mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/python3: security bump to v3.12.11

Browse Source 
This fixes the following CVEs affecting tarfile extraction filters:

- CVE-2024-12718:
    Bypass extraction filter to modify file metadata outside
    extraction directory

- CVE-2025-4138:
    Bypassing extraction filter to create symlinks to arbitrary targets
    outside extraction directory

- CVE-2025-4330:
    Extraction filter bypass for linking outside extraction directory

- CVE-2025-4435:
    Tarfile extracts filtered members when errorlevel=0

- CVE-2025-4517:
    Arbitrary writes via tarfile realpath overflow

See https://www.python.org/downloads/release/python-31211/

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Titouan Christophe
2025-06-23 10:39:41 +02:00
committed by Thomas Perale
parent 00d5d387f5
commit 5c96f8d7f8
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
package/python3/python3.hash
View File

@@ -1,5 +1,5 @@
# From https://www.python.org/downloads/release/python-31210/
md5 0c0a6cce86d7611aed691d61e0599de0 Python-3.12.10.tar.xz
# From https://www.python.org/downloads/release/python-31211/
md5 9613d56b90d0d0cfd19980c7e2956a06 Python-3.12.11.tar.xz
# Locally computed
sha256 07ab697474595e06f06647417d3c7fa97ded07afc1a7e4454c5639919b46eaea Python-3.12.10.tar.xz
sha256 c30bb24b7f1e9a19b11b55a546434f74e739bb4c271a3e3a80ff4380d49f7adb Python-3.12.11.tar.xz
sha256 3b2f81fe21d181c499c59a256c8e1968455d6689d269aa85373bfb6af41da3bf LICENSE

2
package/python3/python3.mk
View File

@@ -5,7 +5,7 @@
################################################################################
PYTHON3_VERSION_MAJOR = 3.12
PYTHON3_VERSION = $(PYTHON3_VERSION_MAJOR).10
PYTHON3_VERSION = $(PYTHON3_VERSION_MAJOR).11
PYTHON3_SOURCE = Python-$(PYTHON3_VERSION).tar.xz
PYTHON3_SITE = https://python.org/ftp/python/$(PYTHON3_VERSION)
PYTHON3_LICENSE = Python-2.0, others