diff mbox series

[wrynose,3/7] python3: upgrade 3.14.7 -> 3.14.8

Message ID 20261020082611.3115623-4-daniel.turull@ericsson.com
State Awaiting Upstream
Delegated to: Yoann Congal
Headers show
Series stable updates for wrynose | expand

Commit Message

Daniel Turull Oct. 20, 2026, 8:26 a.m. UTC 
From: Daniel Turull <daniel.turull@ericsson.com>

Security fixes in 3.14.8:
- CVE-2026-19445: crash in ssl when sni_callback switches SSLContext
  and the original context is no longer referenced
- CVE-2026-15806: scope HTTPPasswordMgr credentials to the URL scheme
  so HTTPS credentials aren't reused for a matching HTTP URL
- asyncio/ssl: validate server_hostname when check_hostname is set,
  for start_tls(), create_connection() and SSLContext.wrap_bio()
- zipfile: bound decompressed data per read for bzip2/LZMA/Zstandard
  members, matching the existing deflate limit
- tarfile: fix extraction filters creating directories outside the
  destination for names that leave and re-enter it
- Bundle libexpat 2.8.5

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 .../python/{python3_3.14.7.bb => python3_3.14.8.bb}             | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (99%)

Comments

Yoann Congal Oct. 20, 2026, 9:43 a.m. UTC | #1 
On Tue Oct 20, 2026 at 10:26 AM CEST, Daniel Turull via lists.openembedded.org wrote:
> From: Daniel Turull <daniel.turull@ericsson.com>
>
> Security fixes in 3.14.8:
> - CVE-2026-19445: crash in ssl when sni_callback switches SSLContext
>   and the original context is no longer referenced
> - CVE-2026-15806: scope HTTPPasswordMgr credentials to the URL scheme
>   so HTTPS credentials aren't reused for a matching HTTP URL
> - asyncio/ssl: validate server_hostname when check_hostname is set,
>   for start_tls(), create_connection() and SSLContext.wrap_bio()
> - zipfile: bound decompressed data per read for bzip2/LZMA/Zstandard
>   members, matching the existing deflate limit
> - tarfile: fix extraction filters creating directories outside the
>   destination for names that leave and re-enter it
> - Bundle libexpat 2.8.5
>
> Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> ---
>  .../python/{python3_3.14.7.bb => python3_3.14.8.bb}             | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>  rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (99%)

That would put wrynose ahead of master.
I'll hold this one until master/blacksail are upgraded.

Regards,
diff mbox series

Patch

diff --git a/meta/recipes-devtools/python/python3_3.14.7.bb b/meta/recipes-devtools/python/python3_3.14.8.bb
similarity index 99%
rename from meta/recipes-devtools/python/python3_3.14.7.bb
rename to meta/recipes-devtools/python/python3_3.14.8.bb
index e73dc8d772..99152fcb2b 100644
--- a/meta/recipes-devtools/python/python3_3.14.7.bb
+++ b/meta/recipes-devtools/python/python3_3.14.8.bb
@@ -40,7 +40,7 @@  SRC_URI:append:class-native = " \
            file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
            "
 
-SRC_URI[sha256sum] = "3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81"
+SRC_URI[sha256sum] = "c2215904f02b175596dc49351585104f4bc20341e1c47378b26a2c274360ce73"
 
 # exclude pre-releases for both python 2.x and 3.x
 UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"