From 9ae99d19b92aa922ab38cfc083944602d54e4eeb Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Wed, 3 Dec 2025 19:03:34 +0100 Subject: [PATCH] package/python3: security bump version to 3.13.10 For release notes of this bugfix release, see [1]. While the release notes [1] does not mention any security fixes, the more detailed change log at [2] has a security section: - gh-139700: "Check consistency of the zip64 end of central directory record." refers to CVE-2025-8291 [3], - gh-136065: "Fix quadratic complexity in os.path.expandvars()." refers to CVE-2025-6075 [4], - gh-119342: "Fix a potential memory denial of service in the plistlib module." refers to CVE-2025-13837 [5]. Fixes: - [3], [4] and [5]. [1] https://www.python.org/downloads/release/python-31310/ [2] https://docs.python.org/release/3.13.10/whatsnew/changelog.html#security [3] https://www.cve.org/CVERecord?id=CVE-2025-8291 [4] https://www.cve.org/CVERecord?id=CVE-2025-6075 [5] https://www.cve.org/CVERecord?id=CVE-2025-13837 Signed-off-by: Bernd Kuhls [Julien: add info in commit log about CVEs] Signed-off-by: Julien Olivain --- package/python3/python3.hash | 6 +++--- package/python3/python3.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/python3/python3.hash b/package/python3/python3.hash index d1a8f3780f..778dca3b69 100644 --- a/package/python3/python3.hash +++ b/package/python3/python3.hash @@ -1,5 +1,5 @@ -# From https://www.python.org/downloads/release/python-3139/ -md5 516aabdf3de01eeefb6de1aacf9df810 Python-3.13.9.tar.xz +# From https://www.python.org/downloads/release/python-31310/ +md5 5ada33c7f08d5d2df881657bdb8e848d Python-3.13.10.tar.xz # Locally computed -sha256 ed5ef34cda36cfa2f3a340f07cac7e7814f91c7f3c411f6d3562323a866c5c66 Python-3.13.9.tar.xz +sha256 bc673c04375a1a3f0808c27ba8f0411ab811ad390a8740318ccb9c60fad8fd77 Python-3.13.10.tar.xz sha256 78b12c3a81360b357002334f0e70ea0e92eebf7a9b358805c03c48484945f3bb LICENSE diff --git a/package/python3/python3.mk b/package/python3/python3.mk index 7aad14a8ca..6200b8af4e 100644 --- a/package/python3/python3.mk +++ b/package/python3/python3.mk @@ -5,7 +5,7 @@ ################################################################################ PYTHON3_VERSION_MAJOR = 3.13 -PYTHON3_VERSION = $(PYTHON3_VERSION_MAJOR).9 +PYTHON3_VERSION = $(PYTHON3_VERSION_MAJOR).10 PYTHON3_SOURCE = Python-$(PYTHON3_VERSION).tar.xz PYTHON3_SITE = https://python.org/ftp/python/$(PYTHON3_VERSION) PYTHON3_LICENSE = Python-2.0, others