-
python3.8 (3.8.0-3ubuntu1~18.04.2) bionic-security; urgency=medium
* SECURITY UPDATE: Regular Expression Denial of Service
- debian/patches/CVE-2020-8492.patch: updates a regular expression in the
urllib.request.AbsatrctBasicAuthHandler class which allows for
catastrophic backtracking and could result in a Denial of Service
condition.
- CVE-2020-8492
* SECURITY UPDATE: Regular Expression Denial of Service
- debian/patches/CVE-2021-3733.patch: updates a regular expression in the
urllib.request.AbstractBasicAuthHandler class which has a quadratic
worst-case time complexity and could be abused by a malicious HTTP
server to cause a Denial of Service condition for a client.
- CVE-2021-3733
* SECURITY UPDATE: Denial of Service
- debian/patches/CVE-2021-3737.patch: addresses the potential for the
urllib http client to enter into an infinite loop and hang on a 100
Continue response from a malicious server.
- debian/patches/CVE-2021-3737_test-fix.patch: improves the regression
test in Lib/test/test_httplib.py
- CVE-2021-3737
-- Ian Constantin <email address hidden> Thu, 09 Dec 2021 12:53:27 -0500
-
python3.8 (3.8.0-3~18.04.1) bionic-security; urgency=medium
* SECURITY UPDATE: Code execution from content received via HTTP
- debian/patches/CVE-2020-27619.patch: no longer call eval() on
content received via HTTP in Lib/test/multibytecodec_support.py.
- CVE-2020-27619
* SECURITY UPDATE: Buffer overflow
- debian/patches/CVE-2021-3177.patch: replace snprintf with Python unicode
formatting in ctypes param reprs in Lib/ctypes/test/test_parameters.py,
Modules/_ctypes/callproc.c.
- CVE-2021-3177
-- Paulo Flabiano Smorigo <email address hidden> Thu, 25 Feb 2021 22:10:10 +0000
-
python3.8 (3.8.0-3~18.04) bionic-proposed; urgency=medium
* SRU: LP: #1835737. Backport the final Python 3.8.0 release.
* Don't build the -doc package, outdated sphinx version in bionic.
-- Matthias Klose <email address hidden> Mon, 28 Oct 2019 17:14:01 +0100
