• Files Changed
• Browse Source

- Update to 3.8.14:
  - (CVE-2020-10735, bsc#1203125). Converting between int
    and str in bases other than 2 (binary), 4, 8 (octal), 16
    (hexadecimal), or 32 such as base 10 (decimal) now raises a
    ValueError if the number of digits in string form is above a
    limit to avoid potential denial of service attacks due to the
    algorithmic complexity.
    This new limit can be configured or disabled by environment
    variable, command line flag, or sys APIs. See the integer
    string conversion length limitation documentation. The
    default limit is 4300 digits in string form.
  - (CVE-2021-28861, bsc#1202624) http.server: Fix an open
    redirection vulnerability in the HTTP server when an URI path
    starts with //. Vulnerability discovered, and initial fix
    proposed, by Hamza Avvan.
  - Also other bugfixes:
    - Fix contextvars HAMT implementation to handle iteration
      over deep trees. The bug was discovered and fixed by Eli
      Libman. See MagicStack/immutables#84 for more details.
    - Fix ensurepip environment isolation for subprocess running
      pip.
    - Raise ProgrammingError instead of segfaulting on recursive
      usage of cursors in sqlite3 converters. Patch by Sergey
      Fedoseev.
    - Add a new gh role to the documentation to link to GitHub
      issues.
    - Pin Jinja to a version compatible with Sphinx version
      2.4.4.
    - test_ssl is now checking for supported TLS version and
      protocols in more tests.
    - Fix test case for OpenSSL 3.0.1 version. OpenSSL 3.0 uses
      0xMNN00PP0L.
- Removed upstreamed patches:
  - CVE-2021-28861-double-slash-path.patch
- Readjusted patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - sphinx-update-removed-function.patch
- (bsc#1196784, CVE-2022-25236) Add patch
  support-expat-CVE-2022-25236-patched.patch to allow working
  with different versions of libexpat.

• Files Changed
• Browse Source

- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)

- Add bpo34990-2038-problem-compileall.patch making compileall.py
  compliant with year 2038 (bsc#1202666, gh#python/cpython#79171),
  backport of fix to Python 3.8.
- Add conditional for requiring rpm-build-python, so we should be
  compilable on SLE/Leap.

• Files Changed
• Browse Source

- Switch from %primary_interpreter to prjconf-defined
  %primary_python (gh#openSUSE/python-rpm-macros#127).

• Files Changed
• Browse Source

- Switch primary_interpreter from python38 to python310

• Files Changed
• Browse Source

- Update to 3.8.13:
Core and Builtins
    bpo-46794: Bump up the libexpat version into 2.4.6
    bpo-46985: Upgrade pip wheel bundled with ensurepip (pip 22.0.4)
    bpo-46932: Update bundled libexpat to 2.4.7
    bpo-46811: Make test suite support Expat >=2.4.5
    bpo-46784: Fix libexpat symbols collisions with user
      dynamically loaded or statically linked libexpat in embedded
      Python.
    bpo-46400: expat: Update libexpat from 2.4.1 to 2.4.4
    bpo-46474: In importlib.metadata.EntryPoint.pattern, avoid
      potential REDoS by limiting ambiguity in consecutive
      whitespace.
    bpo-44849: Fix the os.set_inheritable() function on FreeBSD
      14 for file descriptor opened with the O_PATH flag: ignore
      the EBADF error on ioctl(), fallback on the fcntl()
      implementation.
    bpo-41028: Language and version switchers, previously
      maintained in every cpython branches, are now handled by
      docsbuild-script.
    bpo-45195: Fix test_readline.test_nonascii(): sometimes, the
      newline character is not written at the end, so don’t
      expect it in the output.
    bpo-44949: Fix auto history tests of test_readline:
      sometimes, the newline character is not written at the end,
      so don’t expect it in the output.
    bpo-45405: Prevent internal configure error when running
      configure with recent versions of clang.
- Remove upstreamed patches:
  - support-expat-245.patch

• Files Changed
• Browse Source

- Add patch support-expat-245.patch:
  * Support Expat >= 2.4.5

• Files Changed
• Browse Source

- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch

• Files Changed
• Browse Source

• Files Changed
• Browse Source

• Files Changed
• Browse Source

• Files Changed
• Browse Source

- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).

