Hello community, here is the log from the commit of package python36 for openSUSE:Factory checked in at 2020-12-02 13:58:41 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python36 (Old) and /work/SRC/openSUSE:Factory/.python36.new.5913 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python36" Wed Dec 2 13:58:41 2020 rev:4 rq:852415 version:3.6.12 Changes: -------- --- /work/SRC/openSUSE:Factory/python36/python36.changes 2020-11-29 12:29:16.834053900 +0100 +++ /work/SRC/openSUSE:Factory/.python36.new.5913/python36.changes 2020-12-02 13:58:42.569831999 +0100 @@ -1,0 +2,14 @@ +Tue Dec 1 17:20:14 UTC 2020 - Matej Cepl <[email protected]> + +- Add CVE-2020-27619-no-eval-http-content.patch fixing + CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support + calls eval() on content retrieved via HTTP. + +------------------------------------------------------------------- +Tue Dec 1 05:37:07 UTC 2020 - Steve Kowalik <[email protected]> + +- Add patch sphnix-update-removed-function.patch to no longer call + a now removed function (gh#python/cpython#13236). As + a consequence, no longer pin Sphinx version. + +------------------------------------------------------------------- @@ -88,0 +103,2 @@ +- Working around missing python-packaging dependency in + python-Sphinx (bsc#1174571) is not necessary anymore. @@ -143 +159,14 @@ - * Include more security fixes (CVE-2019-18348, bsc#1155094) + - bpo-39073: Disallow CR or LF in email.headerregistry. Address + arguments to guard against header injection attacks. + - bpo-38576 (bsc#1155094): Disallow control characters in + hostnames in http.client, addressing CVE-2019-18348. Such + potentially malicious header injection URLs now cause + a InvalidURL to be raised. + - bpo-39503: CVE-2020-8492: The AbstractBasicAuthHandler class + of the urllib.request module uses an inefficient regular + expression which can be exploited by an attacker to cause + a denial of service. Fix the regex to prevent the + catastrophic backtracking. Vulnerability reported by Ben + Caller and Matt Schwager. + - bpo-39401: Avoid unsafe load of + api-ms-win-core-path-l1-1-0.dll at startup on Windows 7. @@ -241 +270,3 @@ - - CVE-2019-16935-xmlrpc-doc-server_title.patch + - CVE-2019-16935-xmlrpc-doc-server_title.patch (and also + bpo37614-race_test_docxmlrpc_srv_setup.patch, which was + resolving bsc#1174701). New: ---- CVE-2020-27619-no-eval-http-content.patch sphnix-update-removed-function.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python36.spec ++++++ --- /var/tmp/diff_new_pack.4k1WRL/_old 2020-12-02 13:58:43.557833040 +0100 +++ /var/tmp/diff_new_pack.4k1WRL/_new 2020-12-02 13:58:43.561833045 +0100 @@ -169,6 +169,11 @@ # PATCH-FIX-UPSTREAM ignore_pip_deprec_warn.patch [email protected] # Ignore deprecation warning for old version of pip Patch39: ignore_pip_deprec_warn.patch +# PATCH-FIX-UPSTREAM stop calling removed Sphinx function gh#python/cpython#13236 +Patch40: sphnix-update-removed-function.patch +# PATCH-FIX-UPSTREAM CVE-2020-27619-no-eval-http-content.patch bsc#1178009 [email protected] +# No longer call eval() on content received via HTTP in the CJK codec tests +Patch41: CVE-2020-27619-no-eval-http-content.patch BuildRequires: automake BuildRequires: fdupes @@ -190,7 +195,7 @@ %if %{with doc} # Here we just run sphinx and we can use generic one, we don't need # the flavor variant -BuildRequires: python3-Sphinx < 3 +BuildRequires: