Security fix for CVE-2025-0938

Fixes: rhbz#2343274

python3.13.spec

@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: Python-2.0.1
 
 
@@ -366,6 +366,10 @@ Patch251: 00251-change-user-install-location.patch
 # Resolved upstream: https://github.com/python/cpython/issues/127655
 Patch445: 00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch
 
+# 00450 # 4ab8663661748eb994c09e4ae89f59eb84c5d3ea
+# CVE-2025-0938: Disallow square brackets ([ and ]) in domain names for parsed URLs
+Patch450: 00450-cve-2025-0938-disallow-square-brackets-and-in-domain-names-for-parsed-urls.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1719,6 +1723,10 @@ CheckPython freethreading
 # ======================================================
 
 %changelog
+* Tue Feb 04 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.13.1-5
+- Security fix for CVE-2025-0938
+- Fixes: rhbz#2343274
+
 * Wed Jan 29 2025 Miro Hrončok <mhroncok@redhat.com> - 3.13.1-4
 - On Fedora 41 or older, statically build the _datetime module into libpython
 - This fixes a segfault when importing it from Python 3.13.0 updated to 3.13.1+ while running