Changelog for python3-tools-3.6.15-1.134.i586.rpm :

* Sun Nov 28 2021 Johannes Engel - Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch- Remove faulthandler_stack_overflow_on_GCC10.patch- Update to 3.6.15
* Security + bpo-44022: http.client now avoids infinitely reading potential HTTP headers after a 100 Continue status response from the server. + bpo-43882 Remove ASCII newlines and tabs from URLs + bpo-43285 ftplib no longer trusts the IP address value returned from the server in response to the PASV command by default. This prevents a malicious FTP server from using the response to probe IPv4 address and port combinations on the client network. + bpo-43075 Fix Regular Expression Denial of Service (ReDoS) vulnerability in urllib.request.AbstractBasicAuthHandler. + bpo-44394: Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the fix for the CVE-2013-0340 “Billion Laughs” vulnerability. + bpo-43124 Made the internal putcmd function in smtplib sanitize input for presence of \\r and \
characters to avoid (unlikely) command injection. + bpo-45001: Made email date parsing more robust against malformed input, namely a whitespace-only Date: header.
* Sun May 02 2021 Ben Greiner - Make sure to close the import_failed.map file after the exception has been raised in order to avoid ResourceWarnings when the failing import is part of a try...except block.
* Tue Apr 27 2021 Matej Cepl - Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove getfile feature from pydoc, which is a security nightmare (among other things, CVE-2021-3426, allows disclosure of any file on the system; bsc#1183374, bpo#42988).
* Fri Feb 19 2021 Matej Cepl Update to 3.6.13, final release of 3.6 branch:
* Security - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache poisoning vulnerability by defaulting the query args separator to &, and allowing the user to choose a custom separator. - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static buffers when computing the repr of ctypes.c_double and ctypes.c_longdouble values. - bpo#42103: Prevented potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format. - bpo#42051: The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities. This should not affect users as entity declarations are not used in regular plist files. - bpo#40791: Add volatile to the accumulator variable in hmac.compare_digest, making constant-time-defeating optimizations less likely.
* Core and Builtins - bpo#35560: Fix an assertion error in format() in debug build for floating point formatting with “n” format, zero padding and small width. Release build is not impacted. Patch by Karthikeyan Singaravelan.
* Library - bpo#42103: InvalidFileException and RecursionError are now the only errors caused by loading malformed binary Plist file (previously ValueError and TypeError could be raised in some specific cases).
* Tests - bpo#42794: Update test_nntplib to use offical group name of news.aioe.org for testing. Patch by Dong-hee Na. - bpo#41944: Tests for CJK codecs no longer call eval() on content received via HTTP.- Patches removed, because they were included in the upstream tarball: - CVE-2020-27619-no-eval-http-content.patch - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch
* Mon Feb 08 2021 Matej Cepl - Resync with python36 Factory package.- Make this %primary_interpreter
* Fri Jan 29 2021 Matej Cepl - Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution.
* Wed Jan 27 2021 Matej Cepl - Provide the newest setuptools wheel (bsc#1176262, CVE-2019-20916) in their correct form (bsc#1180686).
* Mon Dec 28 2020 Marcus Meissner - readd --with-fpectl (bsc#1180377)
* Mon Dec 07 2020 Matej Cepl - Adjust sphinx-update-removed-function.patch
* Sat Dec 05 2020 Matej Cepl - (bsc#1179630) Update sphinx-update-removed-function.patch to work with all versions of Sphinx (not binding the Python documentation build to the latest verison of Sphinx). Updated version mentioned on gh#python/cpython#13236.
* Tue Dec 01 2020 Matej Cepl - Add CVE-2020-27619-no-eval-http-content.patch fixing CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support calls eval() on content retrieved via HTTP.
* Tue Dec 01 2020 Steve Kowalik - Add patch sphinx-update-removed-function.patch to no longer call a now removed function (gh#python/cpython#13236). As a consequence, no longer pin Sphinx version.
* Fri Nov 27 2020 Markéta Machová - Pin Sphinx version to fix doc subpackage
* Wed Nov 25 2020 Matej Cepl - Change setuptools and pip version numbers according to new wheels (bsc#1179756).- Add ignore_pip_deprec_warn.patch to switch of persistently failing test.
* Tue Nov 24 2020 Matej Cepl - Replace bundled wheels for pip and setuptools with the updated ones (bsc#1176262 CVE-2019-20916).
* Tue Oct 13 2020 Marketa Calabkova - Handful of changes to make python36 compatible with SLE15 and SLE12 (jsc#ECO-2799, jsc#SLE-13738)- Rebase bpo23395-PyErr_SetInterrupt-signal.patch
* Fri Oct 09 2020 Dominique Leuenberger - Fix build with RPM 4.16: error: bare words are no longer supported, please use \"...\": x86 == ppc.
* Fri Oct 09 2020 Matej Cepl - Fix installing .desktop file
* Fri Sep 25 2020 Dominique Leuenberger - Buildrequire timezone only for general flavor. It\'s used in this flavor for the test suite.
* Wed Sep 02 2020 Matej Cepl - Add faulthandler_stack_overflow_on_GCC10.patch to make build working even with GCC10 (bpo#38965).
