From patchwork Thu Aug 6 12:42:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 94696 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25BB1C55ABF for ; Thu, 6 Aug 2026 12:43:06 +0000 (UTC) Received: from AM0PR02CU008.outbound.protection.outlook.com (AM0PR02CU008.outbound.protection.outlook.com [52.101.72.62]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.18369.1786020176416194687 for ; Thu, 06 Aug 2026 05:42:56 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=TX2G/7vA; spf=pass (domain: est.tech, ip: 52.101.72.62, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ppRKEPaaW+TaMAxwbPX51gzZda4ewrpxhbXX6wKbZUfB/K62f7odP/oBvCcqM9tY0EMj93FbbQkofVBaUGWs8sgyXWm/my78XkZvY+Jpddj5CpXPkaBG5M/x1CJt4opm3TgXO0BNZCwQMf/1A30DjNv+q49ZNOd8fxTRCVFcSNL6QwdGWX8PZ25Uq3nINA4XjwjRwhcG3ji8W/KlC+vOEpHHMY78lV+Cm66FanomFSnJB7caaiVg6NCJ3SlPwgFeXVvrie+Z8UcTuGlX4xezIUl0MJ16eK0wFEGNMtwQczuJiug8ygkgwNut8gxy+2x6Z8s24ruz11efi4+eFOYq4Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ieZTAGvI+hKlFn45pUbBr1r/3H1WvcUCDWT33joRdtc=; b=KW7blgNBYzvQHkfKDEWRHMHmbOtjx461MuOa8ne9UZLTDQYt7/n3AX3OhtC143IlQt/YixjvTYIYmaeA+sSQVAyHUMQcEE2NZpLmRzBaPMpCIiyH3DBYzw3Hv7qz9nsAMJ/wOvudrcfWqf8TZfJkAHFGZxgICwZpLXInC7PBpzPi45BOAkK1uUYF7kcfU0yCm4BMe+El7LA5gfTnGPLf2PmWk78XCBXn6ijOqgtnqnJvFM6u4nfSUJytC91Wi81Ty2T+1Ar67svF0B7+1ZrLPHUd54hitdTVD0KyZlZnp+QYtn8eiUCjvgylfVbh2WqK61KZTiEHJlukI+ti04/Yzw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ieZTAGvI+hKlFn45pUbBr1r/3H1WvcUCDWT33joRdtc=; b=TX2G/7vALhWQn9tY9O3P76HKcfkNThekfu3bBpiVvHwCgQN7KrJFJUOiIJertQQuGSW/uwoBv7nQxYMEBGcoEKbmIGoD6ewmE8tNQ+tiQhufAJPC6lwCUMErshRE2nlBYsgu5kFRINAWhAW5ZuBoaTfQq5qXZG0H1OFLJfPTWKIN33XibF1rnEzK2rl+OR9a37M2x0Y/0Zeag+zgIikcRBiS3yd5onUEEWy+FcvX+Ln2DcWuDCH1a1ktXtJ5KjSrPuS+LgqTj7PQXNRf6/vqI7OWVkYstN8PpK1uS4KEhsx6tPdzMKT2mR2IWiDKv4bOMNbycc4q5SCtK/5OL+dQDA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by PA1P189MB3603.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:500::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.4; Thu, 6 Aug 2026 12:42:51 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0292.013; Thu, 6 Aug 2026 12:42:51 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [PATCH] python3: upgrade 3.14.6 -> 3.14.7 Date: Thu, 6 Aug 2026 14:42:46 +0200 Message-ID: <20260806124246.26004-1-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) X-ClientProxiedBy: LO4P123CA0614.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:314::15) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|PA1P189MB3603:EE_ X-MS-Office365-Filtering-Correlation-Id: 33693af0-dd61-41b1-3c7d-08def3b83a20 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|376014|1800799024|6133799003|56012099006|10067099003|11063799006|5023799004|12006099003|18002099003|3023799007; X-Microsoft-Antispam-Message-Info: RGi2LEvhidr1kxSflRp2RAdhVpbd1+u8qVlGd2tXNjwRRcvYSHnC5PS5MI1Dhrpw/igSJFyluXbjZTSI58cd5DawYFlw+SsEpAtTTNzgMP+espyfTw8SZct+QWKmr1oOWNAHEc+uhQSc2cXy0ts1v/u37cWBIPbOTFSor6TciFdcKiGF9JN/10pdvw6a1nMkFU16d7i7GjLKd/R1UvpLnCr6id7xKfa9E4lNNkhYnDwEwAatKVwqyU7YI0Bcwu9zMfMAxD6xxdAFqpruN1RKqMEVz7R7W+DOtwFHLIPzr3Wn5PtdmMuEw8CVmHBh1qxdQTOxo6Cohs7oE1z0gG7c466V+c28Yz6JlYHM41La3Po+HbDERpaWELQV8QE1KCYkLHopuD3auvph4pmb36M9rGB3mI7iBqI8nrFlw77akONPbDDzm8jaNkj0lmichQ7aGBQrsWI5hIHHFPpusfXMi/TLozmS+oUgOnpk2wUUKh23lr9+BJCqf09diAUPJyZFXICpVX1K7gIfEqMnfvGMv8Yms+GCMUdvVzl+cxCVFOU8KElyXmtuFLp+F8Lc+ZTKs5+uhHX8SCfU7iGYXJ6Qxp37NzDBmXJhWDCAL8dV7wJfGK3VEnjgDqhM6kbneGa+VL8yzW09sUBMFtGkgNZuNREIBcxacAG40rr9IkiaeXs= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(376014)(1800799024)(6133799003)(56012099006)(10067099003)(11063799006)(5023799004)(12006099003)(18002099003)(3023799007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: