Bernd Kuhls 81211883ff package/python3: security bump version to 3.14.5 ...

https://www.python.org/downloads/release/python-3145/
https://docs.python.org/release/3.14.5/whatsnew/changelog.html

This release includes various security fixes:

gh-148178: Hardened _remote_debugging by validating remote debug offset
 tables before using them to size memory reads or interpret remote
 layouts.
gh-149254: Update Android and iOS installer to use OpenSSL 3.0.20.
gh-149017: Update bundled libexpat to version 2.8.0.
gh-90309: Base64-encode values when embedding cookies to JavaScript
 using the http.cookies.BaseCookie.js_output() method to avoid injection
 and escaping.
gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor,
 bz2.BZ2Decompressor, and internal zlib._ZlibDecompressor when memory
 allocation fails with MemoryError, which could let a subsequent
 decompress() call read or write through a stale pointer to the already-
released caller buffer.
gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to
 pass the dash-prefix safety check.
gh-146333: Fix quadratic backtracking in configparser.RawConfigParser
 option parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration
 line with many whitespace characters could cause excessive CPU usage.
gh-146211: Reject CR/LF characters in tunnel request headers for the
 HTTPConnection.set_tunnel() method.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ced8d46573)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>

2026-05-29 10:25:43 +02:00

257 B

Raw Permalink Blame History

View Raw