From 5c96f8d7f846babfdaef689a423ab8aacad048fc Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Mon, 23 Jun 2025 10:39:41 +0200 Subject: [PATCH] package/python3: security bump to v3.12.11 This fixes the following CVEs affecting tarfile extraction filters: - CVE-2024-12718: Bypass extraction filter to modify file metadata outside extraction directory - CVE-2025-4138: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory - CVE-2025-4330: Extraction filter bypass for linking outside extraction directory - CVE-2025-4435: Tarfile extracts filtered members when errorlevel=0 - CVE-2025-4517: Arbitrary writes via tarfile realpath overflow See https://www.python.org/downloads/release/python-31211/ Signed-off-by: Titouan Christophe Signed-off-by: Thomas Perale --- package/python3/python3.hash | 6 +++--- package/python3/python3.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/python3/python3.hash b/package/python3/python3.hash index 2772e33109..923a632165 100644 --- a/package/python3/python3.hash +++ b/package/python3/python3.hash @@ -1,5 +1,5 @@ -# From https://www.python.org/downloads/release/python-31210/ -md5 0c0a6cce86d7611aed691d61e0599de0 Python-3.12.10.tar.xz +# From https://www.python.org/downloads/release/python-31211/ +md5 9613d56b90d0d0cfd19980c7e2956a06 Python-3.12.11.tar.xz # Locally computed -sha256 07ab697474595e06f06647417d3c7fa97ded07afc1a7e4454c5639919b46eaea Python-3.12.10.tar.xz +sha256 c30bb24b7f1e9a19b11b55a546434f74e739bb4c271a3e3a80ff4380d49f7adb Python-3.12.11.tar.xz sha256 3b2f81fe21d181c499c59a256c8e1968455d6689d269aa85373bfb6af41da3bf LICENSE diff --git a/package/python3/python3.mk b/package/python3/python3.mk index 6b3a3e81f3..8bbff066ab 100644 --- a/package/python3/python3.mk +++ b/package/python3/python3.mk @@ -5,7 +5,7 @@ ################################################################################ PYTHON3_VERSION_MAJOR = 3.12 -PYTHON3_VERSION = $(PYTHON3_VERSION_MAJOR).10 +PYTHON3_VERSION = $(PYTHON3_VERSION_MAJOR).11 PYTHON3_SOURCE = Python-$(PYTHON3_VERSION).tar.xz PYTHON3_SITE = https://python.org/ftp/python/$(PYTHON3_VERSION) PYTHON3_LICENSE = Python-2.0, others