fR360dBL6eYbkhmhszMFgxcGMbkERQ2k/AVvpyRSnJ8tjRkrqgwf5TsnlbKwt6rR8xM+OdjwbJj9AxXBpgBKJ/xoEzYQjno0sOQLAzq6gI423JvUe4wZCI/HMqnLZhV7cOYF/ltJL+jy4ccbtMUP293Sp2n1rwuatD/wydlclzKcQvSIZmtKgBQkOMxQtX/2qKstUcf3w6U4p9yoKgfF94AyCYPBVeHYWgmZsaC9R8GeV+oThVVKenAasJEmVwp3i2w7cx7j1Aaxw7AG83N+riuzgMzTlbHNq2S+bZZA+DBYXjOt036Zjczh1zvrlzl/YKdL8/6BIWyIa+V9f7IyQ3aDsoTqoyHUF7OvhbCfSUuNs88nBOzHDQhajzixMRVj0nSTanSq7UoaK+y50dsYLIIwW6ZbJPYVCEaGVn0lgrECtc0jEBMeYAbOrwqr0LgUQPRyOs0uePpRN5gVypdARaWjEShbPMiyPFbCkuz7BkR9GEuPU2LJOVBnHHwC0/BZ80Omdg53xBqYAtRjibAt8r0nPHBESyAf7kAl/Q6wPnfMQWXWpga0RiS24CljISc1WtnXwWWEKrxhAKLyxFIUiNVZA+GjCQboteikmM5RnXCRshioOlJjj4VzbZ1Aw4fjt7YOnNjyHOAwIm1yaGvdJgqtzTpCCXjBse1/xqbax4T91TPL1tkE7NpiFxQWZTdWLZGNFXVWJ04x6CK8z7lwjOQ1AQOwYGyy3qkaEUqkPmnEXwUUNM2ZxyxkOAhKCqTg5l47g0d2MbBBTHNDqvPBo+URGRFaKjecd05L/jrul3Uo3O8i/gPygEK8VDyTMGTF8jDNZrQi3z+AWf2SY46QtKz7RERTOLDQY2oA6IlhRIKpzUcfrHzCtonA/Nt4jhOZ2Vzp5ObYbax2ZJhOzKYZgz93dAQpC24QKbFnXT86JSnNyOSWy4RA/tbtUgr0W9zt+goGAQKhKgSaeY/NnHWHC3qP5AwJM+z1CjJ03Ukesqg+Sjza/gmDvVgjjEQ0uu5ewa8SyMMM+Guu2eO4r3kfy1GEGIQGX3cs0FBl+sr8+OHRryiWK6L7138YjL6hW2tuENTojFivaaw+TBEJwEnXf7isGB4Gu9NCGgNDAhXRGJgVgXZznuEK9T32DNLK3uQakHMZ+F9K/T0HYJHSixKzdj2C9bbm6XWGaJdxSK+I1hTgCclnNjsgjIWaj8fSu7K5haodcbU1AbGSvxTgIBd/qOwhkQkEqn5hh2nHHqUkS0nqwo/IRs+vfd/YCaJ3QkSkBrygCbJDIzuu9rOPxMNCktmQi7wbygYgWEn7jUe9gPuZsvlxxFiy2jQovqfxL34qo+1GsK2gymVT8bp1062OkInZ+ye99Hj3tjzWcQxUShzPKRkbgEA52c8Z+4tlugHuAqO5DVwcPuNUJHn61/Gxo+/xM5HNLQawSvCbKnIsRXyko9tAhoJNXVw5wrLF6BDTiMzkXitUaGO8ZRT5Qt3C63fLg6jduTPOqhf/LLH3a1evsHEBp2pgkrymkNslcTeNnwJvb4+O5opLQ9I43wVG5oGGDphUU6qiLVtjvFCGcz6BusghupMyv4VUyPqZPwLHA+pvfW9uyLO6FSn8VSN5M9MPY4u0msgfSZrd1BcuN0vrb12TeTSMAxaKbtVDrIo3+ehOMQfUcH/by39iGDQ7tm0xl8IELunzqXKQfetnRoysLlv57kChi38wooVOyvojWDnj3Hqif5ODnwMA/2KwpeF8aDxCqG55egtyGc8SO84= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 33693af0-dd61-41b1-3c7d-08def3b83a20 X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Aug 2026 12:42:50.9336 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: RjMEZWDNzzXP+luHTg3SZRR1p4N+sWF6ruDUu0LFbKKA2etYl10dic9wUAov5tPqmuKk3+SeMKwnSEvvOhr6kreqczNnBETMTi6GP/v2SG0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1P189MB3603 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 06 Aug 2026 12:43:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242941 Release notes: [1] Resolves following CVEs: * CVE-2026-4360 * CVE-2026-11940 * CVE-2026-11972 Removed patches included in this release. Removed obsolete CVE_STATUS entries. [1] https://docs.python.org/3/whatsnew/changelog.html#python-3-14-7-final Signed-off-by: Jaipaul Cheernam --- ...shebang-overflow-on-python-config.py.patch | 6 +- ...e-stdin-I-O-errors-same-way-as-maste.patch | 4 +- ...-use-prefix-value-from-build-configu.patch | 7 +- ...-qemu-wrapper-when-gathering-profile.patch | 9 +- ...est_sysconfig-for-posix_user-purelib.patch | 4 +- .../0001-prefer-valid-entrypoints.patch | 2 +- ...g.py-use-platlibdir-also-for-purelib.patch | 4 +- ...le.py-correct-the-test-output-format.patch | 6 +- .../python/python3/CVE-2026-11940.patch | 67 -------- .../python/python3/CVE-2026-11972.patch | 61 -------- .../python/python3/CVE-2026-4360.patch | 148 ------------------ .../python/python3/makerace.patch | 6 +- .../python/python3/valid-dists.patch | 2 +- .../{python3_3.14.6.bb => python3_3.14.7.bb} | 10 +- 14 files changed, 26 insertions(+), 310 deletions(-) delete mode 100644 meta/recipes-devtools/python/python3/CVE-2026-11940.patch delete mode 100644 meta/recipes-devtools/python/python3/CVE-2026-11972.patch delete mode 100644 meta/recipes-devtools/python/python3/CVE-2026-4360.patch rename meta/recipes-devtools/python/{python3_3.14.6.bb => python3_3.14.7.bb} (98%) diff --git a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch index c2106f9437..7a60538364 100644 --- a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch +++ b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch @@ -1,4 +1,4 @@ -From 6b111a328c1c57b1580d63894b2b5d337316f6d4 Mon Sep 17 00:00:00 2001 +From 3f2df0e1fce8c7425998dade00d084f1b101a982 Mon Sep 17 00:00:00 2001 From: Paulo Neves Date: Tue, 7 Jun 2022 16:16:41 +0200 Subject: [PATCH] Avoid shebang overflow on python-config.py @@ -16,10 +16,10 @@ Upstream-Status: Denied [distribution] 1 file changed, 2 insertions(+) diff --git a/Makefile.pre.in b/Makefile.pre.in -index 9ec3a71..f7d5382 100644 +index e946018..345ed29 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2829,6 +2829,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh +@@ -2835,6 +2835,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh @ # Substitution happens here, as the completely-expanded BINDIR @ # is not available in configure sed -e "s,@EXENAME@,$(EXENAME)," < $(srcdir)/Misc/python-config.in >python-config.py diff --git a/meta/recipes-devtools/python/python3/0001-Lib-pty.py-handle-stdin-I-O-errors-same-way-as-maste.patch b/meta/recipes-devtools/python/python3/0001-Lib-pty.py-handle-stdin-I-O-errors-same-way-as-maste.patch index d9072a36f7..532adfe69a 100644 --- a/meta/recipes-devtools/python/python3/0001-Lib-pty.py-handle-stdin-I-O-errors-same-way-as-maste.patch +++ b/meta/recipes-devtools/python/python3/0001-Lib-pty.py-handle-stdin-I-O-errors-same-way-as-maste.patch @@ -1,4 +1,4 @@ -From 129ee75863081d9e3418acca3df1e47667f671ad Mon Sep 17 00:00:00 2001 +From 9cd44429215352eb2753e0fd8e25fef24f714006 Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Thu, 16 Sep 2021 16:35:37 +0200 Subject: [PATCH] Lib/pty.py: handle stdin I/O errors same way as master I/O @@ -29,7 +29,7 @@ Signed-off-by: Alexander Kanavin 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Lib/pty.py b/Lib/pty.py -index 1d97994..fa8821b 100644 +index 4b25ac3..d6aac07 100644 --- a/Lib/pty.py +++ b/Lib/pty.py @@ -149,7 +149,10 @@ def _copy(master_fd, master_read=_read, stdin_read=_read): diff --git a/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch b/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch index 285580195b..60391e726b 100644 --- a/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch +++ b/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch @@ -1,4 +1,4 @@ -From e3c6e770e73e1329958db0a73883e42b01763ae3 Mon Sep 17 00:00:00 2001 +From b5aad6a9b6c5add7a85861aed8aa030c1ad3d52f Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Fri, 17 Nov 2023 14:26:32 +0100 Subject: [PATCH] Lib/sysconfig.py: use prefix value from build configuration @@ -18,7 +18,7 @@ Signed-off-by: Trevor Gamblin 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Lib/sysconfig/__init__.py b/Lib/sysconfig/__init__.py -index 2ecbff222fe..cec54cb23dc 100644 +index 0a8bcc0..a2341f2 100644 --- a/Lib/sysconfig/__init__.py +++ b/Lib/sysconfig/__init__.py @@ -538,12 +538,12 @@ def _init_config_vars(): @@ -39,6 +39,3 @@ index 2ecbff222fe..cec54cb23dc 100644 _CONFIG_VARS['implementation'] = _get_implementation() _CONFIG_VARS['implementation_lower'] = _get_implementation().lower() _CONFIG_VARS['abiflags'] = abiflags --- -2.51.0 - diff --git a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch index e25797f57e..c7f14cad1e 100644 --- a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch +++ b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch @@ -1,4 +1,4 @@ -From e7a8a7385f561f214054cf95f0a22bfa064eee0b Mon Sep 17 00:00:00 2001 +From d6f77e3a934616d1f6c083b7144c50a32e08b70a Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Wed, 30 Jan 2019 12:41:04 +0100 Subject: [PATCH] Makefile.pre: use