• Files Changed
• Browse Source

- Add bpo44426-complex-keyword-sphinx.patch allowing generating
  documentation with Sphinx 4 (bpo#44426).

• Files Changed
• Browse Source

• Files Changed
• Browse Source

- Update to 3.8.10:
  - Security
    - bpo-43434: Creating a sqlite3.Connection object now also
      produces a sqlite3.connect auditing event. Previously this
      event was only produced by sqlite3.connect() calls. Patch
      by Erlend E. Aasland.
    - bpo-43472: Ensures interpreter-level audit hooks receive
      the cpython.PyInterpreterState_New event when called
      through the _xxsubinterpreters module.
    - bpo-43075: Fix Regular Expression Denial of Service (ReDoS)
      vulnerability in urllib.request.AbstractBasicAuthHandler.
      The ReDoS-vulnerable regex has quadratic worst-case
      complexity and it allows cause a denial of service when
      identifying crafted invalid RFCs. This ReDoS issue is on
      the client side and needs remote attackers to control the
      HTTP server.
  - Core and Builtins
    - bpo-43105: Importlib now resolves relative paths when
      creating module spec objects from file locations.
    - bpo-42924: Fix bytearray repetition incorrectly copying
      data from the start of the buffer, even if the data is
      offset within the buffer (e.g. after reassigning a slice at
      the start of the bytearray to a shorter byte string).
  - Library
    - bpo-43993: Update bundled pip to 21.1.1.
    - bpo-43937: Fixed the turtle module working with non-default
      root window.
    - bpo-43930: Update bundled pip to 21.1 and setuptools to
      56.0.0
    - bpo-43920: OpenSSL 3.0.0: load_verify_locations() now
      returns a consistent error message when cadata contains no
      valid certificate.
    - bpo-43607: urllib can now convert Windows paths with \\?\
      prefixes into URL paths.
    - bpo-43284: platform.win32_ver derives the windows version
      from sys.getwindowsversion().platform_version which in turn
      derives the version from kernel32.dll (which can be of
      a different version than Windows itself). Therefore change
      the platform.win32_ver to determine the version using the
      platform module’s _syscmd_ver private function to return an
      accurate version.
    - bpo-42248: [Enum] ensure exceptions raised in _missing__
      are released
    - bpo-43799: OpenSSL 3.0.0: define OPENSSL_API_COMPAT 1.1.1
      to suppress deprecation warnings. Python requires OpenSSL
      1.1.1 APIs.
    - bpo-43794: Add ssl.OP_IGNORE_UNEXPECTED_EOF constants
      (OpenSSL 3.0.0)
    - bpo-43789: OpenSSL 3.0.0: Don’t call the password callback
      function a second time when first call has signaled an
      error condition.
    - bpo-43788: The header files for ssl error codes are now
      OpenSSL version-specific. Exceptions will now show correct
      reason and library codes. The make_ssl_data.py script has
      been rewritten to use OpenSSL’s text file with error codes.
    - bpo-43655: tkinter dialog windows are now recognized as
      dialogs by window managers on macOS and X Window.
