From 1a3cef77d465ea1a53e5c80f869908f359e98c5e Mon Sep 17 00:00:00 2001 From: Jeffery To Date: Mon, 20 Jul 2020 05:48:57 +0800 Subject: python3: Update to 3.8.4, refresh/rework patches, backport patches This version includes fixes for: * CVE-2020-14422: Hash collisions in IPv4Interface and IPv6Interface * CVE-2020-15523: Python uses invalid DLL path after calling Py_SetPath on Windows This version also includes support for OpenSSL 1.1.x builds that use 'no-deprecated' and '--api=1.1.0'[1], and so this removes the previous OpenSSL-related patches. This also backports fixes for security issues, including: * CVE-2019-20907: Infinite loop in the tarfile module This also updates the setuptools and pip packages to 47.1.0 and 20.1.1, respectively. [1]: https://github.com/python/cpython/pull/20566 Signed-off-by: Jeffery To --- .../python3/patches/021-openssl-deprecated.patch | 63 ---------------------- 1 file changed, 63 deletions(-) delete mode 100644 lang/python/python3/patches/021-openssl-deprecated.patch (limited to 'lang/python/python3/patches/021-openssl-deprecated.patch') diff --git a/lang/python/python3/patches/021-openssl-deprecated.patch b/lang/python/python3/patches/021-openssl-deprecated.patch deleted file mode 100644 index 4dd33f623..000000000 --- a/lang/python/python3/patches/021-openssl-deprecated.patch +++ /dev/null @@ -1,63 +0,0 @@ ---- a/Modules/_ssl.c -+++ b/Modules/_ssl.c -@@ -201,6 +201,11 @@ static void _PySSLFixErrno(void) { - #define TLS_method SSLv23_method - #define TLS_client_method SSLv23_client_method - #define TLS_server_method SSLv23_server_method -+#define X509_getm_notBefore X509_get_notBefore -+#define X509_getm_notAfter X509_get_notAfter -+#define OpenSSL_version_num SSLeay -+#define OpenSSL_version SSLeay_version -+#define OPENSSL_VERSION SSLEAY_VERSION - - static int X509_NAME_ENTRY_set(const X509_NAME_ENTRY *ne) - { -@@ -1724,7 +1729,7 @@ _decode_certificate(X509 *certificate) { - Py_DECREF(sn_obj); - - (void) BIO_reset(biobuf); -- notBefore = X509_get_notBefore(certificate); -+ notBefore = X509_getm_notBefore(certificate); - ASN1_TIME_print(biobuf, notBefore); - len = BIO_gets(biobuf, buf, sizeof(buf)-1); - if (len < 0) { -@@ -1741,7 +1746,7 @@ _decode_certificate(X509 *certificate) { - Py_DECREF(pnotBefore); - - (void) BIO_reset(biobuf); -- notAfter = X509_get_notAfter(certificate); -+ notAfter = X509_getm_notAfter(certificate); - ASN1_TIME_print(biobuf, notAfter); - len = BIO_gets(biobuf, buf, sizeof(buf)-1); - if (len < 0) { -@@ -3282,7 +3287,7 @@ _ssl__SSLContext_impl(PyTypeObject *type - conservative and assume it wasn't fixed until release. We do this check - at runtime to avoid problems from the dynamic linker. - See #25672 for more on this. */ -- libver = SSLeay(); -+ libver = OpenSSL_version_num(); - if (!(libver >= 0x10001000UL && libver < 0x1000108fUL) && - !(libver >= 0x10000000UL && libver < 0x100000dfUL)) { - SSL_CTX_set_mode(self->ctx, SSL_MODE_RELEASE_BUFFERS); -@@ -6450,10 +6455,10 @@ PyInit__ssl(void) - return NULL; - - /* OpenSSL version */ -- /* SSLeay() gives us the version of the library linked against, -+ /* OpenSSL_version_num() gives us the version of the library linked against, - which could be different from the headers version. - */ -- libver = SSLeay(); -+ libver = OpenSSL_version_num(); - r = PyLong_FromUnsignedLong(libver); - if (r == NULL) - return NULL; -@@ -6463,7 +6468,7 @@ PyInit__ssl(void) - r = Py_BuildValue("IIIII", major, minor, fix, patch, status); - if (r == NULL || PyModule_AddObject(m, "OPENSSL_VERSION_INFO", r)) - return NULL; -- r = PyUnicode_FromString(SSLeay_version(SSLEAY_VERSION)); -+ r = PyUnicode_FromString(OpenSSL_version(OPENSSL_VERSION)); - if (r == NULL || PyModule_AddObject(m, "OPENSSL_VERSION", r)) - return NULL; - -- cgit