qemu wrapper when gathering profile data @@ -15,10 +15,10 @@ Signed-off-by: Trevor Gamblin 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Makefile.pre.in b/Makefile.pre.in -index 3bd4495f95b..8e8fc60bc76 100644 +index 526d500..a7e536d 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -857,8 +857,7 @@ profile-run-stamp: +@@ -861,8 +861,7 @@ profile-run-stamp: # enabled. $(MAKE) profile-gen-stamp # Next, run the profile task to generate the profile information. @@ -28,6 +28,3 @@ index 3bd4495f95b..8e8fc60bc76 100644 $(LLVM_PROF_MERGER) # Remove profile generation binary since we are done with it. $(MAKE) clean-retain-profile --- -2.39.5 - diff --git a/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch b/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch index 6a62c6dc5b..5509b7475a 100644 --- a/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch +++ b/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch @@ -1,4 +1,4 @@ -From 5bf5aa6eae1fa3eed66893e51a1858ab481426b4 Mon Sep 17 00:00:00 2001 +From c608cb4b3c8c31f1aa25ad1264ff58733fb99769 Mon Sep 17 00:00:00 2001 From: Wentao Zhang Date: Mon, 20 Mar 2023 13:39:52 +0800 Subject: [PATCH] Update test_sysconfig for posix_user purelib @@ -22,7 +22,7 @@ Signed-off-by: Wentao Zhang 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py -index 1ade492..4e94889 100644 +index 1fe4b68..383142a 100644 --- a/Lib/test/test_sysconfig.py +++ b/Lib/test/test_sysconfig.py @@ -434,7 +434,7 @@ class TestSysConfig(unittest.TestCase, VirtualEnvironmentMixin): diff --git a/meta/recipes-devtools/python/python3/0001-prefer-valid-entrypoints.patch b/meta/recipes-devtools/python/python3/0001-prefer-valid-entrypoints.patch index 1250dc9ff0..ae3698fac4 100644 --- a/meta/recipes-devtools/python/python3/0001-prefer-valid-entrypoints.patch +++ b/meta/recipes-devtools/python/python3/0001-prefer-valid-entrypoints.patch @@ -1,4 +1,4 @@ -From ef33ac27e3ac1b9cb159d7eec0ad1af120cd9dc1 Mon Sep 17 00:00:00 2001 +From 8d7fcf04c6513841c7985e64b746b1ef5de0c426 Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Fri, 17 Apr 2026 16:53:42 +0100 Subject: [PATCH] prefer valid entrypoints diff --git a/meta/recipes-devtools/python/python3/0001-sysconfig.py-use-platlibdir-also-for-purelib.patch b/meta/recipes-devtools/python/python3/0001-sysconfig.py-use-platlibdir-also-for-purelib.patch index b9c68a98d7..7807827d9a 100644 --- a/meta/recipes-devtools/python/python3/0001-sysconfig.py-use-platlibdir-also-for-purelib.patch +++ b/meta/recipes-devtools/python/python3/0001-sysconfig.py-use-platlibdir-also-for-purelib.patch @@ -1,4 +1,4 @@ -From bbcb17dc1ed283f41c8cd94d39f70898f0c45583 Mon Sep 17 00:00:00 2001 +From c10d1b295a9fb93836830cce441da3f22e5c7cd7 Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Sun, 12 Sep 2021 21:44:36 +0200 Subject: [PATCH] sysconfig.py: use platlibdir also for purelib @@ -13,7 +13,7 @@ Signed-off-by: Alexander Kanavin 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Lib/sysconfig/__init__.py b/Lib/sysconfig/__init__.py -index 80aef34..f8e1c7d 100644 +index faf8273..0a8bcc0 100644 --- a/Lib/sysconfig/__init__.py +++ b/Lib/sysconfig/__init__.py @@ -29,7 +29,7 @@ _INSTALL_SCHEMES = { diff --git a/meta/recipes-devtools/python/python3/0001-test_locale.py-correct-the-test-output-format.patch b/meta/recipes-devtools/python/python3/0001-test_locale.py-correct-the-test-output-format.patch index 201271b0c0..a60d082e2f 100644 --- a/meta/recipes-devtools/python/python3/0001-test_locale.py-correct-the-test-output-format.patch +++ b/meta/recipes-devtools/python/python3/0001-test_locale.py-correct-the-test-output-format.patch @@ -1,4 +1,4 @@ -From c1f3cf625c0f011060ddaa2a4096f6aa13dd1ee6 Mon Sep 17 00:00:00 