This update for python fixes the following issues:
- CVE-2025-13462: incorrect parsing of TarInfo when GNU long name and type AREGTYPE are combined can lead to
misinterpretation of tar archives (bsc#1259611).
- CVE-2026-3644: incomplete control character validation in http.cookies can lead to input validation bypass
(bsc#1259734).
- CVE-2026-4224: parsing XML with deeply nested DTD content models can lead to C stack overflow (bsc#1259735).
- CVE-2026-4519: failure to sanitize leading dashes in URLs in the `webbrowser.open()` API can lead to web browser
command line option injection (bsc#1260026).
This update for python fixes the following issue:
- CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in `BytesGenerator`
(bsc#1257181).
This update for python fixes the following issues:
- CVE-2026-0672: Fixed a HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel. (bsc#1257031)
- CVE-2026-0865: Fixed a bug where a user-controlled header containing newlines can allow injecting HTTP headers. (bsc#1257042)
- CVE-2025-15366: Fixed a bug wherer a user-controlled command can allow additional commands injected using newlines. (bsc#1257044)
- CVE-2025-15367: Fixed control characters which may allow the injection of additional commands. (bsc#1257041)
This update for python fixes the following issues:
- Modified CVE-2025-6075 fix to not use `re.ASCII` flag (not available in Python 2.7) (bsc#1257064).
This update for python fixes the following issues:
- CVE-2025-13836: Fixed reading an HTTP response from a server, if no read
amount is specified, with using Content-Length per default as the length
(bsc#1254400)
- CVE-2025-12084: Fixed Denial of Service due to quadratic algorithm in
xml.dom.minidom (bsc#1254997).
This update for python fixes the following issues:
- CVE-2025-6075: quadratic complexity in `os.path.expandvars()` can lead to performance degradation when values passed
to it are user-controlled (bsc#1252974).
- CVE-2025-8291: lack of validity checks on the ZIP64 End of Central Directory (EOCD) record allows for the creation of
ZIP archives that are processed inconsistently by the `zipfile` module (bsc#1251305).
This update for python fixes the following issues:
- CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).
This update for python fixes the following issues:
- CVE-2025-6069: Fixed worst case quadratic complexity that can lead to amplified DoS. (bsc#1244705)
This update for python fixes the following issues:
- Reference to no longer used 'bracketed_host' variable in the fix for CVE-2025-0938 (bsc#1236705, bsc#1223694).
This update for python fixes the following issues:
- CVE-2025-0938: functions `urllib.parse.urlsplit` and `urlparse` accept domain names including square brackets (bsc#1236705).
This update for python fixes the following issues:
- CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses (bsc#1233307)
Other fixes:
This update for python fixes the following issues:
- CVE-2023-52425: Fixed using the system libexpat (bsc#1219559).
- CVE-2023-27043: Modifed fix for unicode string handling in email.utils.parseaddr() (bsc#1222537).
- CVE-2022-48560: Fixed use-after-free in Python via heappushpop in heapq (bsc#1214675).
- CVE-2024-0450: Detect the vulnerability of the 'quoted-overlap' zipbomb (bsc#1221854).
Bug fixes:
- Switch off tests. ONLY FOR FACTORY!!! (bsc#1219306).
- Build with -std=gnu89 to build correctly with gcc14 (bsc#1220970).
- Switch from %patchN style to the %patch -P N one.