summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Python 3.8.16v3.8.16Łukasz Langa2022-12-069-23/+69
|
* [3.8] gh-100001: Omit control characters in http.server stderr logs. ↵Miss Islington (bot)2022-12-064-2/+46
| | | | | | | | | | | | | | | | (GH-100002) (#100033) * gh-100001: Omit control characters in http.server stderr logs. (GH-100002) Replace control characters in http.server.BaseHTTPRequestHandler.log_message with an escaped \xHH sequence to avoid causing problems for the terminal the output is printed to. (cherry picked from commit d8ab0a4dfa48f881b4ac9ab857d2e9de42f72828) Co-authored-by: Gregory P. Smith <greg@krypto.org> * also escape \s (backport of PR #100038). * add versionadded and remove extraneous 'to' Co-authored-by: Gregory P. Smith <greg@krypto.org>
* [3.8] gh-87604: Avoid publishing list of active per-interpreter audit hooks ↵Miss Islington (bot)2022-11-214-0/+20
| | | | | | | | via the gc module (GH-99373) (GH-99661) (cherry picked from commit 7b98207aa46bd637d07a7c4a84e998726b74acde) Co-authored-by: Steve Dower <steve.dower@python.org>
* [3.8] gh-98433: Fix quadratic time idna decoding. (GH-99092) (GH-99222) ↵Miss Islington (bot)2022-11-103-17/+27
| | | | | | | | | | | | | (GH-99231) There was an unnecessary quadratic loop in idna decoding. This restores the behavior to linear. (cherry picked from commit d315722564927c7202dd6e111dc79eaf14240b0d) (cherry picked from commit a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15) Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Co-authored-by: Gregory P. Smith <greg@krypto.org>
* [3.8] gh-98517: Fix buffer overflows in _sha3 module (GH-98519) (#98527)Miss Islington (bot)2022-10-283-7/+18
| | | | | | | | | | | | | This is a port of the applicable part of XKCP's fix [1] for CVE-2022-37454 and avoids the segmentation fault and the infinite loop in the test cases published in [2]. [1]: https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a [2]: https://mouha.be/sha-3-buffer-overflow/ Regression test added by: Gregory P. Smith [Google LLC] <greg@krypto.org> (cherry picked from commit 0e4e058602d93b88256ff90bbef501ba20be9dd3) Co-authored-by: Theo Buehler <botovq@users.noreply.github.com>
* [3.8] gh-98739: Update libexpat from 2.4.9 to 2.5.0 (GH-98742) (#98787)Miss Islington (bot)2022-10-284-18/+36
| | | | | | | Update libexpat from 2.4.9 to 2.5.0 to address CVE-2022-43680. Co-authored-by: Shaun Walbridge <shaun.walbridge@gmail.com> (cherry picked from commit 3e07f827b359617664ad0880f218f17ae4483299)
* [3.8] gh-68966: Make mailcap refuse to match unsafe filenames/types/params ↵Miss Islington (bot)2022-10-114-4/+46
| | | | | | | | | (GH-91993) (#98192) gh-68966: Make mailcap refuse to match unsafe filenames/types/params (GH-91993) (cherry picked from commit b9509ba7a9c668b984dab876c7926fe1dc5aa0ba) Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Łukasz Langa <lukasz@langa.pl>
* [3.8] gh-96710: Make the test timing more lenient for the int/str DoS ↵Miss Islington (bot)2022-10-111-6/+8
| | | | | | | | | | | | | | regression test. (GH-96717) (#98197) gh-96710: Make the test timing more lenient for the int/str DoS regression test. (GH-96717) A regression would still absolutely fail and even a flaky pass isn't harmful as it'd fail most of the time across our N system test runs. Windows has a low resolution timer and CI systems are prone to odd timing so this just gives more leeway to avoid flakiness. (cherry picked from commit 11e3548fd1d3445ccde971d613633b58d73c3016) Co-authored-by: Gregory P. Smith <greg@krypto.org>
