summaryrefslogtreecommitdiffstats
path: root/meta-python
Commit message (Collapse)AuthorAgeFilesLines
* python3-django: Fix CVE-2024-41990Soumya Sambu2025-01-222-0/+70
| | | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41990 Upstream-patch: https://github.com/django/django/commit/d0a82e26a74940bf0c78204933c3bdd6a283eb88 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-41989Soumya Sambu2025-01-225-0/+238
| | | | | | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41989 Upstream-patches: https://github.com/django/django/commit/08c5a787262c1ae57f6517d4574b54a5fcaad124 https://github.com/django/django/commit/4b066bde692078b194709d517b27e55defae787c https://github.com/django/django/commit/dcd974698301a38081c141ccba6dcafa5ed2c80e https://github.com/django/django/commit/fc76660f589ac07e45e9cd34ccb8087aeb11904b Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-39614Soumya Sambu2025-01-222-0/+139
| | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-39614 Upstream-patch: https://github.com/django/django/commit/17358fb35fb7217423d4c4877ccb6d1a3a40b1c3 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2023-23969Soumya Sambu2025-01-222-0/+109
| | | | | | | | | | | | | | | | In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large. References: https://nvd.nist.gov/vuln/detail/CVE-2023-23969 Upstream-patch: https://github.com/django/django/commit/c7e0151fdf33e1b11d488b6f67b94fdf3a30614a Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 4.2.15 -> 4.2.17Soumya Sambu2025-01-221-2/+2
| | | | | | | | | | | | Fixes CVE-2024-45230, CVE-2024-45231, CVE-2024-53907 and CVE-2024-53908 Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.16/ https://docs.djangoproject.com/en/dev/releases/4.2.17/ Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-38875Soumya Sambu2025-01-222-0/+162
| | | | | | | | | | | | | | | | An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets. References: https://nvd.nist.gov/vuln/detail/CVE-2024-38875 https://github.com/advisories/GHSA-qg2p-9jwr-mmqf Upstream-patch: https://github.com/django/django/commit/79f368764295df109a37192f6182fb6f361d85b5 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-werkzeug: Fix CVE-2024-49767Soumya Sambu2024-12-312-1/+89
| | | | | | | | | | | | | | | | | | | | Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-49767 Upstream-patch: https://github.com/pallets/werkzeug/commit/8760275afb72bd10b57d92cb4d52abf759b2f3a7 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-werkzeug: Fix CVE-2024-34069Soumya Sambu2024-12-313-1/+272
| | | | | | | | | | | | | | | | | | | | | Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-34069 Upstream-patches: https://github.com/pallets/werkzeug/commit/71b69dfb7df3d912e66bab87fbb1f21f83504967 https://github.com/pallets/werkzeug/commit/890b6b62634fa61224222aee31081c61b054ff01 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-aiohttp: fix ↵Jiaying Song2024-12-086-0/+855
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2023-49081/CVE-2024-30251/CVE-2024-52304/CVE-2023-49082/CVE-2024-27306 CVE-2023-49081: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0. References: https://nvd.nist.gov/vuln/detail/CVE-2023-49081 Upstream patches: https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b CVE-2024-30251: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions. References: https://nvd.nist.gov/vuln/detail/CVE-2024-30251 Upstream patches: https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19 https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597 https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866 CVE-2024-52304: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue. References: https://nvd.nist.gov/vuln/detail/CVE-2024-52304 Upstream patches: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71 CVE-2023-49082: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0. References: https://nvd.nist.gov/vuln/detail/CVE-2023-49082 Upstream patches: https://github.com/aio-libs/aiohttp/pull/7806/commits/a43bc1779892e7014b7723c59d08fb37a000955e CVE-2024-27306: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade. References: https://nvd.nist.gov/vuln/detail/CVE-2024-27306 Upstream patches: https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397 Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-geomet: fix branch parameterMartin Jansa2024-12-081-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * drop unused SRC_URI[sha256sum] as this recipe uses git fetcher * release-0.3.0 branch doesn't exist, but the SRCREV is in master branch: geomet $ git branch -a --contains 73ec5ec96cca32f2e2461d3964fc3d4ab80248f9 * master remotes/origin/HEAD -> origin/master remotes/origin/master remotes/origin/release-1.0 remotes/origin/release-1.1.0 * release-0.3.0 branch doesn't exist even the tarball on MIRROR: https://sources.yoctoproject.org/mirror/sources/git2_github.com.geomet.geomet.git.tar.gz not sure when it was removed from upstream git repo, but it was removed: Pruning origin URL: https://github.com/geomet/geomet.git * [pruned] refs/heads/issue_esri_srid * [pruned] refs/pull/74/merge * [pruned] refs/pull/76/merge * [pruned] refs/pull/77/merge * [pruned] refs/heads/release-0.3.0 * master branch is used since mickledore upgrade to 1.0.0 in: https://git.openembedded.org/meta-openembedded/commit/?h=mickledore&id=382f7d51e3b92b8b7a23cd98f9bfc63c51a33dfd Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-lxml: ignore incompatible-pointer-types issues in native buildMartin Jansa2024-12-081-0/+2
| | | | | | | | | | | | | * to allow building native version on hosts with gcc-14 * it's properly fixed in 5.0.2 version sent to oe-core/scarthgap in: https://lists.openembedded.org/g/openembedded-core/message/206391 but for kirkstone we can just demote the issue back to warning * fixes: https://bugs.launchpad.net/lxml/+bug/2045435 Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-smbus2: Fix LIC_FILES_CHKSUMNiko Mauno2024-09-221-1/+1
| | | | | | | | | Change the reference to the MIT license containing LICENSE file in the downloaded archive. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-haversine: Fix LIC_FILES_CHKSUMNiko Mauno2024-09-221-1/+1
| | | | | | | | | Change the reference to the MIT license containing LICENSE file in the downloaded archive. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-googleapis-common-protos: Fix LIC_FILES_CHKSUMNiko Mauno2024-09-221-1/+1
| | | | | | | | | Change the reference to the Apache-2.0 license containing LICENSE file in the downloaded archive. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pycurl: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | Contents of https://github.com/pycurl/pycurl/blob/REL_7_45_1/COPYING-LGPL correspond to version 2.1 of the license rather than 2.0. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-fann2: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | | According to https://github.com/FutureLinkCorporation/fann2/tree/1.1.2?tab=readme-ov-file#license and https://github.com/FutureLinkCorporation/fann2/blob/1.1.2/LICENSE this project is subject to LGPL-2.1-only license. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-colorama: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | https://github.com/tartley/colorama?tab=readme-ov-file#license and https://github.com/tartley/colorama/blob/0.4.4/LICENSE.txt declare that this project is subject to BSD-3-Clause license. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pillow: Fix LICENSE and change SUMMARY to DESCRIPTIONNiko Mauno2024-09-221-2/+2
| | | | | | | | | | | | | According to https://pypi.org/project/pillow/ and https://github.com/python-pillow/Pillow/blob/9.4.0/LICENSE the project is subject to HPND license. Also change SUMMARY to DESCRIPTION as it's value is clearly over 72 characters long. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-parse-type: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | According to https://pypi.org/project/parse-type/ and https://github.com/jenisys/parse_type/blob/v0.5.2/LICENSE the project is subject to MIT license. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-mock: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | | According to https://github.com/testing-cabal/mock/blob/4.0.3/LICENSE.txt the project is subject to BSD-2-Clause license. (Also https://pypi.org/project/mock/ states 'BSD License'.) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-crc32c: Amend LICENSE declarationNiko Mauno2024-09-221-1/+1
