Soumya Sambu 9541ad9650 python3: Fix CVE-2024-7592 ...

There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module. When parsing cookies that contained
backslashes for quoted characters in the cookie value, the parser would use
an algorithm with quadratic complexity, resulting in excess CPU resources
being used while parsing the value.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-7592

Upstream-Patch:
https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1

(From OE-Core rev: 3bb9684eef5227e7b1280ee9051884310b0d0b7f)

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>

2024-09-09 06:08:10 -07:00

..

0001-Avoid-shebang-overflow-on-python-config.py.patch

python3: upgrade 3.12.1 -> 3.12.2

2024-03-01 09:28:52 +00:00

0001-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch

python3: Treat UID/GID overflow as failure

2024-08-01 06:08:09 -07:00

0001-gh-114492-Initialize-struct-termios-before-calling-t.patch

python3: upgrade 3.12.1 -> 3.12.2

2024-03-01 09:28:52 +00:00

0001-Lib-pty.py-handle-stdin-I-O-errors-same-way-as-maste.patch

python: update 3.11.5 -> 3.12.1

2024-01-19 12:21:22 +00:00

0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch

python: update 3.11.5 -> 3.12.1

2024-01-19 12:21:22 +00:00

0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch

python3: upgrade 3.12.1 -> 3.12.2

2024-03-01 09:28:52 +00:00

0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch

python3: upgrade 3.12.1 -> 3.12.2

2024-03-01 09:28:52 +00:00

0001-Skip-failing-tests-due-to-load-variability-on-YP-AB.patch

python3: upgrade 3.12.1 -> 3.12.2

2024-03-01 09:28:52 +00:00

0001-skip-no_stdout_fileno-test-due-to-load-variability.patch

python3: upgrade 3.12.1 -> 3.12.2

2024-03-01 09:28:52 +00:00

0001-sysconfig.py-use-platlibdir-also-for-purelib.patch

python: update 3.11.5 -> 3.12.1

2024-01-19 12:21:22 +00:00

0001-test_active_children-skip-problematic-test.patch

python3: skip test_multiprocessing/test_active_children test

2024-08-01 06:08:09 -07:00

0001-test_ctypes.test_find-skip-without-tools-sdk.patch

python: update 3.11.5 -> 3.12.1

2024-01-19 12:21:22 +00:00

0001-test_deadlock-skip-problematic-test.patch

python3: skip test_concurrent_futures/test_deadlock

2024-08-01 06:08:09 -07:00

0001-test_locale.py-correct-the-test-output-format.patch

python: update 3.11.5 -> 3.12.1

2024-01-19 12:21:22 +00:00

0001-test_shutdown-skip-problematic-test.patch

python3: skip test_concurrent_futures/test_shutdown

2024-05-09 04:45:06 -07:00

0001-test_storlines-skip-due-to-load-variability.patch

python: update 3.11.5 -> 3.12.1

2024-01-19 12:21:22 +00:00

0001-Update-test_sysconfig-for-posix_user-purelib.patch

python: update 3.11.5 -> 3.12.1

2024-01-19 12:21:22 +00:00

0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch

python3: upgrade 3.12.1 -> 3.12.2

2024-03-01 09:28:52 +00:00

cgi_py.patch

python: update 3.11.5 -> 3.12.1

2024-01-19 12:21:22 +00:00

check_build_completeness.py

…

create_manifest3.py

…

crosspythonpath.patch

python: update 3.11.5 -> 3.12.1

2024-01-19 12:21:22 +00:00

CVE-2024-7592.patch

python3: Fix CVE-2024-7592

2024-09-09 06:08:10 -07:00

deterministic_imports.patch

python3: submit deterministic_imports.patch upstream as a ticket

2024-08-01 06:08:09 -07:00

get_module_deps3.py

…

makerace.patch

python3: upgrade 3.12.1 -> 3.12.2

2024-03-01 09:28:52 +00:00

python3-manifest.json

python3-manifest: Sync RDEPENDS with latest version

2024-03-22 16:25:08 +00:00

reformat_sysconfig.py

…

run-ptest

…