python3-Sphinx %endif %if %{with general} # required for idle3 (.desktop and .appdata.xml files) @@ -434,6 +439,8 @@ %patch37 -p1 %patch38 -p1 %patch39 -p1 +%patch40 -p1 +%patch41 -p1 # drop Autoconf version requirement sed -i 's/^AC_PREREQ/dnl AC_PREREQ/' configure.ac ++++++ CVE-2020-27619-no-eval-http-content.patch ++++++ From 7577b2d21ed82ad3aa5f60b7f1258760de0b2ad8 Mon Sep 17 00:00:00 2001 From: Serhiy Storchaka <[email protected]> Date: Tue, 6 Oct 2020 15:14:51 +0300 Subject: [PATCH] bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests (GH-22566) (cherry picked from commit 2ef5caa58febc8968e670e39e3d37cf8eef3cab8) Co-authored-by: Serhiy Storchaka <[email protected]> --- Lib/test/multibytecodec_support.py | 22 +++++++------------ .../2020-10-05-17-43-46.bpo-41944.rf1dYb.rst | 1 + 2 files changed, 9 insertions(+), 14 deletions(-) create mode 100644 Misc/NEWS.d/next/Tests/2020-10-05-17-43-46.bpo-41944.rf1dYb.rst --- a/Lib/test/multibytecodec_support.py +++ b/Lib/test/multibytecodec_support.py @@ -300,29 +300,23 @@ class TestBase_Mapping(unittest.TestCase self._test_mapping_file_plain() def _test_mapping_file_plain(self): - unichrs = lambda s: ''.join(map(chr, map(eval, s.split('+')))) + def unichrs(s): + return ''.join(chr(int(x, 16)) for x in s.split('+')) + urt_wa = {} with self.open_mapping_file() as f: for line in f: if not line: break - data = line.split('#')[0].strip().split() + data = line.split('#')[0].split() if len(data) != 2: continue - csetval = eval(data[0]) - if csetval <= 0x7F: - csetch = bytes([csetval & 0xff]) - elif csetval >= 0x1000000: - csetch = bytes([(csetval >> 24), ((csetval >> 16) & 0xff), - ((csetval >> 8) & 0xff), (csetval & 0xff)]) - elif csetval >= 0x10000: - csetch = bytes([(csetval >> 16), ((csetval >> 8) & 0xff), - (csetval & 0xff)]) - elif csetval >= 0x100: - csetch = bytes([(csetval >> 8), (csetval & 0xff)]) - else: + if data[0][:2] != '0x': + self.fail(f"Invalid line: {line!r}") + csetch = bytes.fromhex(data[0][2:]) + if len(csetch) == 1 and 0x80 <= csetch[0]: continue unich = unichrs(data[1]) --- /dev/null +++ b/Misc/NEWS.d/next/Tests/2020-10-05-17-43-46.bpo-41944.rf1dYb.rst @@ -0,0 +1 @@ +Tests for CJK codecs no longer call ``eval()`` on content received via HTTP. ++++++ sphnix-update-removed-function.patch ++++++ From 960bb883769e5c64a63b014590d75654db87ffb0 Mon Sep 17 00:00:00 2001 From: Pablo Galindo <[email protected]> Date: Fri, 10 May 2019 22:58:17 +0100 Subject: [PATCH] Fix sphinx deprecation warning about env.note_versionchange() (GH-13236) --- Doc/tools/extensions/pyspecific.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: Python-3.6.12/Doc/tools/extensions/pyspecific.py =================================================================== --- Python-3.6.12.orig/Doc/tools/extensions/pyspecific.py +++ Python-3.6.12/Doc/tools/extensions/pyspecific.py @@ -231,7 +231,7 @@ class DeprecatedRemoved(Directive): translatable=False) node.append(para) env = self.state.document.settings.env - env.note_versionchange('deprecated', version[0], node, self.lineno) + env.get_domain('changeset').note_changeset(node) return [node] + messages _______________________________________________ openSUSE Commits mailing list -- [email protected] To unsubscribe, email [email protected] List Netiquette: https://en.opensuse.org/openSUSE:Mailing_list_netiquette List Archives: https://lists.opensuse.org/archives/list/[email protected]
