소스 검색

package/python3: security bump to v3.12.11

This fixes the following CVEs affecting tarfile extraction filters:

- CVE-2024-12718:
    Bypass extraction filter to modify file metadata outside
    extraction directory

- CVE-2025-4138:
    Bypassing extraction filter to create symlinks to arbitrary targets
    outside extraction directory

- CVE-2025-4330:
    Extraction filter bypass for linking outside extraction directory

- CVE-2025-4435:
    Tarfile extracts filtered members when errorlevel=0

- CVE-2025-4517:
    Arbitrary writes via tarfile realpath overflow

See https://www.python.org/downloads/release/python-31211/

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Titouan Christophe 1 개월 전
부모
커밋
5c96f8d7f8
2개의 변경된 파일4개의 추가작업 그리고 4개의 파일을 삭제
  1. 3 3
      package/python3/python3.hash
  2. 1 1
      package/python3/python3.mk

+ 3 - 3
package/python3/python3.hash

@@ -1,5 +1,5 @@
-# From https://www.python.org/downloads/release/python-31210/
-md5  0c0a6cce86d7611aed691d61e0599de0  Python-3.12.10.tar.xz
+# From https://www.python.org/downloads/release/python-31211/
+md5  9613d56b90d0d0cfd19980c7e2956a06  Python-3.12.11.tar.xz
 # Locally computed
-sha256  07ab697474595e06f06647417d3c7fa97ded07afc1a7e4454c5639919b46eaea  Python-3.12.10.tar.xz
+sha256  c30bb24b7f1e9a19b11b55a546434f74e739bb4c271a3e3a80ff4380d49f7adb  Python-3.12.11.tar.xz
 sha256  3b2f81fe21d181c499c59a256c8e1968455d6689d269aa85373bfb6af41da3bf  LICENSE

+ 1 - 1
package/python3/python3.mk

@@ -5,7 +5,7 @@
 ################################################################################
 
 PYTHON3_VERSION_MAJOR = 3.12
-PYTHON3_VERSION = $(PYTHON3_VERSION_MAJOR).10
+PYTHON3_VERSION = $(PYTHON3_VERSION_MAJOR).11
 PYTHON3_SOURCE = Python-$(PYTHON3_VERSION).tar.xz
 PYTHON3_SITE = https://python.org/ftp/python/$(PYTHON3_VERSION)
 PYTHON3_LICENSE = Python-2.0, others