* Post 3.8.15Łukasz Langa2022-10-111-1/+1
|
* Python 3.8.15v3.8.15Łukasz Langa2022-10-1110-18/+65
|
* [3.8] gh-95778: Mention sys.set_int_max_str_digits() in error message ↵Miss Islington (bot)2022-10-043-4/+7
| | | | | | | | | | | | | | | (GH-96874) (GH-96877) (GH-97835) [3.9] gh-95778: Mention sys.set_int_max_str_digits() in error message (GH-96874) (GH-96877) When ValueError is raised if an integer is larger than the limit, mention sys.set_int_max_str_digits() in the error message. (cherry picked from commit e841ffc915e82e5ea6e3b473205417d63494808d) Co-authored-by: Ned Deily <nad@python.org> (cherry picked from commit 41188134bd2120f0cedd681ed88743c11c7f3742) Co-authored-by: Victor Stinner <vstinner@python.org>
* [3.8] gh-96848: Fix -X int_max_str_digits option parsing (GH-96988) (GH-97575)Miss Islington (bot)2022-10-043-1/+7
| | | | | | | | Fix command line parsing: reject "-X int_max_str_digits" option with no value (invalid) when the PYTHONINTMAXSTRDIGITS environment variable is set to a valid limit. (cherry picked from commit 41351662bcd21672d8ccfa62fe44d72027e6bcf8) Co-authored-by: Victor Stinner <vstinner@python.org>
* [3.8] gh-96577: Fixes buffer overrun in _msi module (GH-96633) (GH-96658)Miss Islington (bot)2022-10-042-2/+3
| | | | | | gh-96577: Fixes buffer overrun in _msi module (GH-96633) (cherry picked from commit 4114bcc9ef7595a07196bcecf9c7d6d39f57f64d) Co-authored-by: Steve Dower <steve.dower@python.org>
* [3.8] gh-97005: Update libexpat from 2.4.7 to 2.4.9 (gh-97006) (gh-97013)Miss Islington (bot)2022-10-048-17/+28
| | | | | | | | gh-97005: Update libexpat from 2.4.7 to 2.4.9 (gh-97006) Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org> (cherry picked from commit 10e3d398c31cc1695752fc52bc6ca2ce9ef6237e) Co-authored-by: Dong-hee Na <donghee.na@python.org>
* [3.8] gh-97616: list_resize() checks for integer overflow (GH-97617) (GH-97628)Miss Islington (bot)2022-10-043-2/+24
| | | | | | | | | | | | | gh-97616: list_resize() checks for integer overflow (GH-97617) Fix multiplying a list by an integer (list *= int): detect the integer overflow when the new allocated length is close to the maximum size. Issue reported by Jordan Limor. list_resize() now checks for integer overflow before multiplying the new allocated length by the list item size (sizeof(PyObject*)). (cherry picked from commit a5f092f3c469b674b8d9ccbd4e4377230c9ac7cf) Co-authored-by: Victor Stinner <vstinner@python.org>
* [3.8] gh-97612: Fix shell injection in get-remote-certificate.py (GH-97613) ↵Miss Islington (bot)2022-10-042-18/+10
| | | | | | | | | | | | | | | | (GH-97633) Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead. Co-authored-by: Caleb Shortt <caleb@rgauge.com> (cherry picked from commit 83a0f44ffd8b398673ae56c310cf5768d359c341) Co-authored-by: Victor Stinner <vstinner@python.org>
* [3.8] Update bugs URL references in README and Docs/bugs.rst from bpo to gh ↵Ned Deily2022-09-112-22/+23
| | | | | | | issues (GH-96728) Co-authored-by: roy reznik <royreznik@gmail.com> Co-authored-by: Inada Naoki <songofacandy@gmail.com> Co-authored-by: Ezio Melotti <ezio.melotti@gmail.com>
* Post 3.8.14Łukasz Langa2022-09-061-1/+1
|
* Python 3.8.14v3.8.14Łukasz Langa2022-09-0615-62/+125
|
* [3.8] gh-95778: CVE-2020-10735: Prevent DoS by very large int() (#96503)Gregory P. Smith2022-09-0526-23/+885
