diff options
author | Larry Hastings <larry@hastings.org> | 2018-01-23 12:25:28 (GMT) |
---|---|---|
committer | Larry Hastings <larry@hastings.org> | 2018-01-23 12:25:28 (GMT) |
commit | 604fb621907fa3077726b36c87b9d8141aab54da (patch) | |
tree | f1ecdc5a056475dab64c1d5916fd2ef872bcf122 /Misc | |
parent | 43f014d3f12468edf61046f0612edc7660042fd5 (diff) | |
download | cpython-604fb621907fa3077726b36c87b9d8141aab54da.zip cpython-604fb621907fa3077726b36c87b9d8141aab54da.tar.gz cpython-604fb621907fa3077726b36c87b9d8141aab54da.tar.bz2 |
blurb release and pydoc topics for 3.5.5rc1.
Diffstat (limited to 'Misc')
7 files changed, 74 insertions, 28 deletions
diff --git a/Misc/NEWS.d/3.5.5rc1.rst b/Misc/NEWS.d/3.5.5rc1.rst new file mode 100644 index 0000000..879f6c4 --- /dev/null +++ b/Misc/NEWS.d/3.5.5rc1.rst @@ -0,0 +1,74 @@ +.. bpo: 32551 +.. date: 2018-01-16-16-05-37 +.. nonce: U0z4W- +.. release date: 2018-01-23 +.. section: Security + +The ``sys.path[0]`` initialization change for bpo-29139 caused a regression +by revealing an inconsistency in how sys.path is initialized when executing +``__main__`` from a zipfile, directory, or other import location. This is +considered a potential security issue, as it may lead to privileged +processes unexpectedly loading code from user controlled directories in +situations where that was not previously the case. + +The interpreter now consistently avoids ever adding the import location's +parent directory to ``sys.path``, and ensures no other ``sys.path`` entries +are inadvertently modified when inserting the import location named on the +command line. (Originally reported as bpo-29723 against Python 3.6rc1, but +it was missed at the time that the then upcoming Python 3.5.4 release would +also be affected) + +.. + +.. bpo: 30657 +.. date: 2017-12-01-18-51-03 +.. nonce: Fd8kId +.. section: Security + +Fixed possible integer overflow in PyBytes_DecodeEscape, CVE-2017-1000158. +Original patch by Jay Bosamiya; rebased to Python 3 by Miro Hrončok. + +.. + +.. bpo: 30947 +.. date: 2017-09-05-20-34-44 +.. nonce: iNMmm4 +.. section: Security + +Upgrade libexpat embedded copy from version 2.2.1 to 2.2.3 to get security +fixes. + +.. + +.. bpo: 31095 +.. date: 2017-08-01-18-48-30 +.. nonce: bXWZDb +.. section: Core and Builtins + +Fix potential crash during GC caused by ``tp_dealloc`` which doesn't call +``PyObject_GC_UnTrack()``. + +.. + +.. bpo: 32072 +.. date: 2017-11-18-21-13-52 +.. nonce: nwDV8L +.. section: Library + +Fixed issues with binary plists: + +* Fixed saving bytearrays. +* Identical objects will be saved only once. +* Equal references will be load as identical objects. +* Added support for saving and loading recursive data structures. + +.. + +.. bpo: 31170 +.. date: 2017-09-05-20-35-21 +.. nonce: QGmJ1t +.. section: Library + +expat: Update libexpat from 2.2.3 to 2.2.4. Fix copying of partial +characters for UTF-8 input (libexpat bug 115): +https://github.com/libexpat/libexpat/issues/115 diff --git a/Misc/NEWS.d/next/Core and Builtins/2017-08-01-18-48-30.bpo-31095.bXWZDb.rst b/Misc/NEWS.d/next/Core and Builtins/2017-08-01-18-48-30.bpo-31095.bXWZDb.rst deleted file mode 100644 index ca1f8ba..0000000 --- a/Misc/NEWS.d/next/Core and Builtins/2017-08-01-18-48-30.bpo-31095.bXWZDb.