This update for python311 fixes the following issues:
- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free
(bsc#1283969).
- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses
(bsc#1283826).
- CV
This update for python311 fixes the following issues:
- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).
This update for python311 fixes the following issues:
- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another
scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside
Unicode 3.2.0 (bsc#1276226).
Changes for python311:
- Updated to version 3.11.16
This update for python311 fixes the following issues:
Security issues fixed:
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
`configparser` module is used (bsc#1269066).
- CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted
Unicode input (bsc#1267581).
- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting
hardlinks (bsc#1269959).
- CVE-2026-4786: Incomplete mitigatio
This update for python311 fixes the following issues:
- CVE-2026-1299: header injection when an email is serialized due to improper newline quoting (bsc#1257181).
- CVE-2026-2297: validation bypass via incorrectly handled hook in FileLoader (bsc#1259240).
This update for python311 fixes the following issues:
Updated to Python 3.11.15:
- CVE-2025-6075: quadratic complexity in os.path.expandvars() (bsc#1252974).
- CVE-2025-11468: header injection with carefully crafted inputs (bsc#1257029).
- CVE-2025-12084: quadratic complexity in xml.minidom node ID cache clearing (bsc#1254997).
- CVE-2025-13836: potential memory denial of service in the http.client module (bsc#1254400).
- CVE-2025-13837: potential memory denial of service in the plistlib module (bsc#1254401).
- CVE-2025-15282: control characters in URL media types data (bsc#1257046).
- CVE-2026-0672: control characters in http.cookies.Mor
This update for python311 fixes the following issues:
- CVE-2025-11468: preserving parens when folding comments in email headers. (bsc#1257029)
- CVE-2026-0672: rejects control characters in http cookies. (bsc#1257031)
- CVE-2026-0865: rejecting control characters in wsgiref.headers.Headers, which could be abused for injecting false HTTP headers. (bsc#1257042)
- CVE-2025-15366: basically the same as the previous patch for IMAP protocol. (bsc#1257044)
- CVE-2025-15282: basically the same as the previous patch for urllib library. (bsc#1257046)
- CVE-2025-15367: basically the same as the previous patch for poplib library. (bsc#1257041)
- CVE-20
This update for python311 fixes the following issues:
- CVE-2025-12084: cpython: Fixed quadratic algorithm in xml.dom.minidom leading to denial of service (bsc#1254997)
- CVE-2025-13836: Fixed default Content-Lenght read amount from HTTP response (bsc#1254400)
- CVE-2025-13837: Fixed plistlib module denial of service (bsc#1254401)
This update for python311 fixes the following issues:
Update to 3.11.14:
- CVE-2025-8291: Fixed validity of the ZIP64 End of Central Directory (EOCD) is not checked by the 'zipfile'
module (bsc#1251305).
- CVE-2025-6075: Fixed the value passed to os.path.expandvars() is user-controlled a performance degradation
is possible when expanding environment variables (bsc#1252974).
This update for python311 fixes the following issues:
- CVE-2025-8194: Fixed infinite loop and deadlock caused by tar
archives with negative offsets (bsc#1247249)
This update for python311 fixes the following issues:
- CVE-2025-6069: Avoid worst case quadratic complexity when processing
certain crafted malformed inputs with HTMLParser (bsc#1244705).
Update to 3.11.13:
- Security
- gh-135034: Fixes multiple issues that allowed tarfile
extraction filters (filter="data" and filter="tar")
to be bypassed using crafted symlinks and hard links.
Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
(bsc#1244059), CVE-2025-4330 (bsc#1244060), and
CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
(gh#135034, bsc#1244061).
- gh-133767: Fix use-after-free
This update for python311 fixes the following issues:
- Updated to 3.11.12:
- gh-131809: Updated bundled libexpat to 2.7.1
- gh-131261: Upgraded to libexpat 2.7.0
- CVE-2025-0938: Fixed functions `urllib.parse.urlsplit` and `urlparse`
accepting domain names including square brackets (bsc#1236705)
- gh-121284: Fixed bug in the folding of rfc2047 encoded-words
when flattening an email message using a modern email
policy. Previously when an encoded-word was too long for
a line, it would be decoded, split across lines, and
re-encoded. But commas and other special characters in the
original text could be left unen
This update for python311 fixes the following issues:
- Skip PGO with %want_reproducible_builds (bsc#1239210)
- CVE-2025-0938: Disallows square brackets ([ and ]) in domain names for parsed
URLs (bsc#1236705).
- Configure externally_managed with a bcond (bsc#1228165).
- Update to 3.11.11:
- Tools/Demos
- gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
- Tests
- gh-125041: Re-enable skipped tests for zlib on the
s390x architecture: only skip checks of the compressed
bytes, which can be different between zlib’s software
implementation and th
This update for python311 fixes the following issues:
- CVE-2024-8088: Fixed a denial of service in zipfile (bsc#1229704)
- CVE-2024-6232: Fixed a ReDos via excessive backtracking while parsing header values (bsc#1230227)
- CVE-2024-7592: Fixed a denial of service in the http.cookies module (bsc#1229596)
This update for python311, python-rpm-macros fixes the following issues:
python311:
- CVE-2024-0450: Fixed zipfile module vulnerability with "quoted-overlap" zipbomb (bsc#1221854)
- CVE-2024-4032: Fixed incorrect IPv4 and IPv6 private ranges (bsc#1226448)
- CVE-2024-0397: Fixed memory race condition in ssl.SSLContext certificate store methods (bsc#1226447)
- CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
- Fixed executable bits for /usr/bin/idle* (bsc#1227378).
python-rpm-macros:
- Update to version 20240618.c146b29:
* Add %FLAVOR_pytest and %FLAVOR_pyunittest variants
- Update to v