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Correctly pre-check for int-to-str conversion Converting a large enough `int` to a decimal string raises `ValueError` as expected. However, the raise comes _after_ the quadratic-time base-conversion algorithm has run to completion. For effective DOS prevention, we need some kind of check before entering the quadratic-time loop. Oops! =) The quick fix: essentially we catch _most_ values that exceed the threshold up front. Those that slip through will still be on the small side (read: sufficiently fast), and will get caught by the existing check so that the limit remains exact. The justification for the current check. The C code check is: ```c max_str_digits / (3 * PyLong_SHIFT) <= (size_a - 11) / 10 ``` In GitHub markdown math-speak, writing $M$ for `max_str_digits`, $L$ for `PyLong_SHIFT` and $s$ for `size_a`, that check is: $$\left\lfloor\frac{M}{3L}\right\rfloor \le \left\lfloor\frac{s - 11}{10}\right\rfloor$$ From this it follows that $$\frac{M}{3L} < \frac{s-1}{10}$$ hence that $$\frac{L(s-1)}{M} > \frac{10}{3} > \log_2(10).$$ So $$2^{L(s-1)} > 10^M.$$ But our input integer $a$ satisfies $|a| \ge 2^{L(s-1)}$, so $|a|$ is larger than $10^M$. This shows that we don't accidentally capture anything _below_ the intended limit in the check. <!-- gh-issue-number: gh-95778 --> * Issue: gh-95778 <!-- /gh-issue-number --> Co-authored-by: Gregory P. Smith [Google LLC] <greg@krypto.org> Co-authored-by: Christian Heimes <christian@python.org> Co-authored-by: Mark Dickinson <dickinsm@gmail.com>
* [3.8] gh-90359: Update documentation to follow PEP 495. (gh-94800). (GH-94834)Dong-hee Na2022-07-281-0/+14
| | | | | (cherry picked from commit 07374cce52abb7fd39729dc1b646ca3029b64c64) Co-authored-by: Dong-hee Na <donghee.na@python.org>
* [3.8] gh-94208: Add more TLS version/protocol checks for FreeBSD (GH-94347) ↵Łukasz Langa2022-07-272-23/+33
| | | | | | | | (GH-95313) Three test cases were failing on FreeBSD with latest OpenSSL. (cherry picked from commit 1bc86c26253befa006c0f52eebb6ed633c7d1e5c) Co-authored-by: Christian Heimes <christian@python.org>
* [3.8] gh-90355: Add isolated flag if currently isolated (GH-92857) (GH-94571)Łukasz Langa2022-07-052-1/+7
| | | | | | | Co-authored-by: Carter Dodd <carter.dodd@gmail.com> Co-authored-by: Éric <merwok@netwok.org> Co-authored-by: Łukasz Langa <lukasz@langa.pl> (cherry picked from commit c8556bcf6c0b05ac46bd74880626a2853e7c99a1)
* [3.8] gh-81054: Document that SimpleHTTPRequestHandler follows symbolic ↵Łukasz Langa2022-07-011-1/+12
| | | | | | | links (GH-94416) (GH-94495) (cherry picked from commit 80aaeabb8bd1e6b49598a7e23e0f8d99b3fcecaf) Co-authored-by: Sam Ezeh <sam.z.ezeh@gmail.com>
* gh-91172: Create a workflow for verifying bundled pip and setuptools ↵Miss Islington (bot)2022-06-223-0/+128
| | | | | | | | | (GH-31885) (GH-94124) Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> (cherry picked from commit d36954b7ead06daead3dcf9b0dd9f8002eab508f) Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
* gh-87389: Fix an open redirection vulnerability in http.server. (GH-93879) ↵Miss Islington (bot)2022-06-223-2/+61
| | | | | | | | | | | | | (GH-94094) Fix an open redirection vulnerability in the `http.server` module when an URI path starts with `//` that could produce a 301 Location header with a misleading target. Vulnerability discovered, and logic fix proposed, by Hamza Avvan (@hamzaavvan). Test and comments authored by Gregory P. Smith [Google]. (cherry picked from commit 4abab6b603dd38bec1168e9a37c40a48ec89508e) Co-authored-by: Gregory P. Smith <greg@krypto.org>
