Update to 3.13.2
Security fix for CVE-2025-0938 Fixes: rhbz#2343274
This commit is contained in:
Charalampos Stratakis
parent
fd1e3b0098
commit
4f7875132e
3 changed files with 9 additions and 74 deletions
|
|
@ -1,62 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: "Miss Islington (bot)"
|
||||
<31488909+miss-islington@users.noreply.github.com>
|
||||
Date: Fri, 6 Dec 2024 06:12:40 +0100
|
||||
Subject: [PATCH] 00445: CVE-2024-12254: Ensure
|
||||
_SelectorSocketTransport.writelines pauses the protocol if needed
|
||||
|
||||
Ensure _SelectorSocketTransport.writelines pauses the protocol if it reaches the high water mark as needed.
|
||||
|
||||
Resolved upstream: https://github.com/python/cpython/issues/127655
|
||||
|
||||
Co-authored-by: J. Nick Koston <nick@koston.org>
|
||||
Co-authored-by: Kumar Aditya <kumaraditya@python.org>
|
||||
---
|
||||
Lib/asyncio/selector_events.py | 1 +
|
||||
Lib/test/test_asyncio/test_selector_events.py | 12 ++++++++++++
|
||||
.../2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst | 1 +
|
||||
3 files changed, 14 insertions(+)
|
||||
create mode 100644 Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst
|
||||
|
||||
diff --git a/Lib/asyncio/selector_events.py b/Lib/asyncio/selector_events.py
|
||||
index f94bf10b42..f1ab9b12d6 100644
|
||||
--- a/Lib/asyncio/selector_events.py
|
||||
+++ b/Lib/asyncio/selector_events.py
|
||||
@@ -1175,6 +1175,7 @@ def writelines(self, list_of_data):
|
||||
# If the entire buffer couldn't be written, register a write handler
|
||||
if self._buffer:
|
||||
self._loop._add_writer(self._sock_fd, self._write_ready)
|
||||
+ self._maybe_pause_protocol()
|
||||
|
||||
def can_write_eof(self):
|
||||
return True
|
||||
diff --git a/Lib/test/test_asyncio/test_selector_events.py b/Lib/test/test_asyncio/test_selector_events.py
|
||||
index aaeda33dd0..efca30f374 100644
|
||||
--- a/Lib/test/test_asyncio/test_selector_events.py
|
||||
+++ b/Lib/test/test_asyncio/test_selector_events.py
|
||||
@@ -805,6 +805,18 @@ def test_writelines_send_partial(self):
|
||||
self.assertTrue(self.sock.send.called)
|
||||
self.assertTrue(self.loop.writers)
|
||||
|
||||
+ def test_writelines_pauses_protocol(self):
|
||||
+ data = memoryview(b'data')
|
||||
+ self.sock.send.return_value = 2
|
||||
+ self.sock.send.fileno.return_value = 7
|
||||
+
|
||||
+ transport = self.socket_transport()
|
||||
+ transport._high_water = 1
|
||||
+ transport.writelines([data])
|
||||
+ self.assertTrue(self.protocol.pause_writing.called)
|
||||
+ self.assertTrue(self.sock.send.called)
|
||||
+ self.assertTrue(self.loop.writers)
|
||||
+
|
||||
@unittest.skipUnless(selector_events._HAS_SENDMSG, 'no sendmsg')
|
||||
def test_write_sendmsg_full(self):
|
||||
data = memoryview(b'data')
|
||||
diff --git a/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst b/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst
|
||||
new file mode 100644
|
||||
index 0000000000..76cfc58121
|
||||
--- /dev/null
|
||||
+++ b/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst
|
||||
@@ -0,0 +1 @@
|
||||
+Fixed the :class:`!asyncio.selector_events._SelectorSocketTransport` transport not pausing writes for the protocol when the buffer reaches the high water mark when using :meth:`asyncio.WriteTransport.writelines`.
|
||||
|
|
@ -13,11 +13,11 @@ URL: https://www.python.org/
|
|||
|
||||
# WARNING When rebasing to a new Python version,
|
||||
# remember to update the python3-docs package as well
|
||||
%global general_version %{pybasever}.1
|
||||
%global general_version %{pybasever}.2
|
||||
#global prerel ...
|
||||
%global upstream_version %{general_version}%{?prerel}
|
||||
Version: %{general_version}%{?prerel:~%{prerel}}
|
||||
Release: 4%{?dist}
|
||||
Release: 1%{?dist}
|
||||
License: Python-2.0.1
|
||||
|
||||
|
||||
|
|
@ -358,14 +358,6 @@ Source11: idle3.appdata.xml
|
|||
# pypa/distutils integration: https://github.com/pypa/distutils/pull/70
|
||||
Patch251: 00251-change-user-install-location.patch
|
||||
|
||||
# 00445 # d1a32daddefad32ceb93155552858c0a0311b23e
|
||||
# CVE-2024-12254: Ensure _SelectorSocketTransport.writelines pauses the protocol if needed
|
||||
#
|
||||
# Ensure _SelectorSocketTransport.writelines pauses the protocol if it reaches the high water mark as needed.
|
||||
#
|
||||
# Resolved upstream: https://github.com/python/cpython/issues/127655
|
||||
Patch445: 00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch
|
||||
|
||||
# (New patches go here ^^^)
|
||||
#
|
||||
# When adding new patches to "python" and "python3" in Fedora, EL, etc.,
|
||||
|
|
@ -1719,6 +1711,11 @@ CheckPython freethreading
|
|||
# ======================================================
|
||||
|
||||
%changelog
|
||||
* Tue Feb 04 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.13.2-1
|
||||
- Update to 3.13.2
|
||||
- Security fix for CVE-2025-0938
|
||||
- Fixes: rhbz#2343274
|
||||
|
||||
* Wed Jan 29 2025 Miro Hrončok <mhroncok@redhat.com> - 3.13.1-4
|
||||
- On Fedora 41 or older, statically build the _datetime module into libpython
|
||||
- This fixes a segfault when importing it from Python 3.13.0 updated to 3.13.1+ while running
|
||||
|
|
|
|||
4
sources
4
sources
|
|
@ -1,2 +1,2 @@
|
|||
SHA512 (Python-3.13.1.tar.xz) = 056c9b5fc0a6b540f41513d045f43c1ed463d15e0f345cecec703ec9c2335e53b4beb19de9c74ab2b236b023f934d5fd9ae7727a808634eaa01cfe66018a9a35
|
||||
SHA512 (Python-3.13.1.tar.xz.asc) = 1b56b7c2f547aa39c75c18978e174debb113444ce3f9da3829ba6842e3160051e0de70bd49d306b8014299aa8aa911d7c67efe71dd648c3528cf8d7535a01599
|
||||
SHA512 (Python-3.13.2.tar.xz) = bb1c0598914c6d4326554faa568f660f10b20c701d0f36bf1fa58837b6498d728a407416b06ede39604caea1ca93f60545b83b01ae8ee65f55d4cc83242b63fe
|
||||
SHA512 (Python-3.13.2.tar.xz.asc) = 5f019be530f688b0adf5d5cc9f2c2243e2f1dc7338559db14c1eedd12aadc85404d42c7aafd74e41828205d85f13f278876662ac30c8f3382a1ee081ba5f29f2
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue