packages/lang/python/python3/patches, branch openwrt-19.07

python3: Update to 3.7.16, refresh patches

2023-03-16T07:05:35Z

Includes fixes: * 3.7.14: * CVE-2020-10735: Prevent DoS by large int<->str conversions * CVE-2021-28861: http.server: Open Redirection if the URL path starts with // * 3.7.16: * CVE-2022-45061: Slow IDNA decoding with large strings * CVE-2022-37454: Buffer overflow in the _sha3 module * CVE-2015-20107: mailcap.findmatch: document shell command Injection danger in filename parameter Signed-off-by: Jeffery To

python3: Update to 3.7.13, refresh patches

2022-03-21T18:16:36Z

Includes fixes for: * Windows builds updated to bzip2 1.0.8 to mitigate CVE-2016-3189 and CVE-2019-12900 * CVE-2022-26488: Escalation of privilege via Windows Installer Signed-off-by: Jeffery To

python3: Update to 3.7.10, refresh patches

2021-02-22T13:05:28Z

Includes fixes for: * CVE-2021-3177 - ctypes: Buffer overflow in PyCArg_repr * CVE-2021-23336 - urllib parse_qsl(): Web cache poisoning - semicolon as a query args separator Signed-off-by: Jeffery To

python3: Update to 3.7.9, refresh/remove backported patches

2020-10-16T17:35:19Z

Signed-off-by: Jeffery To

python3: Backport security fixes

2020-07-20T09:39:42Z

This backports fixes for security issues, including: * CVE-2020-14422: Hash collisions in IPv4Interface and IPv6Interface * CVE-2019-20907: Infinite loop in the tarfile module Signed-off-by: Jeffery To

python3: Use default _PYTHON_HOST_PLATFORM

2020-07-08T09:12:33Z

This lets the Python build process set _PYTHON_HOST_PLATFORM instead of forcing an explicit value. Also: * Save the target _PYTHON_HOST_PLATFORM value during Build/InstallDev for use when building target Python packages (in python3-package.mk). * Use the (mostly) default PYTHON_FOR_BUILD value, instead patch configure to remove the platform triplet from the sysconfigdata file name. * Remove the "CROSS_COMPILE=yes" make variable (there is no indication that this variable is necessary). * Force host pip to build packages from source instead of downloading binary wheels. Previously, host pip can download universal (platform-independent) wheels but not platform-specific wheels, because of the custom _PYTHON_HOST_PLATFORM value. (Packages that do not have universal wheels would be compiled from source.) With a correct _PYTHON_HOST_PLATFORM, host pip can install platform-specific wheels as well. However, the pre-built shared object (.so) files in these wheels will have the host's platform triplet in their file names. When target Python packages are built (using the target's _PYTHON_HOST_PLATFORM), Python will not use these shared object files. By forcing host pip to build packages from source, the built shared object files will not have the platform triplet in their file names. (Host Python has been patched to remove the platform triplet from file names.) This allows these packages to be used when building target Python packages. (The net effect of this complete change is that platform-dependent packages will continue to be compiled from source, while platform-independent packages will now also be compiled from source.) Fixes https://github.com/openwrt/packages/issues/12680. Signed-off-by: Jeffery To

python3: Update to 3.7.8, refresh/rework patches

2020-06-30T13:20:18Z

This contains a fix for CVE-2020-8492 (Denial of service in urllib.request.AbstractBasicAuthHandler)[1]. This also updates the setuptools and pip packages to 47.1.0 and 20.1.1, respectively. [1]: https://docs.python.org/release/3.7.8/whatsnew/changelog.html#python-3-7-8-release-candidate-1 Signed-off-by: Jeffery To

python3: Fix float byte order detection

2020-01-30T11:12:25Z

This backports patches from bpo-34585[1] to fix byte order detection of floats. Fixing byte order detection allows the repr() of floats to be shorter[2]. sys.float_repr_style should be 'short' instead of 'legacy' on supported platforms. See #11134. [1]: https://bugs.python.org/issue34585 [2]: https://docs.python.org/3.8/whatsnew/3.1.html#other-language-changes Signed-off-by: Jeffery To

python3: Update to version 3.7.5

2019-10-21T13:19:32Z

setuptools: Updated to version 41.2.0 pip: Updated to version 19.2.3 Removed patches: - 017: code was refactored - 02{5,6,7,8}: those patches were backported from upstream and they are included in 3.7.5 Refreshed patches Signed-off-by: Josef Schlehofer

python,python3: Fix CVE-2019-16056, CVE-2019-16935

2019-10-04T16:04:39Z

These patches address issues: CVE-2019-16056: email.utils.parseaddr mistakenly parse an email CVE-2019-16935: A reflected XSS in python/Lib/DocXMLRPCServer.py (for Python 2.7) CVE-2019-16935 was fixed for python3 in #10109 Links to Python issues: https://bugs.python.org/issue34155 https://bugs.python.org/issue38243 Signed-off-by: Jeffery To