2001 +From f0ac5b479b99bfb7f5e937a941b31a596f4caafc Mon Sep 17 00:00:00 2001 From: Mingli Yu Date: Mon, 5 Aug 2019 15:57:39 +0800 Subject: [PATCH] test_locale.py: correct the test output format @@ -31,10 +31,10 @@ Signed-off-by: Mingli Yu 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Lib/test/test_locale.py b/Lib/test/test_locale.py -index da4bd79..fd9e67d 100644 +index f918435..1910a43 100644 --- a/Lib/test/test_locale.py +++ b/Lib/test/test_locale.py -@@ -500,7 +500,7 @@ class TestRealLocales(unittest.TestCase): +@@ -499,7 +499,7 @@ class TestRealLocales(unittest.TestCase): self.skipTest('test needs Turkish locale') loc = locale.getlocale(locale.LC_CTYPE) if verbose: diff --git a/meta/recipes-devtools/python/python3/CVE-2026-11940.patch b/meta/recipes-devtools/python/python3/CVE-2026-11940.patch deleted file mode 100644 index 05a5802c39..0000000000 --- a/meta/recipes-devtools/python/python3/CVE-2026-11940.patch +++ /dev/null @@ -1,67 +0,0 @@ -From e24b4e95524fbe8cd0f46aa3292e8040f0e07c83 Mon Sep 17 00:00:00 2001 -From: "Miss Islington (bot)" - <31488909+miss-islington@users.noreply.github.com> -Date: Tue, 23 Jun 2026 15:58:47 +0200 -Subject: [PATCH 1/2] gh-151558: Fix symlink escape via `tarfile` - hardlink-extraction fallback (GH-151559) - -CVE: CVE-2026-11940 -Upstream-Status: Backport [https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f] - -Signed-off-by: Benjamin Robin ---- - Lib/tarfile.py | 3 +++ - Lib/test/test_tarfile.py | 24 ++++++++++++++++++++++++ - 2 files changed, 27 insertions(+) - -diff --git a/Lib/tarfile.py b/Lib/tarfile.py -index e6734db24f64..63f23490e8a1 100644 ---- a/Lib/tarfile.py -+++ b/Lib/tarfile.py -@@ -2782,6 +2782,9 @@ def makelink_with_filter(self, tarinfo, targetpath, - "makelink_with_filter: if filter_function is not None, " - + "extraction_root must also not be None") - try: -+ filter_function( -+ unfiltered.replace(name=tarinfo.name, deep=False), -+ extraction_root) - filtered = filter_function(unfiltered, extraction_root) - except _FILTER_ERRORS as cause: - raise LinkFallbackError(tarinfo, unfiltered.name) from cause -diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py -index d974c7d46ec1..0fc7413be8db 100644 ---- a/Lib/test/test_tarfile.py -+++ b/Lib/test/test_tarfile.py -@@ -4344,6 +4344,30 @@ def test_sneaky_hardlink_fallback(self): - self.expect_file("boom", symlink_to='../../link_here') - self.expect_file("c", symlink_to='b') - -+ @symlink_test -+ def test_sneaky_hardlink_fallback_deep(self): -+ # (CVE-2026-11940) -+ with ArchiveMaker() as arc: -+ arc.add("a/b/s", symlink_to=os.path.join("..", "escape")) -+ arc.add("s", hardlink_to=os.path.join("a", "b", "s")) -+ -+ with self.check_context(arc.open(), 'data'): -+ e = self.expect_exception( -+ tarfile.LinkFallbackError, -+ "link 's' would be extracted as a copy of " -+ + "'a/b/s', which was rejected") -+ self.assertIsInstance(e.__cause__, -+ tarfile.LinkOutsideDestinationError) -+ -+ for filter in 'tar', 'fully_trusted': -+ with self.subTest(filter), self.check_context(arc.open(), filter): -+ if not os_helper.can_symlink(): -+ self.expect_file("a/") -+ self.expect_file("a/b/") -+ else: -+ self.expect_file("a/b/s", symlink_to=os.path.join('..', 'escape')) -+ self.expect_file("s", symlink_to=os.path.join('..', 'escape')) -+ - @symlink_test - def test_exfiltration_via_symlink(self): - # (CVE-2025-4138) --- -2.54.0 diff --git a/meta/recipes-devtools/python/python3/CVE-2026-11972.patch b/meta/recipes-devtools/python/python3/CVE-2026-11972.patch deleted file mode 100644 index 12a79754fe..0000000000 --- a/meta/recipes-devtools/python/python3/CVE-2026-11972.