* Tue Sep 01 2020 Matej Cepl - Just cleanup and reordering items to synchronize with python38
* Mon Aug 31 2020 Tomáš Chvátal - Format with spec-cleaner
* Fri Aug 21 2020 Andreas Schwab - riscv64-support.patch: bpo-33377: add triplets for mips-r6 and riscv (#6655)- riscv64-ctypes.patch: bpo-35847: RISC-V needs CTYPES_PASS_BY_REF_HACK (GH-11694)- Update list of tests to exclude under qemu linux-user
* Thu Aug 20 2020 Marketa Calabkova - Update the python keyring- Correct libpython name
* Thu Aug 20 2020 Marketa Calabkova - Drop patches which are not mentioned in spec:
* CVE-2019-5010-null-defer-x509-cert-DOS.patch
* F00102-lib64.patch
* F00251-change-user-install-location.patch
* OBS_dev-shm.patch
* SUSE-FEDORA-multilib.patch
* bpo-31046_ensurepip_honours_prefix.patch
* bpo34022-stop_hash-based_invalidation_w_SOURCE_DATE_EPOCH.patch
* bpo36302-sort-module-sources.patch
* bpo40784-Fix-sqlite3-deterministic-test.patch
* bsc1167501-invalid-alignment.patch
* python3-imp-returntype.patch- Working around missing python-packaging dependency in python-Sphinx (bsc#1174571) is not necessary anymore.
* Wed Aug 19 2020 Marketa Calabkova - Update to 3.6.12 (bsc#1179193)
* Ensure python3.dll is loaded from correct locations when Python is embedded
* The __hash__() methods of ipaddress.IPv4Interface and ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and 128 respectively. This resulted in always causing hash collisions. The fix uses hash() to generate hash values for the tuple of (address, mask length, network address).
* Prevent http header injection by rejecting control characters in http.client.putrequest(…).
* Unpickling invalid NEWOBJ_EX opcode with the C implementation raises now UnpicklingError instead of crashing.
* Avoid infinite loop when reading specially crafted TAR files using the tarfile module- Drop merged fixtures:
* CVE-2020-14422-ipaddress-hash-collision.patch
* CVE-2019-20907_tarfile-inf-loop.patch
* recursion.tar- This release also fixes CVE-2020-26116 (bsc#1177211) and CVE-2019-20907 (bsc#1174091).
* Mon Jul 20 2020 Matej Cepl - Add CVE-2019-20907_tarfile-inf-loop.patch fixing bsc#1174091 (CVE-2019-20907, bpo#39017) avoiding possible infinite loop in specifically crafted tarball. Add recursion.tar as a testing tarball for the patch.
* Fri Jul 17 2020 Marketa Calabkova - Make library names internally consistent
* Fri Jul 17 2020 Tomáš Chvátal - Disable profile optimalizations as they deadlock in test_faulthandler
* Fri Jul 17 2020 Tomáš Chvátal - Disable lto as it causes mess and works with 3.7 onwards only
* Fri Jul 17 2020 Tomáš Chvátal - Sync the test disablements from the python3 in sle15
* Fri Jul 17 2020 Tomáš Chvátal - Update to 3.6.11: - bpo-39073: Disallow CR or LF in email.headerregistry. Address arguments to guard against header injection attacks. - bpo-38576 (bsc#1155094): Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised. - bpo-39503: CVE-2020-8492: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager. - bpo-39401: Avoid unsafe load of api-ms-win-core-path-l1-1-0.dll at startup on Windows 7.- Remove merged patch CVE-2020-8492-urllib-ReDoS.patch
* Wed Jul 15 2020 Tomáš Chvátal - Fix minor issues found in the staging.
* Wed Jul 15 2020 Tomáš Chvátal - Do not set ourselves as a primary interpreter
* Thu Jun 25 2020 Matej Cepl - Add CVE-2020-14422-ipaddress-hash-collision.patch fixing CVE-2020-14422 (bsc#1173274, bpo#41004), where hash collisions in IPv4Interface and IPv6Interface could lead to DOS.
* Tue Mar 10 2020 Matej Cepl - Change name of idle3 icons to idle3.png to avoid collision with Python 2 version (bsc#1165894).
* Sat Feb 08 2020 Matej Cepl - Add CVE-2019-9674-zip-bomb.patch to improve documentation warning about dangers of zip-bombs and other security problems with zipfile library. (bsc#1162825 CVE-2019-9674)- Add CVE-2020-8492-urllib-ReDoS.patch fixing the security bug \"Python urrlib allowed an HTTP server to conduct Regular Expression Denial of Service (ReDoS)\" (bsc#1162367)
* Sat Feb 08 2020 Matej Cepl - Add Requires: libpython%{so_version} == %{version}-%{release} to python3-base to keep both packages always synchronized (bsc#1162224).
* Mon Feb 03 2020 Tomáš Chvátal - Reame idle icons to idle3 in order to not conflict with python2 variant of the package bsc#1165894
* renamed the icons
* renamed icon load in desktop file
* Tue Jan 28 2020 Matej Cepl - Add pep538_coerce_legacy_c_locale.patch to coerce locale to C.UTF-8 always (bsc#1162423).