From b73bf11d5f58232c74f04f3a6c0c946382e52ad0 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Thu, 1 Oct 2026 09:08:46 +0200 Subject: [PATCH] package/python3: security bump version to 3.14.8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://www.python.org/downloads/release/python-3148/ https://docs.python.org/release/3.14.8/whatsnew/changelog.html Security content in this releases CVE-2026-19445 gh-156293 Use-after-free of a server-side SSLContext when sni_callback switches contexts CVE-2026-19553 gh-156793 SSLContext.wrap_bio() missing validation of server_hostname parameter CVE-2026-82049 gh-157190 tarfile extraction filters allow file modification and content disclosure via hard link to symlink CVE-2026-15310 gh-156002 Memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression CVE-2026-19672 gh-155999 tarfile extraction filter bypass allows creation of directories outside the destination CVE-2026-15806 gh-155694 urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme CVE-2026-17084 gh-155292 StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 gh-158446 Reject float format precision near INT_MAX Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain (cherry picked from commit 6e0a068475062968db52c102ec2b7185f8a90d1b) Signed-off-by: Raphaël Mélotte --- package/python3/python3.hash | 4 ++-- package/python3/python3.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/python3/python3.hash b/package/python3/python3.hash index 97302bc750..ae4a00c319 100644 --- a/package/python3/python3.hash +++ b/package/python3/python3.hash @@ -1,4 +1,4 @@ -# From https://www.python.org/downloads/release/python-3147/ -sha256 3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81 Python-3.14.7.tar.xz +# From https://www.python.org/downloads/release/python-3148/ +sha256 c2215904f02b175596dc49351585104f4bc20341e1c47378b26a2c274360ce73 Python-3.14.8.tar.xz # Locally computed sha256 b0e25a78cffb43f4d92de8b61ccfa1f1f98ecbc22330b54b5251e7b6ba010231 LICENSE diff --git a/package/python3/python3.mk b/package/python3/python3.mk index cb5e1a4b85..788d993d75 100644 --- a/package/python3/python3.mk +++ b/package/python3/python3.mk @@ -5,7 +5,7 @@ ################################################################################ PYTHON3_VERSION_MAJOR = 3.14 -PYTHON3_VERSION = $(PYTHON3_VERSION_MAJOR).7 +PYTHON3_VERSION = $(PYTHON3_VERSION_MAJOR).8 PYTHON3_SOURCE = Python-$(PYTHON3_VERSION).tar.xz PYTHON3_SITE = https://python.org/ftp/python/$(PYTHON3_VERSION) PYTHON3_LICENSE = Python-2.0, others