Security fix for CVE-2024-6923

- Fixes: rhbz#2303160

python3.13.spec

@@ -407,6 +407,29 @@ Patch429: 00429-gh-118943-fix-another-race-condition-when-generating-jit_stencil
 # Add an unit test on PyEval_GetLocals().
 Patch434: 00434-gh-122728-fix-systemerror-in-pyeval_getlocals.patch
 
+# 00435 # 66908394adb797c2c8463a74027c8646514423a0
+# gh-121650: Encode newlines in headers, and verify headers are sound
+#
+# Encode header parts that contain newlines
+#
+# Per RFC 2047:
+#
+# > [...] these encoding schemes allow the
+# > encoding of arbitrary octet values, mail readers that implement this
+# > decoding should also ensure that display of the decoded data on the
+# > recipient's terminal will not cause unwanted side-effects
+#
+# It seems that the "quoted-word" scheme is a valid way to include
+# a newline character in a header value, just like we already allow
+# undecodable bytes or control characters.
+# They do need to be properly quoted when serialized to text, though.
+#
+# Verify that email headers are well-formed
+#
+# This should fail for custom fold() implementations that aren't careful
+# about newlines.
+Patch435: 00435-gh-121650-encode-newlines-in-headers-and-verify-headers-are-sound.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1751,6 +1774,8 @@ CheckPython freethreading
 * Tue Aug 06 2024 Miro Hrončok <mhroncok@redhat.com> - 3.13.0~rc1-2
 - Fix SystemError in PyEval_GetLocals()
 - Fixes: rhbz#2303107
+- Security fix for CVE-2024-6923
+- Fixes: rhbz#2303160
 
 * Thu Aug 01 2024 Karolina Surma <ksurma@redhat.com> - 3.13.0~rc1-1
 - Update to Python 3.13.0rc1