| | | | | | | | | | According to https://github.com/ICRAR/crc32c/blob/v2.2.post0/LICENSE and https://github.com/ICRAR/crc32c?tab=readme-ov-file#license change 'LGPL-2.0-or-later' in LICENSE value to 'LGPL-2.1-or-later'. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-cbor2: Fix LICENSE and LIC_FILES_CHKSUMNiko Mauno2024-09-221-2/+2
| | | | | | | | | | | | Both project pypi page: https://pypi.org/project/cbor2/ as well as https://github.com/agronholm/cbor2/blob/5.4.2/LICENSE.txt state that it is subject to MIT rather than Apache-2.0 license. Also update LIC_FILES_CHKSUM value to reference the LICENSE.txt file from the downloaded archive. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-xlsxwriter: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | | According to homepage https://xlsxwriter.readthedocs.io/license.html and pypi page https://pypi.org/project/XlsxWriter/ as well as https://github.com/jmcnamara/XlsxWriter/blob/RELEASE_3.0.3/LICENSE.txt the module is licensed under BSD-2-Clause. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pybind11: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | The repositorys LICENSE file contains BSD-3-Clause license text, so update the relevant recipe information field to match. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Upgrade 4.2.10 -> 4.2.15Soumya Sambu2024-08-251-2/+2
| | | | | | | | | | | | | | Includes fixes for - CVE-2024-42005, CVE-2024-41991, CVE-2024-41990, CVE-2024-41989 Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.15/ https://docs.djangoproject.com/en/dev/releases/4.2.14/ https://docs.djangoproject.com/en/dev/releases/4.2.13/ https://docs.djangoproject.com/en/dev/releases/4.2.12/ https://docs.djangoproject.com/en/dev/releases/4.2.11 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-42005Soumya Sambu2024-08-252-0/+85
| | | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg. References: https://nvd.nist.gov/vuln/detail/CVE-2024-42005 Upstream-patch: https://github.com/django/django/commit/f4af67b9b41e0f4c117a8741da3abbd1c869ab28 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pyyaml-include: support native and nativesdk buildRandy MacLeod2024-06-271-1/+1
| | | | | | | | Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 56e2e5df9bba23c431bed2fa7794d5cc86c08f2f) Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pyyaml-include: Drop pytest --automakeMingli Yu2024-05-222-2/+1
| | | | | | | | | | The python3-unittest-automake-output is not supported [1], so drop "pytest --automake". [1] https://lore.kernel.org/all/20240327072236.2221619-1-mingli.yu@windriver.com/T/#mda91919809cf156aba24f099bef65142067cd318 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* python3-twisted: Add python3-typing-extensions to RDEPENDSHains van den Bosch2024-04-281-0/+1
| | | | | | | | | | | | | To fix crash due to missing module: File "/usr/lib/python3.11/site-packages/twisted/internet/defer.py", line 42, in <module> from typing_extensions import Literal, ParamSpec, Protocol ModuleNotFoundError: No module named 'typing_extensions' Signed-off-by: Hains van den Bosch <hainsvdbosch@ziggo.nl> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Guðni Már Gilbert <gudnimar@noxmedical.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-twisted: Add python3-asyncio to RDEPENDSHains van den Bosch2024-04-281-0/+1
| | | | | | | | | | | | | | To fix crash due to missing module: from twisted.internet import defer File "/usr/lib/python3.11/site-packages/twisted/internet/defer.py", line 14, in <module> from asyncio import AbstractEventLoop, Future, iscoroutine ModuleNotFoundError: No module named 'asyncio' Signed-off-by: Hains van den Bosch <hainsvdbosch@ziggo.nl> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Guðni Már Gilbert <gudnimar@noxmedical.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-aiohttp: Fix CVE-2024-23334Rahul Janani Pandi2024-04-282-0/+225
| | | | | | | | | | | | | | | | | | | | | | | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue. References: https://security-tracker.debian.org/tracker/CVE-2024-23334 https://github.com/aio-libs/aiohttp/releases/tag/v3.9.2 Signed-off-by: Rahul Janani Pandi <RahulJanani.Pandi@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: fix CVE-2024-24680Rahul Janani Pandi2024-04-282-0/+49
