summaryrefslogtreecommitdiffstats
path: root/Misc/NEWS.d/next/Security
diff options
context:
space:
mode:
authorNed Deily <nad@python.org>2021-05-08 02:31:01 (GMT)
committerGitHub <noreply@github.com>2021-05-08 02:31:01 (GMT)
commit164d6e1bb1bb3a4e4d5610f07a8911ecf57a691d (patch)
treec88ccb611c1b50e7fdfc58a58aa472df5a4d7e98 /Misc/NEWS.d/next/Security
parent4d4be477055d0f9e415407bcd193788fae04dc11 (diff)
downloadcpython-164d6e1bb1bb3a4e4d5610f07a8911ecf57a691d.zip
cpython-164d6e1bb1bb3a4e4d5610f07a8911ecf57a691d.tar.gz
cpython-164d6e1bb1bb3a4e4d5610f07a8911ecf57a691d.tar.bz2
Add the blurbify of the 3.10.0b1 changelog to the main branch (GH-25976)
Diffstat (limited to 'Misc/NEWS.d/next/Security')
-rw-r--r--Misc/NEWS.d/next/Security/2020-07-04-22-14-46.bpo-37363.NDjHNw.rst1
-rw-r--r--Misc/NEWS.d/next/Security/2021-01-09-17-07-36.bpo-42800._dtZvW.rst1
-rw-r--r--Misc/NEWS.d/next/Security/2021-01-31-05-28-14.bpo-43075.DoAXqO.rst1
-rw-r--r--Misc/NEWS.d/next/Security/2021-03-30-16-29-51.bpo-36384.sCAmLs.rst6
-rw-r--r--Misc/NEWS.d/next/Security/2021-04-06-18-07-48.bpo-43756.DLBNqQ.rst2
-rw-r--r--Misc/NEWS.d/next/Security/2021-04-07-12-57-41.bpo-43762.7lMtpT.rst3
-rw-r--r--Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst2
-rw-r--r--Misc/NEWS.d/next/Security/2021-04-21-22-53-31.bpo-43472.gjLBTb.rst3
-rw-r--r--Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst6
-rw-r--r--Misc/NEWS.d/next/Security/2021-05-01-13-13-40.bpo-43998.xhmWD7.rst5
-rw-r--r--Misc/NEWS.d/next/Security/2021-05-02-17-50-23.bpo-43434.cy7xz6.rst4
11 files changed, 0 insertions, 34 deletions
diff --git a/Misc/NEWS.d/next/Security/2020-07-04-22-14-46.bpo-37363.NDjHNw.rst b/Misc/NEWS.d/next/Security/2020-07-04-22-14-46.bpo-37363.NDjHNw.rst
deleted file mode 100644
index 5390848..0000000
--- a/Misc/NEWS.d/next/Security/2020-07-04-22-14-46.bpo-37363.NDjHNw.rst
+++ /dev/null
@@ -1 +0,0 @@
-Add audit events to the :mod:`http.client` module. \ No newline at end of file
diff --git a/Misc/NEWS.d/next/Security/2021-01-09-17-07-36.bpo-42800._dtZvW.rst b/Misc/NEWS.d/next/Security/2021-01-09-17-07-36.bpo-42800._dtZvW.rst
deleted file mode 100644
index d01c0c3..0000000
--- a/Misc/NEWS.d/next/Security/2021-01-09-17-07-36.bpo-42800._dtZvW.rst
+++ /dev/null
@@ -1 +0,0 @@
-Audit hooks are now fired for frame.f_code, traceback.tb_frame, and generator code/frame attribute access.
diff --git a/Misc/NEWS.d/next/Security/2021-01-31-05-28-14.bpo-43075.DoAXqO.rst b/Misc/NEWS.d/next/Security/2021-01-31-05-28-14.bpo-43075.DoAXqO.rst
deleted file mode 100644
index 1c9f727..0000000
--- a/Misc/NEWS.d/next/Security/2021-01-31-05-28-14.bpo-43075.DoAXqO.rst
+++ /dev/null
@@ -1 +0,0 @@
-Fix Regular Expression Denial of Service (ReDoS) vulnerability in :class:`urllib.request.AbstractBasicAuthHandler`. The ReDoS-vulnerable regex has quadratic worst-case complexity and it allows cause a denial of service when identifying crafted invalid RFCs. This ReDoS issue is on the client side and needs remote attackers to control the HTTP server.
diff --git a/Misc/NEWS.d/next/Security/2021-03-30-16-29-51.bpo-36384.sCAmLs.rst b/Misc/NEWS.d/next/Security/2021-03-30-16-29-51.bpo-36384.sCAmLs.rst
deleted file mode 100644
index f956cde..0000000
--- a/Misc/NEWS.d/next/Security/2021-03-30-16-29-51.bpo-36384.sCAmLs.rst
+++ /dev/null
@@ -1,6 +0,0 @@
-:mod:`ipaddress` module no longer accepts any leading zeros in IPv4 address
-strings. Leading zeros are ambiguous and interpreted as octal notation by
-some libraries. For example the legacy function :func:`socket.inet_aton`
-treats leading zeros as octal notatation. glibc implementation of modern
-:func:`~socket.inet_pton` does not accept any leading zeros. For a while
-the :mod:`ipaddress` module used to accept ambiguous leading zeros.