    - bpo-43534: turtle.textinput() and turtle.numinput() create
      now a transient window working on behalf of the canvas
      window.
    - bpo-43522: Fix problem with hostname_checks_common_name.
      OpenSSL does not copy hostflags from struct SSL_CTX to
      struct SSL.
    - bpo-42967: Allow bytes separator argument in
      urllib.parse.parse_qs and urllib.parse.parse_qsl when
      parsing str query strings. Previously, this raised
      a TypeError.
    - bpo-43176: Fixed processing of a dataclass that inherits
      from a frozen dataclass with no fields. It is now correctly
      detected as an error.
    - bpo-34463: Fixed discrepancy between traceback and the
      interpreter in formatting of SyntaxError with lineno not
      set (traceback was changed to match interpreter).
    - bpo-41735: Fix thread locks in zlib module may go wrong in
      rare case. Patch by Ma Lin.
    - bpo-26053: Fixed bug where the pdb interactive run command
      echoed the args from the shell command line, even if those
      have been overridden at the pdb prompt.
    - bpo-36470: Fix dataclasses with InitVars and replace().
      Patch by Claudiu Popa.
    - bpo-28577: The hosts method on 32-bit prefix length
      IPv4Networks and 128-bit prefix IPv6Networks now returns
      a list containing the single Address instead of an empty
      list.
    - bpo-32745: Fix a regression in the handling of ctypes’
      ctypes.c_wchar_p type: embedded null characters would cause
      a ValueError to be raised. Patch by Zackery Spytz.
  - Documentation
    - bpo-43959: The documentation on the PyContextVar C-API was
      clarified.
    - bpo-43938: Update dataclasses documentation to express that
      FrozenInstanceError is derived from AttributeError.
    - bpo-43739: Fixing the example code in
      Doc/extending/extending.rst to declare and initialize the
      pmodule variable to be of the right type.
  - Tests
    - bpo-43842: Fix a race condition in the SMTP test of
      test_logging. Don’t close a file descriptor (socket) from
      a different thread while asyncore.loop() is polling the
      file descriptor. Patch by Victor Stinner.
    - bpo-43811: Tests multiple OpenSSL versions on GitHub
      Actions. Use ccache to speed up testing.
    - bpo-43791: OpenSSL 3.0.0: Disable testing of legacy
      protocols TLS 1.0 and 1.1. Tests are failing with
      TLSV1_ALERT_INTERNAL_ERROR.
  - IDLE
    - bpo-43655: IDLE dialog windows are now recognized as
      dialogs by window managers on macOS and X Window.
  - C API
    - bpo-43962: _PyInterpreterState_IDIncref() now calls
      _PyInterpreterState_IDInitref() and always increments
      id_refcount. Previously, calling
      _xxsubinterpreters.get_current() could create an
      id_refcount inconsistency when
      a _xxsubinterpreters.InterpreterID object was deallocated.
      Patch by Victor Stinner.
- Reapplied patches:
  - CVE-2019-5010-null-defer-x509-cert-DOS.patch
  - F00102-lib64.patch
  - SUSE-FEDORA-multilib.patch
  - bpo-31046_ensurepip_honours_prefix.patch
  - python-3.3.0b1-fix_date_time_compiler.patch
- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.

