Community maintained packages for OpenWrt http://x-nagi.com/cgit/packages/atom?h=openwrt-19.07 2023-06-12T09:35:45Z 2023-06-12T09:35:45Z Jeffery To jeffery.to@gmail.com 2023-06-12T09:35:45Z urn:sha1:f7a8607579f72f504dadc48379c2746210eea7c6 This includes an updated patch for pip, as the bundled pip was also updated with this release. Signed-off-by: Jeffery To <jeffery.to@gmail.com> 2023-03-16T07:05:35Z Jeffery To jeffery.to@gmail.com 2023-03-16T07:05:35Z urn:sha1:509f4e2f838952bd0322597a9b677ead283c98d1 Includes fixes: * 3.7.14: * CVE-2020-10735: Prevent DoS by large int<->str conversions * CVE-2021-28861: http.server: Open Redirection if the URL path starts with // * 3.7.16: * CVE-2022-45061: Slow IDNA decoding with large strings * CVE-2022-37454: Buffer overflow in the _sha3 module * CVE-2015-20107: mailcap.findmatch: document shell command Injection danger in filename parameter Signed-off-by: Jeffery To <jeffery.to@gmail.com> 2022-03-21T18:16:36Z Jeffery To jeffery.to@gmail.com 2022-03-21T18:16:36Z urn:sha1:3398ed29b0c09dcb5519e229ba25db30043d1566 Includes fixes for: * Windows builds updated to bzip2 1.0.8 to mitigate CVE-2016-3189 and CVE-2019-12900 * CVE-2022-26488: Escalation of privilege via Windows Installer Signed-off-by: Jeffery To <jeffery.to@gmail.com> 2021-09-08T11:06:36Z Josef Schlehofer pepe.schlehofer@gmail.com 2021-09-08T11:05:22Z urn:sha1:17f5a0cc8362cc2198d97c9f42cc9ef7aebb29b8 Fixes: CVE-2013-0340 (Windows and MacOS only) and smtplib multiple CRLF injection Changelog: https://www.python.org/downloads/release/python-3712/ Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> 2021-07-06T07:15:33Z Josef Schlehofer pepe.schlehofer@gmail.com 2021-07-06T07:14:42Z urn:sha1:b18aab0d13f96e19294bcd3d6dce414a0d3efd59 Fixes: CVE-2021-3426 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> 2021-02-22T13:05:28Z Jeffery To jeffery.to@gmail.com 2021-02-22T13:02:55Z urn:sha1:f05ba1bbca9dafad9ed89360966fc38fd6220d2b Includes fixes for: * CVE-2021-3177 - ctypes: Buffer overflow in PyCArg_repr * CVE-2021-23336 - urllib parse_qsl(): Web cache poisoning - semicolon as a query args separator Signed-off-by: Jeffery To <jeffery.to@gmail.com> 2020-10-16T17:35:19Z Jeffery To jeffery.to@gmail.com 2020-10-16T17:35:19Z urn:sha1:acb77d5bebd2d44a21480655798c04f74f6f4d45 Signed-off-by: Jeffery To <jeffery.to@gmail.com> 2020-06-30T13:20:18Z Jeffery To jeffery.to@gmail.com 2020-06-30T13:20:18Z urn:sha1:d78bdbd8ad91abca5bf1959b53a70e930440fba1 This contains a fix for CVE-2020-8492 (Denial of service in urllib.request.AbstractBasicAuthHandler)[1]. This also updates the setuptools and pip packages to 47.1.0 and 20.1.1, respectively. [1]: https://docs.python.org/release/3.7.8/whatsnew/changelog.html#python-3-7-8-release-candidate-1 Signed-off-by: Jeffery To <jeffery.to@gmail.com> 2020-05-21T12:15:24Z Jeffery To jeffery.to@gmail.com 2020-05-21T12:02:13Z urn:sha1:6dac29693f3c6f3feb35018d31868f9db522d285 When a Python package is installed from source (i.e. using setup.py) into a custom location (with --home), setuptools may want to create a site.py file in the custom location. This file is created based on the source code of site-patch.py, a file bundled with setuptools. Because the normal OpenWrt setuptools package does not contain Python source code, this file is missing and the installation will end with an error. This copies site-patch.py to site-patch.py.txt so that it will be included in python3-setuptools, and patches setuptools to look for this file. See https://github.com/openwrt/packages/issues/12223 Signed-off-by: Jeffery To <jeffery.to@gmail.com> (cherry picked from commit 70a7f736c5d6fb9ebec1acc8b3e8ca77704361bf) 2020-04-24T15:29:34Z Jeffery To jeffery.to@gmail.com 2020-04-24T13:09:37Z urn:sha1:5b660755711e284e92469219b7d17d9dc9186b6a This addresses one of the issues raised in #11912. Signed-off-by: Jeffery To <jeffery.to@gmail.com> (cherry picked from commit 11bc05763d6cb351842a7bd55e736b601656a41a)