rpms/python3.9
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security fix for CVE-2024-4032 (rhbz#2293397)

Browse source
This commit is contained in:
Lumir Balhar 2024-08-14 07:34:35 +02:00
commit d6f5072e8d
2 changed files with 433 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

35
python3.9.spec
View file

@ -17,7 +17,7 @@ URL: https://www.python.org/
#global prerel ...
%global upstream_version %{general_version}%{?prerel}
Version: %{general_version}%{?prerel:~%{prerel}}
Release: 4%{?dist}
Release: 5%{?dist}
License: Python
@ -400,6 +400,36 @@ Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-par
# zlib-ng defines the version as "1.3.0.zlib-ng".
Patch419: 00419-gh-112769-test_zlib-fix-comparison-of-zlib_runtime_version-with-non-int-suffix-gh-112771-gh-112774.patch
# 00431 # 1216ca6d2f3d6fc7ef7bf33b78b7a887be02e467
# gh-113171: gh-65056: Fix "private" (non-global) IP address ranges (GH-113179) (GH-113186) (GH-118177) (GH-118472)
#
# The _private_networks variables, used by various is_private
# implementations, were missing some ranges and at the same time had
# overly strict ranges (where there are more specific ranges considered
# globally reachable by the IANA registries).
#
# This patch updates the ranges with what was missing or otherwise
# incorrect.
#
# 100.64.0.0/10 is left alone, for now, as it's been made special in [1].
#
# The _address_exclude_many() call returns 8 networks for IPv4, 121
# networks for IPv6.
#
# [1] https://github.com/python/cpython/issues/61602
#
# In 3.10 and below, is_private checks whether the network and broadcast
# address are both private.
# In later versions (where the test wss backported from), it checks
# whether they both are in the same private network.
#
# For 0.0.0.0/0, both 0.0.0.0 and 255.225.255.255 are private,
# but one is in 0.0.0.0/8 ("This network") and the other in
# 255.255.255.255/32 ("Limited broadcast").
#
# ---------
Patch431: 00431-gh-113171-gh-65056-fix-private-non-global-ip-address-ranges-gh-113179-gh-113186-gh-118177-gh-118472.patch
# (New patches go here ^^^)
#
# When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@ -1842,6 +1872,9 @@ CheckPython optimized
# ======================================================
%changelog
* Tue Aug 13 2024 Lumír Balhar <lbalhar@redhat.com> - 3.9.19-5
- Security fix for CVE-2024-4032 (rhbz#2293397)
* Tue Jul 23 2024 Lumír Balhar <lbalhar@redhat.com> - 3.9.19-4
- Require systemtap-sdt-devel for sys/sdt.h