• Files Changed
• Browse Source

- Update to 3.8.9:
  - bpo#42988 (bsc#1183374) CVE-2021-3426: Remove the getfile
    feature of the pydoc module which could be abused to read
    arbitrary files on the disk (directory traversal
    vulnerability). Moreover, even source code of Python modules
    can contain sensitive data like passwords. Vulnerability
    reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
  - Code that requires the former vulnerable behavior may set
    a trust_server_pasv_ipv4_address attribute on their
    ftplib.FTP instances to True to re-enable it.
  - bpo-43439: Add audit hooks for gc.get_objects(),
    gc.get_referrers() and gc.get_referents(). Patch by Pablo
    Galindo.
  - bpo-43660: Fix crash that happens when replacing sys.stderr
    with a callable that can remove the object while an exception
    is being printed. Patch by Pablo Galindo.
  - bpo-35883: Python no longer fails at startup with a fatal
    error if a command line argument contains an invalid Unicode
    character. The Py_DecodeLocale() function now escapes byte
    sequences which would be decoded as Unicode characters
    outside the [U+0000; U+10ffff] range.
  - bpo-43406: Fix a possible race condition where
    PyErr_CheckSignals tries to execute a non-Python signal
    handler.
  - bpo-35930: Raising an exception raised in a “future” instance
    will create reference cycles.
  - bpo-43577: Fix deadlock when using ssl.SSLContext debug
    callback with ssl.SSLContext.sni_callback().
  - bpo-43423: subprocess.communicate() no longer raises an
    IndexError when there is an empty stdout or stderr IO buffer
    during a timeout on Windows.
  - bpo-27820: Fixed long-standing bug of smtplib.SMTP where
    doing AUTH LOGIN with initial_response_ok=False will fail.
    The cause is that SMTP.auth_login _always_ returns a password
    if provided with a challenge string, thus non-compliant with
    the standard for AUTH LOGIN. Also fixes bug with the test for
    smtpd.
  - bpo-43399: Fix ElementTree.extend not working on iterators
    when using the Python implementation
  - bpo-43316: The python -m gzip command line application now
    properly fails when detecting an unsupported extension. It
    exits with a non-zero exit code and prints an error message
    to stderr.
  - bpo-43260: Fix TextIOWrapper can not flush internal buffer
    forever after very large text is written.
  - bpo-42782: Fail fast in shutil.move() to avoid creating
    destination directories on failure.
  - bpo-37193: Fixed memory leak in socketserver.ThreadingMixIn
    introduced in Python 3.7.
  - bpo-43199: Answer “Why is there no goto?” in the Design and
    History FAQ.
  - bpo-43407: Clarified that a result from time.monotonic(),
    time.perf_counter(), time.process_time(), or
    time.thread_time() can be compared with the result from any
    following call to the same function - not just the next
    immediate call.
  - bpo-27646: Clarify that ‘yield from <expr>’ works with any
    iterable, not just iterators.
  - bpo-36346: Update some deprecated unicode APIs which are
    documented as “will be removed in 4.0” to “3.12”. See PEP 623
    for detail.
  - bpo-37945: Fix test_getsetlocale_issue1813() of test_locale:
    skip the test if setlocale() fails. Patch by Victor Stinner.
  - bpo-41561: Add workaround for Ubuntu’s custom OpenSSL
    security level policy.
  - bpo-43631: Update macOS, Windows, and CI to OpenSSL 1.1.1k.
  - bpo-43617: Improve configure.ac: Check for presence of
    autoconf-archive package and remove our copies of M4 macros.
  - bpo-41837: Update macOS installer build to use OpenSSL
    1.1.1j.
  - bpo-42225: Document that IDLE can fail on Unix either from
    misconfigured IP masquerage rules or failure displaying
    complex colored (non-ascii) characters.
  - bpo-43283: Document why printing to IDLE’s Shell is often
    slower than printing to a system terminal and that it can be
    made faster by pre-formatting a single string before
    printing.

• Files Changed
• Browse Source

Automatic submission by obs-autosubmit

• Files Changed
• Browse Source

- Update to 3.8.8:
  - bpo#42938 (bsc#1181126): Avoid static buffers when computing
    the repr of ctypes.c_double and ctypes.c_longdouble
    values. This issue was assigned CVE-2021-3177.
  - bpo#42967 (bso#1182379): Fix web cache poisoning
    vulnerability by defaulting the query args separator to &,
    and allowing the user to choose a custom separator. This
    issue was assigned CVE-2021-23336.
- Remove bsc1167501-invalid-alignment.patch and
  CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch, which were included
  into the upstream tarball.

• Files Changed
• Browse Source

- Add Obsoletes for python3-base when primary interpreter is set to
  properly replace it during upgrades. (bsc#1181324)

- Provide %have_<flavor> for all python flavors
  gh#openSUSE/python-rpm-macros#96
- Add %python3_default and %default_python3 for the primary python3
  flavor

• Files Changed
• Browse Source

- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.
- (bsc#1180125) We really don't Require python-rpm-macros package.
  Unnecessary dependency.
- Update to 3.8.7:
  - bugfix release
  - multiple patches realigned:
    - F00102-lib64.patch
    - SUSE-FEDORA-multilib.patch
    - bpo-31046_ensurepip_honours_prefix.patch
    - skip_random_failing_tests.patch
- Last try before this results in an editwar:
  * remove importlib_resources and importlib-metadata 
    provides/obsoletes
  * import importlib_resources is not the same as
    import importlib.resources, same for metadata
  * The backport packages from PyPI needed for older flavors are
    specified as such for setuptools or in pyproject.toml. If a
    package requires them they typically add them with a python
    version qualifier and the packages have their own version
    numbers.
- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function and to make documentation build independent of
  the Sphinx version (bsc#1179630, gh#python/cpython#13236).
- Add importlib_resources provide/obsolete as it is integral
  part of the lang since 3.7 release 

• Files Changed
• Browse Source