mbox series

[Internal,Review,wrynose,0/3] python3: upgrade to 3.14.8 and backport security fixes

Message ID 20261016053944.3835603-1-dkelaiya@cisco.com
Headers show
Series python3: upgrade to 3.14.8 and backport security fixes | expand

Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 16, 2026, 5:39 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Upgrade Python 3.14.7 to 3.14.8 on Wrynose and backport fixes for
CVE-2025-15367 and CVE-2026-87910.

The 3.14.8 release addresses CVE-2026-19445, CVE-2026-19553,
CVE-2026-19672, CVE-2026-15310, CVE-2026-15806 and CVE-2026-17084.
The new test_append_limited_history ptest fails with the default
libedit backend on musl. Patch 1 skips only that test on musl while
the libedit interaction remains unresolved.

Patch 2 rejects control characters in POP3 commands to prevent command
injection. This changes behavior for clients whose passwords contain
those characters: they must replace the credentials and handle the new
ValueError as a credential error.

Patch 3 fixes tarfile extraction so a filter rejecting a link fallback
is honored. It also includes the upstream Windows test correction.

Darsh Kelaiya (2):
  python3: fix CVE-2025-15367
  python3: fix CVE-2026-87910

Vijay Anusuri (1):
  python3: upgrade 3.14.7 -> 3.14.8

 .../python/python3/CVE-2025-15367.patch       | 66 +++++++++++++
 .../python/python3/CVE-2026-87910_p1.patch    | 98 +++++++++++++++++++
 .../python/python3/CVE-2026-87910_p2.patch    | 55 +++++++++++
 .../{python3_3.14.7.bb => python3_3.14.8.bb}  |  8 +-
 4 files changed, 226 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-15367.patch
 create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-87910_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-87910_p2.patch
 rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (98%)

Comments

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 16, 2026, 5:54 a.m. UTC | #1 
Hi all,

The [Internal Review] prefix in the cover-letter subject was
included by mistake. This series is intended for review and
inclusion in Wrynose.

Sorry for the confusion.

Regards,
Darsh