diff --git a/Misc/NEWS.d/next/Security/2021-04-06-18-07-48.bpo-43756.DLBNqQ.rst b/Misc/NEWS.d/next/Security/2021-04-06-18-07-48.bpo-43756.DLBNqQ.rst
deleted file mode 100644
index e05fef2..0000000
--- a/Misc/NEWS.d/next/Security/2021-04-06-18-07-48.bpo-43756.DLBNqQ.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-Add new audit event ``glob.glob/2`` to incorporate the new *root_dir* and
-*dir_fd* arguments added to :func:`glob.glob` and :func:`glob.iglob`.
diff --git a/Misc/NEWS.d/next/Security/2021-04-07-12-57-41.bpo-43762.7lMtpT.rst b/Misc/NEWS.d/next/Security/2021-04-07-12-57-41.bpo-43762.7lMtpT.rst
deleted file mode 100644
index aa39265..0000000
--- a/Misc/NEWS.d/next/Security/2021-04-07-12-57-41.bpo-43762.7lMtpT.rst
+++ /dev/null
@@ -1,3 +0,0 @@
-Add audit events for :func:`sqlite3.connect/handle`,
-:meth:`sqlite3.Connection.enable_load_extension`, and
-:meth:`sqlite3.Connection.load_extension`. Patch by Erlend E. Aasland.
diff --git a/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst b/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst
deleted file mode 100644
index 713a683..0000000
--- a/Misc/NEWS.d/next/Security/2021-04-18-00-56-44.bpo-43362.__5aiP.rst
+++ /dev/null
@@ -1,2 +0,0 @@
-Fix invalid free in _sha3 module. The issue was introduced in 3.10.0a1.
-Python 3.9 and earlier are not affected.
diff --git a/Misc/NEWS.d/next/Security/2021-04-21-22-53-31.bpo-43472.gjLBTb.rst b/Misc/NEWS.d/next/Security/2021-04-21-22-53-31.bpo-43472.gjLBTb.rst
deleted file mode 100644
index e38dc16..0000000
--- a/Misc/NEWS.d/next/Security/2021-04-21-22-53-31.bpo-43472.gjLBTb.rst
+++ /dev/null
@@ -1,3 +0,0 @@
-Ensures interpreter-level audit hooks receive the
-``cpython.PyInterpreterState_New`` event when called through the
-``_xxsubinterpreters`` module.
diff --git a/Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst b/Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst
deleted file mode 100644
index a326d07..0000000
--- a/Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst
+++ /dev/null
@@ -1,6 +0,0 @@
-The presence of newline or tab characters in parts of a URL could allow
-some forms of attacks.
-
-Following the controlling specification for URLs defined by WHATWG
-:func:`urllib.parse` now removes ASCII newlines and tabs from URLs,
-preventing such attacks.
diff --git a/Misc/NEWS.d/next/Security/2021-05-01-13-13-40.bpo-43998.xhmWD7.rst b/Misc/NEWS.d/next/Security/2021-05-01-13-13-40.bpo-43998.xhmWD7.rst
deleted file mode 100644
index 6a40346..0000000
--- a/Misc/NEWS.d/next/Security/2021-05-01-13-13-40.bpo-43998.xhmWD7.rst
+++ /dev/null
@@ -1,5 +0,0 @@
-The :mod:`ssl` module sets more secure cipher suites defaults. Ciphers
-without forward secrecy and with SHA-1 MAC are disabled by default. Security
-level 2 prohibits weak RSA, DH, and ECC keys with less than 112 bits of
-security. :class:`~ssl.SSLContext` defaults to minimum protocol version TLS
-1.2. Settings are based on Hynek Schlawack's research.
diff --git a/Misc/NEWS.d/next/Security/2021-05-02-17-50-23.bpo-43434.cy7xz6.rst b/Misc/NEWS.d/next/Security/2021-05-02-17-50-23.bpo-43434.cy7xz6.rst
deleted file mode 100644
index b5a3f8d..0000000
--- a/Misc/NEWS.d/next/Security/2021-05-02-17-50-23.bpo-43434.cy7xz6.rst
+++ /dev/null
@@ -1,4 +0,0 @@
-Creating :class:`sqlite3.Connection` objects now also produces
-``sqlite3.connect`` and ``sqlite3.connect/handle`` :ref:`auditing events
-<auditing>`. Previously these events were only produced by
-:func:`sqlite3.connect` calls. Patch by Erlend E. Aasland.