package/python3: security bump to version 3.8.3

Fixes the following security issues:

- bpo-40121: Fixes audit events raised on creating a new socket

- bpo-38576: Disallow control characters in hostnames in http.client,
  addressing CVE-2019-18348.  Such potentially malicious header injection
  URLs now cause a InvalidURL to be raised.

- bpo-39503: CVE-2020-8492: The AbstractBasicAuthHandler class of the
  urllib.request module uses an inefficient regular expression which can be
  exploited by an attacker to cause a denial of service.  Fix the regex to
  prevent the catastrophic backtracking.  Vulnerability reported by Ben
  Caller and Matt Schwager.

For more details, see the changelog:
https://docs.python.org/release/3.8.3/whatsnew/changelog.html#security

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5ff01eb31f)
[Peter: mention security impact]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Adam Duskett
2020-06-14 13:23:46 -07:00
committed by Peter Korsgaard
parent c6c4e713a8
commit ece2007306
23 changed files with 29 additions and 29 deletions

View File

@@ -1,5 +1,5 @@
# From https://www.python.org/downloads/release/python-382/
md5 e9d6ebc92183a177b8e8a58cad5b8d67 Python-3.8.2.tar.xz
# From https://www.python.org/downloads/release/python-383/
md5 3000cf50aaa413052aef82fd2122ca78 Python-3.8.3.tar.xz
# Locally computed
sha256 2646e7dc233362f59714c6193017bb2d6f7b38d6ab4a0cb5fbac5c36c4d845df Python-3.8.2.tar.xz
sha256 dfab5ec723c218082fe3d5d7ae17ecbdebffa9a1aea4d64aa3a2ecdd2e795864 Python-3.8.3.tar.xz
sha256 de4d1f2d2ad5ad0cfd1657a106476b31cb5db5ef9d1ff842b237c0c81f0c8a23 LICENSE