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 2d256d4bfd654bdcaf2d96733799be73b8ff8f69 Mon Sep 17 00:00:00 2001 -From: Petr Viktorin -Date: Tue, 23 Jun 2026 15:13:30 +0200 -Subject: [PATCH 2/2] gh-151981: Make tarfile._Stream.seek break at EOF - (GH-151982) - -Co-authored-by: Stan Ulbrych - -CVE: CVE-2026-11972 -Upstream-Status: Backport [https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896] - -Signed-off-by: Benjamin Robin ---- - Lib/tarfile.py | 4 +++- - Lib/test/test_tarfile.py | 16 ++++++++++++++++ - 2 files changed, 19 insertions(+), 1 deletion(-) - -diff --git a/Lib/tarfile.py b/Lib/tarfile.py -index 63f23490e8a1..399f906efdff 100644 ---- a/Lib/tarfile.py -+++ b/Lib/tarfile.py -@@ -524,7 +524,9 @@ def seek(self, pos=0): - if pos - self.pos >= 0: - blocks, remainder = divmod(pos - self.pos, self.bufsize) - for i in range(blocks): -- self.read(self.bufsize) -+ data = self.read(self.bufsize) -+ if not data: -+ break - self.read(remainder) - else: - raise StreamError("seeking backwards is not allowed") -diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py -index 0fc7413be8db..045377d620cc 100644 ---- a/Lib/test/test_tarfile.py -+++ b/Lib/test/test_tarfile.py -@@ -4786,6 +4786,22 @@ def valueerror_filter(tarinfo, path): - with self.check_context(arc.open(errorlevel='boo!'), filtererror_filter): - self.expect_exception(TypeError) # errorlevel is not int - -+ @support.subTests('format', [tarfile.GNU_FORMAT, tarfile.PAX_FORMAT]) -+ def test_getmembers_big_size(self, format): -+ # gh-151981: A loop in seek() for streaming files tried to read the -+ # declared number of blocks even at EOF -+ tinfo = tarfile.TarInfo("huge-file") -+ tinfo.size = 1 << 64 -+ bio = io.BytesIO() -+ # Write header without data -+ bio.write(tinfo.tobuf(format)) -+ -+ # Reset & try to get contents -+ bio.seek(0) -+ with tarfile.open(fileobj=bio, mode="r|") as tar: -+ with self.assertRaises(tarfile.ReadError): -+ tar.getmembers() -+ - - class OverwriteTests(archiver_tests.OverwriteTests, unittest.TestCase): - testdir = os.path.join(TEMPDIR, "testoverwrite") --- -2.54.0 diff --git a/meta/recipes-devtools/python/python3/CVE-2026-4360.patch b/meta/recipes-devtools/python/python3/CVE-2026-4360.patch deleted file mode 100644 index d381508959..0000000000 --- a/meta/recipes-devtools/python/python3/CVE-2026-4360.patch +++ /dev/null @@ -1,148 +0,0 @@ -From 66c8bc346c0c614edc05535145c0424a14fba213 Mon Sep 17 00:00:00 2001 -From: "Miss Islington (bot)" - <31488909+miss-islington@users.noreply.github.com> -Date: Mon, 29 Jun 2026 21:11:22 +0200 -Subject: [PATCH] gh-151987: Pass filter_function to `TarFile._extract_one()` - during `.extract()` (GH-151988) (#152609) - -(cherry picked from commit 7ccdbaba2c54250a70d7f25632152df7655a5e0a) - -Co-authored-by: Petr Viktorin -Co-authored-by: Seth Michael Larson - -CVE: CVE-2026-4360 -Upstream-Status: Backport [https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0] - -Signed-off-by: Leonid Iziumtsev ---- - Lib/tarfile.py | 3 +- - Lib/test/test_tarfile.py | 92 +++++++++++++++++++ - ...-06-23-14-19-30.gh-issue-151987.8mNIMf.rst | 2 + - 3 files changed, 96 insertions(+), 1 deletion(-) - create mode 100644 Misc/NEWS.d/next/Security/2026-06-23-14-19-30.gh-issue-151987.8mNIMf.rst - -diff --git a/Lib/tarfile.py b/Lib/tarfile.py -index e6734db..2c46179 100644 ---- a/Lib/tarfile.py -+++ b/Lib/tarfile.py -@@ -2510,7 +2510,8 @@ class TarFile(object): - tarinfo, unfiltered = self._get_extract_tarinfo( - member, filter_function, path) - if tarinfo is not None: -- self._extract_one(tarinfo, path, set_attrs, numeric_owner) -+ self._extract_one(tarinfo, path, set_attrs, numeric_owner, -+ filter_function=filter_function) - - def _get_extract_tarinfo(self, member, filter_function, path): - """Get (filtered, unfiltered) TarInfos