5133c1ab17a060cd134bea2a4b6e1831c47fed
# CVE-2026-3644
#
# Incomplete control character validation in http.cookies
Patch484: 00484-cve-2026-3644.patch
# 00485 # 12a5b206676927bcee131ab4f2bd6783d2f5914a
# CVE-2026-4224
#
# Stack overflow parsing XML with deeply nested DTD content models
Patch485: 00485-cve-2026-4224.patch
# (New patches go here ^^^)
#
# When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@ -1775,6 +1811,10 @@ CheckPython optimized
# ======================================================
%changelog
* Thu Apr 16 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.12.13-3
- Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224
Resolves: rhbz#2444705, rhbz#2448189, rhbz#2448205, rhbz#2457942, rhbz#2458014, rhbz#2458222
* Thu Mar 26 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.13-2
- Security fix for CVE-2026-4519 (rhbz#2449728)