| | | | | | | | | | | | | | | | An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings. Since, there is no ptest available for python3-django so have not tested the patch changes at runtime. References: https://security-tracker.debian.org/tracker/CVE-2024-24680 https://docs.djangoproject.com/en/dev/releases/4.2.10/ Signed-off-by: Rahul Janani Pandi <RahulJanani.Pandi@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pillow: Fix CVE-2023-50447Rahul Janani Pandi2024-04-285-0/+186
| | | | | | | | | | | | | Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). References: https://security-tracker.debian.org/tracker/CVE-2023-50447 https://github.com/python-pillow/Pillow/blob/10.2.0/CHANGES.rst Signed-off-by: Rahul Janani Pandi <RahulJanani.Pandi@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pyyaml-include: Upgrade 1.3.2 -> 1.4.1Mingli Yu2024-04-281-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Upgrade to 1.4.1 to make it work with setuptools 59.x as it doesn't support pep 621 [1], so remove pyproject.toml and add setup.cfg back [2]. * Add python3-toml to RDEPENDS to fix below error: self = <yamlinclude.readers.TomlReader object at 0x7faceccdbd30> def __call__(self): if sys.version_info >= (3, 11): with open(self._path, "rb") as fp: return tomllib.load(fp) else: try: import toml except ImportError as err: # pragma: no cover > raise ImportError(f'Un-supported file "{self._path}".\n`pip install toml` should solve the problem.\n\n{err}') E ImportError: Un-supported file "tests/data/include.d/1.toml". E `pip install toml` should solve the problem. E E No module named 'toml' ../../python3.10/site-packages/yamlinclude/readers.py:69: ImportError [1] https://setuptools.pypa.io/en/latest/userguide/pyproject_config.html [2] https://github.com/tanbro/pyyaml-include/issues/43 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pyyaml-include: switch to pytest --automakeTim Orling2024-04-282-4/+5
| | | | | | | | | | * Also replace ${PYTHON_PN} with python3 Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 182f31a182f6572a3538b875cec7ee761e2da1e6) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pyyaml-include: add initial recipe for version 1.3.2Derek Straka2024-04-282-0/+31
| | | | | | | | | | | | Add a recipe for the pyyaml-include package that extends PyYAML to include YAML files within YAML files. Add a ptest to run the unit tests and include the tests as part of the package lists in meta-python Signed-off-by: Derek Straka <derek@asterius.io> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit bf011a9f5e89186b338b6a335d10ef84929be0ce) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade from 4.2.7 to 4.2.10Fathi Boudra2024-02-281-1/+1
| | | | | | | | | | Upgrade to the latest 4.x LTS release. Bugs fixes only. Fix CVE: CVE-2024-24680: Potential denial-of-service in intcomma template filter Signed-off-by: Fathi Boudra <fathi.boudra@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-aiohttp: upgrade 3.8.5 -> 3.8.6Narpat Mali2024-02-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The delta between 3.8.5 & 3.8.6 contains the CVE-2023-47627 fix and other bugfixes. https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg Changelog: ---------- https://docs.aiohttp.org/en/stable/changes.html#id72 The git log --oneline v3.8.5..v3.8.6 shows: 996de262 (tag: v3.8.6) Release v3.8.6 (#7668) 8c128d4f [PR #7651/45f98b7d backport][3.8] Fix BadStatusLine message (#7666) 89b7df15 Allow lax response parsing on Py parser (#7663) (#7664) d5c12ba8 [PR #7661/85713a48 backport][3.8] Update Python parser for RFCs 9110/9112 (#7662) 8a3977ac [PR #7272/b2a7983a backport][3.8] Fix Read The Docs config (#7650) bcc416e5 [PR #7647/1303350e backport][3.8] Upgrade to llhttp 9.1.3 (#7648) b30c0cd2 Remove chardet/charset-normalizer. (#7589) 5946c743 CookieJar - return 'best-match' and not LIFO (#7577) (#7588) 8c4ec62f [PR #7518/8bd42e74 backport][3.8] Fix GunicornWebWorker max_requests_jitter not work (#7519) a0d234df Use lenient headers for response parser (#7490) (#7492) f92b27b0 Update to LLHTTP 9 (#7485) (#7487) 8129d26f [PR #7480/1fb06bbc backport][3.8] Fix error pointer on linebreaks (#7482) 8d701c3d Fix PermissionError when loading .netrc (#7237) (#7378) (#7395) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pillow: Fix CVE-2023-44271dnyandev2024-01-122-0/+157
