packages/lang/python/python3, branch openwrt-19.07

python3: Update to 3.7.17

2023-06-12T09:35:45Z

This includes an updated patch for pip, as the bundled pip was also updated with this release. Signed-off-by: Jeffery To

python3: Update to 3.7.16, refresh patches

2023-03-16T07:05:35Z

Includes fixes: * 3.7.14: * CVE-2020-10735: Prevent DoS by large int<->str conversions * CVE-2021-28861: http.server: Open Redirection if the URL path starts with // * 3.7.16: * CVE-2022-45061: Slow IDNA decoding with large strings * CVE-2022-37454: Buffer overflow in the _sha3 module * CVE-2015-20107: mailcap.findmatch: document shell command Injection danger in filename parameter Signed-off-by: Jeffery To

python3: Update to 3.7.13, refresh patches

2022-03-21T18:16:36Z

Includes fixes for: * Windows builds updated to bzip2 1.0.8 to mitigate CVE-2016-3189 and CVE-2019-12900 * CVE-2022-26488: Escalation of privilege via Windows Installer Signed-off-by: Jeffery To

python3: update to version 3.7.12

2021-09-08T11:06:36Z

Fixes: CVE-2013-0340 (Windows and MacOS only) and smtplib multiple CRLF injection Changelog: https://www.python.org/downloads/release/python-3712/ Signed-off-by: Josef Schlehofer

python3: update to version 3.7.11

2021-07-06T07:15:33Z

Fixes: CVE-2021-3426 Signed-off-by: Josef Schlehofer

python3: Update to 3.7.10, refresh patches

2021-02-22T13:05:28Z

Includes fixes for: * CVE-2021-3177 - ctypes: Buffer overflow in PyCArg_repr * CVE-2021-23336 - urllib parse_qsl(): Web cache poisoning - semicolon as a query args separator Signed-off-by: Jeffery To

python3: Update to 3.7.9, refresh/remove backported patches

2020-10-16T17:35:19Z

Signed-off-by: Jeffery To

python3: fix host compilation with clang

2020-08-15T22:21:32Z

Matched rpath parameter with Makefile. Signed-off-by: Rosen Penev (cherry picked from commit b40c40151c2ac3dd11d908a0548ac97e6b5c8455)

python3: Backport security fixes

2020-07-20T09:39:42Z

This backports fixes for security issues, including: * CVE-2020-14422: Hash collisions in IPv4Interface and IPv6Interface * CVE-2019-20907: Infinite loop in the tarfile module Signed-off-by: Jeffery To

python3: Use default _PYTHON_HOST_PLATFORM

2020-07-08T09:12:33Z

This lets the Python build process set _PYTHON_HOST_PLATFORM instead of forcing an explicit value. Also: * Save the target _PYTHON_HOST_PLATFORM value during Build/InstallDev for use when building target Python packages (in python3-package.mk). * Use the (mostly) default PYTHON_FOR_BUILD value, instead patch configure to remove the platform triplet from the sysconfigdata file name. * Remove the "CROSS_COMPILE=yes" make variable (there is no indication that this variable is necessary). * Force host pip to build packages from source instead of downloading binary wheels. Previously, host pip can download universal (platform-independent) wheels but not platform-specific wheels, because of the custom _PYTHON_HOST_PLATFORM value. (Packages that do not have universal wheels would be compiled from source.) With a correct _PYTHON_HOST_PLATFORM, host pip can install platform-specific wheels as well. However, the pre-built shared object (.so) files in these wheels will have the host's platform triplet in their file names. When target Python packages are built (using the target's _PYTHON_HOST_PLATFORM), Python will not use these shared object files. By forcing host pip to build packages from source, the built shared object files will not have the platform triplet in their file names. (Host Python has been patched to remove the platform triplet from file names.) This allows these packages to be used when building target Python packages. (The net effect of this complete change is that platform-dependent packages will continue to be compiled from source, while platform-independent packages will now also be compiled from source.) Fixes https://github.com/openwrt/packages/issues/12680. Signed-off-by: Jeffery To