]> git.ipfire.org Git - thirdparty/openembedded/openembedded-core.git/commit
python3: upgrade 3.8.13 -> 3.8.14
authorTim Orling <ticotimo@gmail.com>
Tue, 11 Oct 2022 18:40:43 +0000 (11:40 -0700)
committerSteve Sakoman <steve@sakoman.com>
Tue, 11 Oct 2022 21:50:48 +0000 (11:50 -1000)
commit25fafd35a4698daa0d4abb814a91601e68223128
treea7964d326a6b7b1c1e5050ac250ee87f0a503d97
parent0f4b1db4fdc655e880ec66525eb7642978529e82
python3: upgrade 3.8.13 -> 3.8.14

Security and bug fixes.

* Drop CVE-2021-28861.patch as it was merged in 3.8.14 release.

Fixes:
  * CVE-2020-10735
    https://nvd.nist.gov/vuln/detail/CVE-2020-10735
  * CVE-2021-28861
    https://nvd.nist.gov/vuln/detail/CVE-2021-28861
  * CVE-2018-25032
    https://nvd.nist.gov/vuln/detail/CVE-2018-25032

Python 3.8.14
Release Date: Sept. 6, 2022

This is a security release of Python 3.8
Note: The release you're looking at is Python 3.8.14, a security bugfix
      release for the legacy 3.8 series. Python 3.10 is now the latest
      feature release series of Python 3.

Security content in this release
CVE-2020-10735: converting between int and str in bases other than
  2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base
  10 (decimal) now raises a ValueError if the number of digits in string
  form is above a limit to avoid potential denial of service attacks due
  to the algorithmic complexity.
gh-87389: http.server: Fix an open redirection vulnerability in the HTTP
  server when an URI path starts with //.
gh-93065: Fix contextvars HAMT implementation to handle iteration over
  deep trees to avoid a potential crash of the interpreter.
gh-90355: Fix ensurepip environment isolation for the subprocess running
  pip.
gh-80254: Raise ProgrammingError instead of segfaulting on recursive usage
  of cursors in sqlite3 converters.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
meta/recipes-devtools/python/python3/CVE-2021-28861.patch [deleted file]
meta/recipes-devtools/python/python3_3.8.14.bb [moved from meta/recipes-devtools/python/python3_3.8.13.bb with 98% similarity]