New Debian python3.11 3.11.2-6+deb12u5 fixes: This update addresses the following issues: * python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043) * cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923) * cpython: python: Uncontrolled CPU resource consumption when in http.cookies module (CVE-2024-7592) * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287) * python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)
--- mirror/ftp/pool/main/p/python3.11/python3.11_3.11.2-6+deb12u4.dsc +++ apt/ucs_5.2-0-errata5.2-0/source/python3.11_3.11.2-6+deb12u5.dsc @@ -1,3 +1,13 @@ +3.11.2-6+deb12u5 [Sat, 30 Nov 2024 23:22:50 +0200] Adrian Bunk <bunk@debian.org>: + + * Non-maintainer upload. + * CVE-2023-27043: Reject malformed addresses in email.parseaddr() + (Closes: #1059298) + * CVE-2024-6923: Encode newlines in headers in the email module + * CVE-2024-7592: Quadratic complexity parsing cookies with backslashes + * CVE-2024-9287: venv activation scripts did't quote paths + * CVE-2024-11168: urllib functions improperly validated bracketed hosts + 3.11.2-6+deb12u4 [Sat, 14 Sep 2024 00:00:30 -0300] Santiago Ruano Rincón <santiagorr@riseup.net>: * Fix zipfile.Path regression introduced by 3.11.2-6+deb12u3 <http://piuparts.knut.univention.de/5.2-0/#7114223992240299507>
OK: bug OK: yaml OK: announce_errata OK: patch ~OK: piuparts Some files after purge disapeared [5.2-0] 6af7efeae2 Bug #57915: python3.11 3.11.2-6+deb12u5 doc/errata/staging/python3.11.yaml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
<https://errata.software-univention.de/#/?erratum=5.2x16>