mirror of
https://git.yoctoproject.org/poky
synced 2026-02-12 03:33:02 +01:00
8cd040c218
Drop upstreamed patch and refresh remaining patches. * https://www.python.org/downloads/release/python-31017/ Security content in this release * gh-131809: Upgrade vendored expat to 2.7.1 * gh-80222: Folding of quoted string in display_name violates RFC * gh-121284: Invalid RFC 2047 address header after refolding with email.policy.default * gh-131261: Update libexpat to 2.7.0 * gh-105704: CVE-2025-0938 urlparse does not flag hostname containing [ or ] as incorrect * gh-119511: OOM vulnerability in the imaplib module * https://www.python.org/downloads/release/python-31018/ Security content in this release * gh-135034: [CVE 2024-12718] [CVE 2025-4138] [CVE 2025-4330] [CVE 2025-4435] [CVE 2025-4517] Fixes multiple issues that allowed tarfile extraction filters (filter="data" and filter="tar") to be bypassed using crafted symlinks and hard links. * gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler. * gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service. gh-133767 got meawhile CVE-2025-4516 assigned. (From OE-Core rev: 838a8b5ca148dfa6c6c2c76f1705d1e358a31648) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
41 lines
1.7 KiB
Diff
41 lines
1.7 KiB
Diff
From 999d4e74d34afa233ad8ad0c70b989d77a21957f Mon Sep 17 00:00:00 2001
|
|
From: Petr Viktorin <encukou@gmail.com>
|
|
Date: Wed, 23 Aug 2023 20:00:07 +0200
|
|
Subject: [PATCH] gh-107811: tarfile: treat overflow in UID/GID as failure to
|
|
set it (#108369)
|
|
|
|
Upstream-Status: Backport [https://github.com/python/cpython/pull/108369]
|
|
Signed-off-by: Khem Raj <raj.khem@gmail.com>
|
|
---
|
|
Lib/tarfile.py | 3 ++-
|
|
.../Library/2023-08-23-17-34-39.gh-issue-107811.3Fng72.rst | 3 +++
|
|
2 files changed, 5 insertions(+), 1 deletion(-)
|
|
create mode 100644 Misc/NEWS.d/next/Library/2023-08-23-17-34-39.gh-issue-107811.3Fng72.rst
|
|
|
|
diff --git a/Lib/tarfile.py b/Lib/tarfile.py
|
|
index 3bbbcaa..473167d 100755
|
|
--- a/Lib/tarfile.py
|
|
+++ b/Lib/tarfile.py
|
|
@@ -2675,7 +2675,8 @@ class TarFile(object):
|
|
os.lchown(targetpath, u, g)
|
|
else:
|
|
os.chown(targetpath, u, g)
|
|
- except OSError as e:
|
|
+ except (OSError, OverflowError) as e:
|
|
+ # OverflowError can be raised if an ID doesn't fit in `id_t`
|
|
raise ExtractError("could not change owner") from e
|
|
|
|
def chmod(self, tarinfo, targetpath):
|
|
diff --git a/Misc/NEWS.d/next/Library/2023-08-23-17-34-39.gh-issue-107811.3Fng72.rst b/Misc/NEWS.d/next/Library/2023-08-23-17-34-39.gh-issue-107811.3Fng72.rst
|
|
new file mode 100644
|
|
index 0000000..ffca413
|
|
--- /dev/null
|
|
+++ b/Misc/NEWS.d/next/Library/2023-08-23-17-34-39.gh-issue-107811.3Fng72.rst
|
|
@@ -0,0 +1,3 @@
|
|
+:mod:`tarfile`: extraction of members with overly large UID or GID (e.g. on
|
|
+an OS with 32-bit :c:type:`!id_t`) now fails in the same way as failing to
|
|
+set the ID.
|
|
--
|
|
2.45.0
|
|
|