Security fix for CVE-2024-6923 (rhbz#2303164)

python3.9.spec

@@ -430,6 +430,25 @@ Patch419: 00419-gh-112769-test_zlib-fix-comparison-of-zlib_runtime_version-with-
 # ---------
 Patch431: 00431-gh-113171-gh-65056-fix-private-non-global-ip-address-ranges-gh-113179-gh-113186-gh-118177-gh-118472.patch
 
+# 00435 # f2924d30f4dd44804219c10410a57dd96764d297
+# gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233)
+#
+# Per RFC 2047:
+#
+# > [...] these encoding schemes allow the
+# > encoding of arbitrary octet values, mail readers that implement this
+# > decoding should also ensure that display of the decoded data on the
+# > recipient's terminal will not cause unwanted side-effects
+#
+# It seems that the "quoted-word" scheme is a valid way to include
+# a newline character in a header value, just like we already allow
+# undecodable bytes or control characters.
+# They do need to be properly quoted when serialized to text, though.
+#
+# This should fail for custom fold() implementations that aren't careful
+# about newlines.
+Patch435: 00435-gh-121650-encode-newlines-in-headers-and-verify-headers-are-sound-gh-122233.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1874,6 +1893,7 @@ CheckPython optimized
 %changelog
 * Tue Aug 13 2024 Lumír Balhar <lbalhar@redhat.com> - 3.9.19-5
 - Security fix for CVE-2024-4032 (rhbz#2293397)
+- Security fix for CVE-2024-6923 (rhbz#2303164)
 
 * Tue Jul 23 2024 Lumír Balhar <lbalhar@redhat.com> - 3.9.19-4
 - Require systemtap-sdt-devel for sys/sdt.h