* gh-83728: Add hmac.new default parameter deprecation (GH-91939) (GH-93547)Miss Islington (bot)2022-06-061-0/+2
| | | | | (cherry picked from commit 56b5daf15970be449d44e91f08db84c698ac5506) Co-authored-by: Stanley <46876382+slateny@users.noreply.github.com>
* bpo-46114: Fix OpenSSL version check for 3.0.1 (GH-30170) (GH-92954)Victor Stinner2022-06-062-6/+11
| | | | | (cherry picked from commit 2985feac4e02d590bb78bcce9e30864be53280ac) Co-authored-by: Christian Heimes <christian@python.org>
* [3.8] gh-93065: Fix HAMT to iterate correctly over 7-level deep trees ↵Łukasz Langa2022-05-245-4/+66
| | | | | | | | | | | | (GH-93066) (#93148) Also while there, clarify a few things about why we reduce the hash to 32 bits. Co-authored-by: Eli Libman <eli@hyro.ai> Co-authored-by: Yury Selivanov <yury@edgedb.com> Co-authored-by: Łukasz Langa <lukasz@langa.pl> (cherry picked from commit c1f5c903a7e4ed27190488f4e33b00d3c3d952e5)
* [3.8] gh-80254: Disallow recursive usage of cursors in sqlite3 converters ↵Erlend Egeberg Aasland2022-05-163-14/+77
| | | | | | | | | (#92333) (cherry picked from commit c908dc5b4798c311981bd7e1f7d92fb623ee448b) Co-authored-by: Sergey Fedoseev <fedoseev.sergey@gmail.com> Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
* bpo-47194: Update zlib to v1.2.12 on Windows to resolve CVE-2018-25032 ↵Miss Islington (bot)2022-05-163-2/+3
| | | | | | | (GH-32241) (GH-32250) (cherry picked from commit 6066739ff7794e54c98c08b953a699cbc961cd28) Co-authored-by: Zachary Ware <zach@python.org>
* [3.8] gh-92448: Update the documentation builder to render the GitHub… ↵Dong-hee Na2022-05-125-8/+9
| | | | | | | | (GH-92605) (cherry picked from commit 45e1721d100bab09510ccf9da49f14ca5cc268f4) Co-authored-by: Dong-hee Na <donghee.na@python.org>
* [3.8] Update Sphinx bpo role to use redirect URI. (#91892)Ezio Melotti2022-05-100-0/+0
| | | | | | | | * Update Sphinx bpo role to use redirect URI. (GH-32342) * [3.8] Update Sphinx bpo role to use redirect URI. (GH-32342). (cherry picked from commit 08cfe079503ffd19d8b7ab324f0fdb1c6b150ca8) Co-authored-by: Ezio Melotti <ezio.melotti@gmail.com>
* Add redirects to Misc/NEWS bpo links (GH-91454) (#91895)Miss Islington (bot)2022-05-101-1/+2
| | | | | | | (cherry picked from commit 17dbb6bc10ca8a8b602335414c047294f00afcbe) Co-authored-by: Ezio Melotti <ezio.melotti@gmail.com> Co-authored-by: Ezio Melotti <ezio.melotti@gmail.com>
* [3.8] gh-91888: add a `:gh:` role to the documentation (GH-91889) (#91936)Ezio Melotti2022-05-102-1/+26
| | | | | | | | | | | | | | | | | | | | * gh-91888: Add a :gh: role to the documentation (GH-91889). * [3.8] gh-91888: add a `:gh:` role to the documentation (GH-91889) * Add a new :gh:`...` role for GitHub issues. * Fix a GitHub id to use the :gh: role. * Add Misc/NEWS entry. * Refactoring and rephrasing. Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>. (cherry picked from commit f7641a2ffec243e5f600028a84debe9028a9ee44) Co-authored-by: Ezio Melotti <ezio.melotti@gmail.com> * Fix use of the default role in NEWS entry
* bpo-47138: Ensure Windows docs build uses the same pinned version as other ↵Steve Dower2022-05-091-1/+2
| | | | | platforms (GH-32161) (#32183) Co-authored-by: Ned Deily <nad@python.org>
* [3.8] bpo-47138: Fix documentation build by pinning Jinja version to 3.0.3 ↵m-aciek2022-04-082-0/+3
| | | | | (GH-32109) Co-authored-by: Ned Deily <nad@python.org>
* Post 3.8.13, take twoŁukasz Langa2022-03-161-1/+1
|
* Python 3.8.13, take twov3.8.13Łukasz Langa2022-03-161-1/+1
| | | | This reverts commit e5f711f5eeb6db4290db1b747f42f5d723d12ed3.