from *member* -diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py -index d974c7d..9a15585 100644 ---- a/Lib/test/test_tarfile.py -+++ b/Lib/test/test_tarfile.py -@@ -4399,6 +4399,98 @@ class TestExtractionFilters(unittest.TestCase): - st_mode = cc.outerdir.stat().st_mode - self.assertNotEqual(st_mode & 0o777, 0o777) - -+ @symlink_test -+ @unittest.skipUnless(hasattr(os, 'chown'), "missing os.chown") -+ @unittest.skipUnless(hasattr(os, 'lchown'), "missing os.lchown") -+ @unittest.skipUnless(hasattr(os, 'geteuid'), "missing os.geteuid") -+ @support.subTests('link_type', (tarfile.SYMTYPE, tarfile.LNKTYPE)) -+ def test_chown_links_on_extract(self, link_type): -+ with ArchiveMaker() as arc: -+ arc.add("test.txt", -+ uid=1337, gid=1337, uname="", gname="", mode='-rwxr-xr-x') -+ arc.add("link", -+ type=link_type, -+ linkname='test.txt', -+ uid=1337, gid=1337, uname="", gname="", mode='-rwxr-xr-x') -+ -+ with ( -+ os_helper.temp_dir() as tmpdir, -+ arc.open() as tar, -+ unittest.mock.patch("os.chown") as mock_chown, -+ unittest.mock.patch("os.lchown") as mock_lchown, -+ unittest.mock.patch("os.geteuid") as mock_geteuid, -+ ): -+ # Set UID to 0 so chown() is attempted. -+ mock_geteuid.return_value = 0 -+ tar.extract("link", path=tmpdir, filter='data') -+ extract_path = os.path.join(tmpdir, "link") -+ -+ if link_type == tarfile.SYMTYPE: -+ mock_chown.assert_not_called() -+ mock_lchown.assert_called_once_with(extract_path, -1, -1) -+ else: -+ mock_chown.assert_has_calls([ -+ unittest.mock.call(extract_path, -1, -1), -+ unittest.mock.call(extract_path, -1, -1) -+ ]) -+ mock_lchown.assert_not_called() -+ -+ @symlink_test -+ @unittest.skipUnless(hasattr(os, 'chown'), "missing os.chown") -+ @unittest.skipUnless(hasattr(os, 'lchown'), "missing os.lchown") -+ @unittest.skipUnless(hasattr(os, 'geteuid'), "missing os.geteuid") -+ @support.subTests('link_type', (tarfile.SYMTYPE, tarfile.LNKTYPE)) -+ def test_chown_links_on_extractall(self, link_type): -+ with ArchiveMaker() as arc: -+ arc.add("test.txt", -+ uid=1337, gid=1337, uname="", gname="", mode='-rwxr-xr-x') -+ arc.add("link", -+ type=link_type, -+ linkname='test.txt', -+ uid=1337, gid=1337, uname="", gname="", mode='-rwxr-xr-x') -+ -+ with ( -+ os_helper.temp_dir() as tmpdir, -+ arc.open() as tar, -+ unittest.mock.patch("os.chown") as mock_chown, -+ unittest.mock.patch("os.lchown") as mock_lchown, -+ unittest.mock.patch("os.geteuid") as mock_geteuid, -+ ): -+ # Set UID to 0 so chown() is attempted. -+ mock_geteuid.return_value = 0 -+ tar.extractall(path=tmpdir, filter='data') -+ extract_link_path = os.path.join(tmpdir, "link") -+ extract_file_path = os.path.join(tmpdir, "test.txt") -+ -+ if link_type == tarfile.SYMTYPE: -+ mock_chown.assert_called_once_with(extract_file_path, -1, -1) -+ mock_lchown.assert_called_once_with(extract_link_path, -1, -1) -+ else: -+ mock_chown.assert_has_calls([ -+ unittest.mock.call(extract_file_path, -1, -1), -+ unittest.mock.call(extract_link_path, -1, -1) -+ ]) -+ mock_lchown.assert_not_called() -+ -+ def test_extract_filters_target(self): -+ # Test that when extract() falls back to extracting (rather than -+ # linking) a hardlink target, it filters the target. -+ with ArchiveMaker() as arc: -+ arc.add("target") -+ arc.add("link", hardlink_to="target") -+ def testing_filter(member, path): -+ if member.name == 'target': -+ # target: set read-only -+ return member.replace(mode=stat.S_IRUSR) -+ # link: don't overwrite the mode -+ return member.replace(mode=None) -+ tempdir = pathlib.Path(TEMPDIR) / 'extract' -+ with os_helper.temp_dir(tempdir), arc.open() as tar: -+ tar.extract("link", path=tempdir, filter=testing_filter) -+ path = tempdir / 'link' -+ if os_helper.can_chmod(): -+ self.assertFalse(path.stat().st_mode & stat.S_IWUSR) -+ - def test_link_fallback_normalizes(self): - # Make sure hardlink fallbacks work for non-normalized paths for all - # filters -diff --git a/Misc/NEWS.d/next/Security/2026-06-23-14-19-30.gh-issue-151987.8mNIMf.rst b/Misc/NEWS.d/next/Security/2026-06-23-14-19-30.gh-issue-151987.8mNIMf.rst -new file mode 100644 -index 0000000..9eea7b3 ---- /dev/null -+++ b/Misc/NEWS.d/next/Security/2026-06-23-14-19-30.gh-issue-151987.8mNIMf.rst -@@ -0,0 +1,2 @@ -+The :meth:`tarfile.TarFile.extract` method now applies the given filter when -+it extracts a link target from the archive as a fallback. diff --git a/meta/recipes-devtools/python/python3/makerace.patch b/meta/recipes-devtools/python/python3/makerace.patch index b29ea56cc3..248a521118 100644 --- a/meta/recipes-devtools/python/python3/makerace.patch +++ b/meta/recipes-devtools/python/python3/makerace.patch @@ -1,4 +1,4 @@ -From 2b458b4e1bcd57e3f135d3f0e715f64b98b27906 Mon Sep 17 00:00:00 2001 +From b41557f570ff4451c477669d6ca5bfacabe21c66 Mon Sep 17 00:00:00 2001 From: Richard Purdie Date: Tue, 13 Jul 2021 23:19:29 +0100 Subject: [PATCH] python3: Fix make race @@ -17,10 +17,10 @@ Signed-off-by: Richard Purdie 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile.pre.in b/Makefile.pre.in -index be1b9ea..9ec3a71 100644 +index a7e536d..e946018 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2735,7 +2735,7 @@ COMPILEALL_OPTS=-j0 +@@ -2741,7 +2741,7 @@ COMPILEALL_OPTS=-j0 TEST_MODULES=@TEST_MODULES@ .PHONY: libinstall diff --git a/meta/recipes-devtools/python/python3/valid-dists.patch b/meta/recipes-devtools/python/python3/valid-dists.patch index 38b6ebc5cb..7fe18254e5 100644 --- a/meta/recipes-devtools/python/python3/valid-dists.patch +++ b/meta/recipes-devtools/python/python3/valid-dists.patch @@ -1,4 +1,4 @@ -From a65c29adc027b3615154cab73aaedd58a6aa23da Mon Sep 17 00:00:00 2001 +From 66874ce1a9f21b4b00dc85919734d58e6243ca29 Mon Sep 17 00:00:00 2001 From: "Jason R. Coombs" Date: Tue, 23 Jul 2024 08:36:16 -0400 Subject: [PATCH] Prioritize valid dists to invalid dists when retrieving by diff --git a/meta/recipes-devtools/python/python3_3.14.6.bb b/meta/recipes-devtools/python/python3_3.14.7.bb similarity index 98% rename from meta/recipes-devtools/python/python3_3.14.6.bb rename to meta/recipes-devtools/python/python3_3.14.7.bb index 77333ce3e2..7c0bd41337 100644 --- a/meta/recipes-devtools/python/python3_3.14.6.bb +++ b/meta/recipes-devtools/python/python3_3.14.7.bb @@ -22,15 +22,12 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ file://0001-Avoid-shebang-overflow-on-python-config.py.patch \ file://0001-Update-test_sysconfig-for-posix_user-purelib.patch \ file://0001-prefer-valid-entrypoints.patch \ - file://CVE-2026-11940.patch \ - file://CVE-2026-11972.patch \ - file://CVE-2026-4360.patch \ " SRC_URI:append:class-native = " \ file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \ " -SRC_URI[sha256sum] = "143b1dddefaec3bd2e21e3b839b34a2b7fb9842272883c576420d605e9f30c63" +SRC_URI[sha256sum] = "3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81" # exclude pre-releases for both python 2.x and 3.x UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P\d+(\.\d+)+).tar" @@ -589,5 +586,6 @@ py3_sysroot_cleanup () { rm -rf ${SYSROOT_DESTDIR}${libdir}/python${PYTHON_MAJMIN}/test } -CVE_STATUS[CVE-2026-6019] = "cpe-stable-backport: backported to v3.14.5" -CVE_STATUS[CVE-2026-7210] = "cpe-stable-backport: backported to v3.14.6" +CVE_STATUS[CVE-2026-4360] = "cpe-stable-backport: fixed in v3.14.7" +CVE_STATUS[CVE-2026-11940] = "cpe-stable-backport: fixed in v3.14.7" +CVE_STATUS[CVE-2026-11972] = "cpe-stable-backport: fixed in v3.14.7"