Cheryl Sabella [Mon, 4 Mar 2019 00:01:39 +0000 (19:01 -0500)]
[3.4] bpo-33329: Fix multiprocessing regression on newer glibcs (GH-6575) (#12145)
Starting with glibc 2.27.9000-xxx, sigaddset() can return EINVAL for some
reserved signal numbers between 1 and NSIG. The `range(1, NSIG)` idiom
is commonly used to select all signals for blocking with `pthread_sigmask`.
So we ignore the sigaddset() return value until we expose sigfillset()
to provide a better idiom.
(cherry picked from commit 25038ec)
Victor Stinner [Mon, 25 Feb 2019 21:28:36 +0000 (22:28 +0100)]
bpo-35746: Fix segfault in ssl's cert parser (GH-11569) (#11868)
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.
Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas
Edet of Cisco.
The regex to test a mail server's timestamp is susceptible to
catastrophic backtracking on long evil responses from the server.
Happily, the maximum length of malicious inputs is 2K thanks
to a limit introduced in the fix for CVE-2013-1752.
A 2KB evil response from the mail server would result in small slowdowns
(milliseconds vs. microseconds) accumulated over many apop calls.
This is a potential DOS vector via accumulated slowdowns.
Replace it with a similar non-vulnerable regex.
The new regex is RFC compliant.
The old regex was non-compliant in edge cases.
* Prevent difflib REDOS (CVE-2018-1061)
The default regex for IS_LINE_JUNK is susceptible to
catastrophic backtracking.
This is a potential DOS vector.
Replace it with an equivalent non-vulnerable regex.
Also introduce unit and REDOS tests for difflib.
Co-authored-by: Tim Peters <tim.peters@gmail.com> Co-authored-by: Christian Heimes <christian@python.org>.
larryhastings [Sun, 4 Feb 2018 19:37:08 +0000 (11:37 -0800)]
[3.4] [3.5] bpo-32620: Remove failing pyenv call from CI config (GH-5274) (#5533)
* [3.5] Remove failing pyenv call from CI config
* Backport XML RPC test skip to 3.5
The buildbot service upgrade removed the XML-RPC
interface, so this test no longer works (through no
fault of the standard library).
(cherry picked from commit 4a4c2743133e195cc3725b78a895d85d69e50089)
Serhiy Storchaka [Mon, 22 Jan 2018 10:18:00 +0000 (12:18 +0200)]
[3.4] bpo-32072: Fix issues with binary plists. (GH-4455) (#4658)
* [3.4] bpo-32072: Fix issues with binary plists. (GH-4455)
* Fixed saving bytearrays.
* Identical objects will be saved only once.
* Equal references will be load as identical objects.
* Added support for saving and loading recursive data structures..
(cherry picked from commit a897aeeef647259a938a36cb5eb6680c86021c6a)
* Fix implementation dependent assertion in test_plistlib. (#4813)
Victor Stinner [Sun, 24 Sep 2017 08:04:53 +0000 (01:04 -0700)]
[3.4][Security] bpo-30947, bpo-31170: Update expat from 2.2.1 to 2.2.4 (#3353)
* bpo-30947, bpo-31170: Update expat from 2.2.1 to 2.2.4
* Upgrade libexpat embedded copy from version 2.2.1 to 2.2.3 to get security
fixes.
* Update libexpat from 2.2.3 to 2.2.4. Fix copying of partial
characters for UTF-8 input (libexpat bug 115):
https://github.com/libexpat/libexpat/issues/115
The public cyrus.andrew.cmu.edu IMAP server (port 993) doesn't accept
TLS connection using our self-signed x509 certificate. Remove the two
tests which are already skipped.
(cherry picked from commit 7895a0585b4b6a1c8082d17227307c6ce2c8bb8b)
* Backport CI config from master
* Add .travis.yml for Travis CI
* Add .github/ for AppVeyor and CodeCov.
* Travis CI: remove "make regen-all" check
The regen-all Makefile rule doesn't exist in Python 3.4, only since
Python 3.5 and newer (and 2.7).
* appveyor: replace --slowest with --slow
* Travis CI: remove the GCC coverage job
* Travis CI: remove tzdata resource from regrtest
tzdata resource doesn't exist in Python 3.4.
* Travis CI: remove the doc job
Fixing Sphinx warnings requires to backport huge intrusive changes
like:
Victor Stinner [Wed, 12 Jul 2017 12:51:46 +0000 (14:51 +0200)]
bpo-30500: urllib: Simplify splithost by calling into urlparse. (#1849) (#2291)
The current regex based splitting produces a wrong result. For example::
http://abc#@def
Web browsers parse that URL as ``http://abc/#@def``, that is, the host
is ``abc``, the path is ``/``, and the fragment is ``#@def``.
(cherry picked from commit 90e01e50ef8a9e6c91f30d965563c378a4ad26de)
larryhastings [Thu, 22 Jun 2017 23:00:46 +0000 (16:00 -0700)]
Add "Misc/NEWS.d" directory tree for "blurb". GH-2331
CPython workflow is changing! We're going to start using "blurb"
to manage Misc/NEWS entries:
https://github.com/python/core-workflow
(This will be a big win for release managers, honest.)
This checkin simply populates the "Misc/NEWS.d" subdirectory tree
so that people can start putting their news entries in there.
No other changes (yet).
Issue #28563: Fixed possible DoS and arbitrary code execution when handle
plural form selections in the gettext module. The expression parser now
supports exact syntax supported by GNU gettext.
Issue #28563: Fixed possible DoS and arbitrary code execution when handle
plural form selections in the gettext module. The expression parser now
supports exact syntax supported by GNU gettext.
Martin Panter [Thu, 14 Jan 2016 09:36:00 +0000 (09:36 +0000)]
Issue #25940: Use self-signed.pythontest.net in SSL tests
This is instead of svn.python.org, whose certificate recently expired, and
whose new certificate uses a different root certificate.
The certificate used at the pythontest server was modifed to set the "basic
constraints" CA flag. This flag seems to be required for test_get_ca_certs_
capath() to work (in Python 3.4+).
Added the new self-signed certificate to capath with the following commands:
projects / thirdparty / Python / cpython.git / log