* bpo-31327: Update time documentation to reflect possible errors (GH-31460) ↵Miss Islington (bot)2022-03-161-0/+6
| | | | | | | | | | | | | | | | | | | | (GH-31827) As per the comments, this mirrors the [datetime documentation](https://docs.python.org/3/library/datetime.htmlGH-datetime.datetime.fromtimestamp). ``` >>> import time >>> time.localtime(999999999999999999999) Traceback (most recent call last): File "<stdin>", line 1, in <module> OverflowError: timestamp out of range for platform time_t >>> time.localtime(-3600) Traceback (most recent call last): File "<stdin>", line 1, in <module> OSError: [Errno 22] Invalid argument ``` (cherry picked from commit c83fc9c02c9846ec3a2d0123999c98e02f00b3f5) Co-authored-by: slateny <46876382+slateny@users.noreply.github.com>
* bpo-46948: Fix launcher installer build failure due to first part of fix ↵Miss Islington (bot)2022-03-161-0/+2
| | | | | | | (GH-31920) (GH-31924) (cherry picked from commit 708812085355c92f32e547d1f1d1f29aefbbc27e) Co-authored-by: Steve Dower <steve.dower@python.org>
* Post 3.8.13Łukasz Langa2022-03-151-1/+1
|
* Python 3.8.13Łukasz Langa2022-03-1522-61/+204
|
* [3.8] bpo-47024: Update Windows builds and macOS installer build to use ↵Ned Deily2022-03-1510-75/+16
| | | | | | | OpenSSL 1.1.1n. (GH-31912) * bpo-47024: Update Windows builds and macOS installer build to use OpenSSL 1.1.1n. * Revert inadvertent sqlite downgrade
* bpo-46985: Upgrade bundled pip to 22.0.4 (GH-31819) (GH-31851)Ned Deily2022-03-154-4/+3
| | | | | (cherry picked from commit d87f1b787ed38dfd307d82452f2efe9dc5b93942) Co-authored-by: Pradyun Gedam <pgedam@bloomberg.net>
* bpo-45405: Prevent internal configure error when running configure with ↵Ned Deily2022-03-153-6/+12
| | | | | | | | | | | | | | | | | | recent versions of clang. (GH-28845) (GH-31889) Change the configure logic to function properly on macOS when the compiler outputs a platform triplet for option --print-multiarch. The Apple Clang included with Xcode 13.3 now supports --print-multiarch causing configure to fail without this change. Co-authored-by: Ned Deily <nad@python.org> (cherry picked from commit 9c4766772cda67648184f8ddba546a5fc0167f91) Co-authored-by: David Bohman <debohman@gmail.com> Automerge-Triggered-By: GH:ned-deily (cherry picked from commit 9901d153c201d852d27dc9d3074e283c26468f6d) Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
* bpo-46784: Add newly exported expat symbols to the namespace. (GH-31397) ↵Miss Islington (bot)2022-03-082-0/+6
| | | | | | | | | | | | | | | | | | | | (GH-31419) The libexpat 2.4.1 upgrade from introduced the following new exported symbols: * `testingAccountingGetCountBytesDirect` * `testingAccountingGetCountBytesIndirect` * `unsignedCharToPrintable` * `XML_SetBillionLaughsAttackProtectionActivationThreshold` * `XML_SetBillionLaughsAttackProtectionMaximumAmplification` We need to adjust [Modules/expat/pyexpatns.h](https://github.com/python/cpython/blob/master/Modules/expat/pyexpatns.h) (The newer libexpat upgrade has no new symbols). Automerge-Triggered-By: GH:gpshead (cherry picked from commit 6312c1052c0186b4596fc45c42fd3ade9f8f5911) Co-authored-by: Yilei "Dolee" Yang <yileiyang@google.com>
* Update copyright year to 2022. (GH-30335) (GH-31478)Miss Islington (bot)2022-03-089-10/+10
| | | | | | Automerge-Triggered-By: GH:benjaminp (cherry picked from commit ba00f0d93a4aea85ae8089f139856a7c450584d7) Co-authored-by: Benjamin Peterson <benjamin@python.org>
* bpo-44549: Update bzip2 to 1.0.8 in Windows builds to mitigate CVE-2016-3189 ↵Steve Dower2022-03-084-3/+5
| | | | and CVE-2019-12900 (GH-31732) (GH-31734)
* bpo-46948: Fix CVE-2022-26488 by ensuring the Windows Installer correctly ↵Steve Dower2022-03-0811-4/+26
| | | | uses the install path during repair (GH-31729)
generated by cgit v0.12 at 2026-01-09 23:58:45 (GMT)