diff options
author | Ned Deily <nad@python.org> | 2021-05-08 02:31:01 (GMT) |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-05-08 02:31:01 (GMT) |
commit | 164d6e1bb1bb3a4e4d5610f07a8911ecf57a691d (patch) | |
tree | c88ccb611c1b50e7fdfc58a58aa472df5a4d7e98 /Misc/NEWS.d/next/Security | |
parent | 4d4be477055d0f9e415407bcd193788fae04dc11 (diff) | |
download | cpython-164d6e1bb1bb3a4e4d5610f07a8911ecf57a691d.zip cpython-164d6e1bb1bb3a4e4d5610f07a8911ecf57a691d.tar.gz cpython-164d6e1bb1bb3a4e4d5610f07a8911ecf57a691d.tar.bz2 |
Add the blurbify of the 3.10.0b1 changelog to the main branch (GH-25976)
Diffstat (limited to 'Misc/NEWS.d/next/Security')
11 files changed, 0 insertions, 34 deletions
diff --git a/Misc/NEWS.d/next/Security/2020-07-04-22-14-46.bpo-37363.NDjHNw.rst b/Misc/NEWS.d/next/Security/2020-07-04-22-14-46.bpo-37363.NDjHNw.rst deleted file mode 100644 index 5390848..0000000 --- a/Misc/NEWS.d/next/Security/2020-07-04-22-14-46.bpo-37363.NDjHNw.rst +++ /dev/null @@ -1 +0,0 @@ -Add audit events to the :mod:`http.client` module.
\ No newline at end of file diff --git a/Misc/NEWS.d/next/Security/2021-01-09-17-07-36.bpo-42800._dtZvW.rst b/Misc/NEWS.d/next/Security/2021-01-09-17-07-36.bpo-42800._dtZvW.rst deleted file mode 100644 index d01c0c3..0000000 --- a/Misc/NEWS.d/next/Security/2021-01-09-17-07-36.bpo-42800._dtZvW.rst +++ /dev/null @@ -1 +0,0 @@ -Audit hooks are now fired for frame.f_code, traceback.tb_frame, and generator code/frame attribute access. diff --git a/Misc/NEWS.d/next/Security/2021-01-31-05-28-14.bpo-43075.DoAXqO.rst b/Misc/NEWS.d/next/Security/2021-01-31-05-28-14.bpo-43075.DoAXqO.rst deleted file mode 100644 index 1c9f727..0000000 --- a/Misc/NEWS.d/next/Security/2021-01-31-05-28-14.bpo-43075.DoAXqO.rst +++ /dev/null @@ -1 +0,0 @@ -Fix Regular Expression Denial of Service (ReDoS) vulnerability in :class:`urllib.request.AbstractBasicAuthHandler`. The ReDoS-vulnerable regex has quadratic worst-case complexity and it allows cause a denial of service when identifying crafted invalid RFCs. This ReDoS issue is on the client side and needs remote attackers to control the HTTP server. diff --git a/Misc/NEWS.d/next/Security/2021-03-30-16-29-51.bpo-36384.sCAmLs.rst b/Misc/NEWS.d/next/Security/2021-03-30-16-29-51.bpo-36384.sCAmLs.rst deleted file mode 100644 index f956cde..0000000 --- a/Misc/NEWS.d/next/Security/2021-03-30-16-29-51.bpo-36384.sCAmLs.rst +++ /dev/null @@ -1,6 +0,0 @@ -:mod:`ipaddress` module no longer accepts any leading zeros in IPv4 address -strings. Leading zeros are ambiguous and interpreted as octal notation by -some libraries. For example the legacy function :func:`socket.inet_aton` -treats leading zeros as octal notatation. glibc implementation of modern -:func:`~socket.inet_pton` does not accept any leading zeros. For a while -the :mod:`ipaddress` module used to accept ambiguous leading zeros. diff --git a/Misc/NEWS.d/next/Security/2021-04-06-18-07-48.bpo-43756.DLBNqQ.rst b/Misc/NEWS.d/next/Security/2021-04-06-18-07-48.bpo-43756.DLBNqQ.rst deleted file mode 100644 index e05fef2..0000000 --- a/Misc/NEWS.d/next/Security/2021-04-06-18-07-48.bpo-43756.DLBNqQ.rst +++ /dev/null @@ -1,2 +0,0 @@ -Add new audit event ``glob.glob/2`` to incorporate the new *root_dir* and -*dir_fd* arguments added to :func:`glob.glob` and :func:`glob.iglob`. diff --git a/Misc/NEWS.d/next/Security/2021-04-07-12-57-41.bpo-43762.7lMtpT.rst b/Misc/NEWS.d/next/Security/2021-04-07-12-57-41.bpo-43762.7lMtpT.rst deleted file mode 100644 index aa39265..0000000 --- a/Misc/NEWS.d/next/Security/2021-04-07-12-57-41.bpo-43762.7lMtpT.rst +++ /dev/null @@ -1,3 +0,0 @@ -Add audit events for :func:`sqlite3.connect/handle`, -:meth:`sqlite3.Connection.enable_load_extension`, and -:meth:`sqlite3.Connection.load_extension`. Patch by Erlend E. Aasland. diff --git a/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst b/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst deleted file mode 100644 index 713a683..0000000 --- a/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix invalid free in _sha3 module. The issue was introduced in 3.10.0a1. -Python 3.9 and earlier are not affected. diff --git a/Misc/NEWS.d/next/Security/2021-04-21-22-53-31.bpo-43472.gjLBTb.rst b/Misc/NEWS.d/next/Security/2021-04-21-22-53-31.bpo-43472.gjLBTb.rst deleted file mode 100644 index e38dc16..0000000 --- a/Misc/NEWS.d/next/Security/2021-04-21-22-53-31.bpo-43472.gjLBTb.rst +++ /dev/null @@ -1,3 +0,0 @@ -Ensures interpreter-level audit hooks receive the -``cpython.PyInterpreterState_New`` event when called through the -``_xxsubinterpreters`` module. diff --git a/Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst b/Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst deleted file mode 100644 index a326d07..0000000 --- a/Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst +++ /dev/null @@ -1,6 +0,0 @@ -The presence of newline or tab characters in parts of a URL could allow -some forms of attacks. - -Following the controlling specification for URLs defined by WHATWG -:func:`urllib.parse` now removes ASCII newlines and tabs from URLs, -preventing such attacks. diff --git a/Misc/NEWS.d/next/Security/2021-05-01-13-13-40.bpo-43998.xhmWD7.rst b/Misc/NEWS.d/next/Security/2021-05-01-13-13-40.bpo-43998.xhmWD7.rst deleted file mode 100644 index 6a40346..0000000 --- a/Misc/NEWS.d/next/Security/2021-05-01-13-13-40.bpo-43998.xhmWD7.rst +++ /dev/null @@ -1,5 +0,0 @@ -The :mod:`ssl` module sets more secure cipher suites defaults. Ciphers -without forward secrecy and with SHA-1 MAC are disabled by default. Security -level 2 prohibits weak RSA, DH, and ECC keys with less than 112 bits of -security. :class:`~ssl.SSLContext` defaults to minimum protocol version TLS -1.2. Settings are based on Hynek Schlawack's research. diff --git a/Misc/NEWS.d/next/Security/2021-05-02-17-50-23.bpo-43434.cy7xz6.rst b/Misc/NEWS.d/next/Security/2021-05-02-17-50-23.bpo-43434.cy7xz6.rst deleted file mode 100644 index b5a3f8d..0000000 --- a/Misc/NEWS.d/next/Security/2021-05-02-17-50-23.bpo-43434.cy7xz6.rst +++ /dev/null @@ -1,4 +0,0 @@ -Creating :class:`sqlite3.Connection` objects now also produces -``sqlite3.connect`` and ``sqlite3.connect/handle`` :ref:`auditing events -<auditing>`. Previously these events were only produced by -:func:`sqlite3.connect` calls. Patch by Erlend E. Aasland. |