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix potential crash during GC caused by ``tp_dealloc`` which doesn't call -``PyObject_GC_UnTrack()``. diff --git a/Misc/NEWS.d/next/Library/2017-09-05-20-35-21.bpo-31170.QGmJ1t.rst b/Misc/NEWS.d/next/Library/2017-09-05-20-35-21.bpo-31170.QGmJ1t.rst deleted file mode 100644 index 2505007..0000000 --- a/Misc/NEWS.d/next/Library/2017-09-05-20-35-21.bpo-31170.QGmJ1t.rst +++ /dev/null @@ -1,3 +0,0 @@ -expat: Update libexpat from 2.2.3 to 2.2.4. Fix copying of partial -characters for UTF-8 input (libexpat bug 115): -https://github.com/libexpat/libexpat/issues/115 diff --git a/Misc/NEWS.d/next/Library/2017-11-18-21-13-52.bpo-32072.nwDV8L.rst b/Misc/NEWS.d/next/Library/2017-11-18-21-13-52.bpo-32072.nwDV8L.rst deleted file mode 100644 index 6da5bb4..0000000 --- a/Misc/NEWS.d/next/Library/2017-11-18-21-13-52.bpo-32072.nwDV8L.rst +++ /dev/null @@ -1,6 +0,0 @@ -Fixed issues with binary plists: - -* Fixed saving bytearrays. -* Identical objects will be saved only once. -* Equal references will be load as identical objects. -* Added support for saving and loading recursive data structures. diff --git a/Misc/NEWS.d/next/Security/2017-09-05-20-34-44.bpo-30947.iNMmm4.rst b/Misc/NEWS.d/next/Security/2017-09-05-20-34-44.bpo-30947.iNMmm4.rst deleted file mode 100644 index 3caca9a7..0000000 --- a/Misc/NEWS.d/next/Security/2017-09-05-20-34-44.bpo-30947.iNMmm4.rst +++ /dev/null @@ -1,2 +0,0 @@ -Upgrade libexpat embedded copy from version 2.2.1 to 2.2.3 to get security -fixes. diff --git a/Misc/NEWS.d/next/Security/2017-12-01-18-51-03.bpo-30657.Fd8kId.rst b/Misc/NEWS.d/next/Security/2017-12-01-18-51-03.bpo-30657.Fd8kId.rst deleted file mode 100644 index 75359b6..0000000 --- a/Misc/NEWS.d/next/Security/2017-12-01-18-51-03.bpo-30657.Fd8kId.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fixed possible integer overflow in PyBytes_DecodeEscape, CVE-2017-1000158. -Original patch by Jay Bosamiya; rebased to Python 3 by Miro Hrončok. diff --git a/Misc/NEWS.d/next/Security/2018-01-16-16-05-37.bpo-32551.U0z4W-.rst b/Misc/NEWS.d/next/Security/2018-01-16-16-05-37.bpo-32551.U0z4W-.rst deleted file mode 100644 index 3ebcfbb..0000000 --- a/Misc/NEWS.d/next/Security/2018-01-16-16-05-37.bpo-32551.U0z4W-.rst +++ /dev/null @@ -1,13 +0,0 @@ -The ``sys.path[0]`` initialization change for bpo-29139 caused a regression -by revealing an inconsistency in how sys.path is initialized when executing -``__main__`` from a zipfile, directory, or other import location. This is -considered a potential security issue, as it may lead to privileged -processes unexpectedly loading code from user controlled directories in -situations where that was not previously the case. - -The interpreter now consistently avoids ever adding the import location's -parent directory to ``sys.path``, and ensures no other ``sys.path`` entries -are inadvertently modified when inserting the import location named on the -command line. (Originally reported as bpo-29723 against Python 3.6rc1, but -it was missed at the time that the then upcoming Python 3.5.4 release would -also be affected) |