| | | | | | | | | | Add patch to fix CVE-2023-44271 Reference: https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7 Signed-off-by: Dnyandev Padalkar <padalkards17082001@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 4.2.5 -> 4.2.7Narpat Mali2024-01-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The delta between 4.2.5 and 4.2.7 contains the fixes for CVE-2023-43665, CVE-2023-46695 and other bugfixes. git log --oneline 4.2.5..4.2.7 shows: d254a54e7f (tag: 4.2.7) [4.2.x] Bumped version for 4.2.7 release. 048a9ebb6e [4.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows. 3fae5d92da [4.2.x] Refs #30601 -- Fixed typos in docs/topics/db/transactions.txt. a8aa94062b [4.2.x] Refs #15578 -- Made cosmetic edits to fixtures docs. 109f39a38b [4.2.x] Fixed #34932 -- Restored varchar_pattern_ops/text_pattern_ops index creation when deterministic collaction is set. 61612990d8 [4.2.x] Fixed typos in docs/ref/models/expressions.txt. 696fbc32d6 [4.2.x] Fixed #30601 -- Doc'd the need to manually revert all app state on transaction rollbacks. ffba63180c [4.2.x] Fixed typo in docs/ref/contrib/gis/geos.txt. 43a3646070 [4.2.x] Fixed #15578 -- Stated the processing order of fixtures in the fixtures docs. 0cd8b867a0 [4.2.x] Added stub release notes and release date for 4.2.7, 4.1.13, and 3.2.23. 510a512119 [4.2.x] Fixed typo in docs/releases/4.2.txt. b644f8bc1f [4.2.x] Corrected note about using accents in writing documentation contributing guide. a576ef98ae [4.2.x] Refs #34900, Refs #34118 -- Updated assertion in test_skip_class_unless_db_feature() test on Python 3.12.1+. 803caec60b [4.2.x] Fixed #34798 -- Fixed QuerySet.aggregate() crash when referencing expressions containing subqueries. caec4f4a6f [4.2.x] Refs #34840 -- Improved release note describing index regression. b6bb2f8099 [4.2.x] Refs #34840 -- Fixed test_validate_nullable_textfield_with_isnull_true() on databases that don's support table check constraints. e8fe48d3a0 [4.2.x] Fixed #34808 -- Doc'd aggregate function's default argument. 830990fa6c [4.2.x] Reorganized tutorial's part 4 to better understand changes needed in URLConf. 0cbc92bc3a [4.2.x] Refs #26029 -- Improved get_storage_class() deprecation warning with stacklevel=2. 9c7627da30 [4.2.x] Refs #34043 -- Clarified how to test UI changes. 0bd53ab86a [4.2.x] Added backticks to setuptools in docs. 99dcba90b4 [4.2.x] Refs #32275 -- Added scrypt password hasher to PASSWORD_HASHERS setting docs. 6697880219 [4.2.x] Refs #31435 -- Doc'd potential infinite recursion when accessing model fields in __init__. a9a3317a95 [4.2.x] Corrected wrap_socket() reference in docs/ref/settings.txt. 9962f94a97 [4.2.x] Added CVE-2023-43665 to security archive. b2d95bb301 [4.2.x] Added stub release notes for 4.2.7. 08d54f83a9 [4.2.x] Post release version bump. c22017bd1d (tag: 4.2.6) [4.2.x] Bumped version for 4.2.6 release. be9c27c4d1 [4.2.x] Fixed CVE-2023-43665 -- Mitigated potential DoS in django.utils.text.Truncator when truncating HTML text. 39fc3f46a8 [4.2.x] Added stub release notes and release date for 4.2.6, 4.1.12, and 3.2.22. dd0bf63d3e [4.2.x] Added warning about flatpages and untrusted users. fec4ed0a25 [4.2.x] Refs #34320 -- Skipped SchemaTests.test_rename_field_with_check_to_truncated_name on MariaBD 10.5.2+. a148461f1f [4.2.x] Fixed #34840 -- Avoided casting string base fields on PostgreSQL. b08f53ff46 [4.2.x] Refs #34808 -- Doc'd that aggregation functions on empty groups can return None. c70f08c4aa [4.2.x] Added updating the Django release process on Trac to release steps. d485aa2732 [4.2.x] Fixed typo in docs/howto/custom-file-storage.txt. ff26e6ad84 [4.2.x] Corrected QuerySet.prefetch_related() note about GenericRelation(). 866122690d [4.2.x] Doc'd HttpResponse.cookies. 97e8a2afb1 [4.2.x] Fixed #34821 -- Prevented DEFAULT_FILE_STORAGE/STATICFILES_STORAGE settings from mutating the main STORAGES. 39cb3b08bc [4.2.x] Bumped checkout version in Github actions configuration. 592ebd8920 [4.2.x] Added stub release notes for 4.2.6. a1dd785139 [4.2.x] Added CVE-2023-41164 to security archive. a9686cb871 [4.2.x] Post-release version bump. Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.7/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 3.2.21 -> 3.2.23Narpat Mali2024-01-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | The delta between 3.2.21 and 3.2.23 contains the fixes for CVE-2023-43665, CVE-2023-46695 and other bugfixes. git log --oneline 3.2.21..3.2.23 shows: 60e648a7ae (tag: 3.2.23) [3.2.x] Bumped version for 3.2.23 release. f9a7fb8466 [3.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows. e6d2591d9e [3.2.x] Added stub release notes for 3.2.23. 3c04b74293 [3.2.x] Added CVE-2023-43665 to security archive. 86a14d653f [3.2.x] Post release version bump. 3106e94e52 (tag: 3.2.22) [3.2.x] Bumped version for 3.2.22 release. ccdade1a02 [3.2.x] Fixed CVE-2023-43665 -- Mitigated potential DoS in django.utils.text.Truncator when truncating HTML text. 6caf7b313d [3.2.x] Added stub release notes for 3.2.22. 9e814c3a5e [3.2.x] Added CVE-2023-41164 to security archive. 4b439dcd05 [3.2.x] Post-release version bump. Release Notes: https://docs.djangoproject.com/en/dev/releases/3.2.23/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix for CVE-2023-43665 and CVE-2023-46695Narpat Mali2024-01-123-0/+291
| | | | | | | | | | | | | | | | | | | | | | | | CVE-2023-43665: In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. CVE-2023-46695: An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. References: https://www.djangoproject.com/weblog/2023/oct/04/security-releases/ https://www.djangoproject.com/weblog/2023/nov/01/security-releases/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-gcovr: switch to main branchChristian Eggers2023-12-131-1/+1
| | | | | | | Branch "master" has been renamed to "main". Signed-off-by: Christian Eggers <ceggers@arri.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-python: Drop broken BBCLASSEXTEND variantsRichard Purdie2023-11-187-13/+1
| | | | | | | | | | | | | | | | | | | | | | | | The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d4aa17dc436beb96a804860bc6d18cf72283709e) Backport: * Adapted paths to follow PV changes * Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-cson: fix run-time dependenciesBartosz Golaszewski2023-11-181-2/+1
| | | | | | | | | | | Add the missing run-time dependency on python3-json. As a result we no longer need to pull python3 native and can drop other *DEPENDS. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 40b4cf5a83098a5f1be873be5c29f26380bc7993) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-soupsieve: Break circular dependency with beautifulsoup4Yoann Congal2023-11-171-4/+0
| | | | | | | | python3-beautifulsoup4 does depend on python3-soupsieve but python3-soupsieve does not depend on python3-beautifulsoup4. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python-blivet: Adapt to upstream branch name changesRichard Purdie2023-11-031-1/+1
| | | | | Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-gevent: fix CVE-2023-41419Narpat Mali2023-10-172-0/+675
| | | | | | | | | | | | An issue in Gevent Gevent before version 23.9.1 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component. References: https://nvd.nist.gov/vuln/detail/CVE-2023-41419 https://github.com/advisories/GHSA-x7m3-jprg-wc5g Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 4.2.3 -> 4.2.5Narpat Mali2023-09-271-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The delta between 4.2.3 and 4.2.5 contains the CVE-2023-41164 fix and other bugfixes. git log --oneline 4.2.3..4.2.5 shows: b8b2f74512 (tag: 4.2.5) [4.2.x] Bumped version for 4.2.5 release. 9c51b4dcfa [4.2.x] Fixed CVE-2023-41164 -- Fixed potential DoS in django.utils.encoding.uri_to_iri(). acfb427522 [4.2.x] Fixed #34803 -- Fixed queryset crash when filtering againts deeply nested OuterRef annotations. 55a0b9c32e [4.2.x] Added stub release notes and release date for 4.2.5, 4.1.11, and 3.2.21. 8e8c318449 [4.2.x] Avoided counting exceptions in AsyncClient docs. dcb9d7a0e4 [4.2.x] Improved formset docs by using a set instead of a list in the custom validation example. f55b420277 [4.2.x] Fixed #34781 -- Updated logging ref docs for django.server's request extra context value. 46b2b08e45 [4.2.x] Fixed #34779 -- Avoided unnecessary selection of non-nullable m2m fields without natural keys during serialization. d34db6602e [4.2.x] Fixed #34773 -- Fixed syncing DEFAULT_FILE_STORAGE/STATICFILES_STORAGE settings with STORAGES. a22aeef555 [4.2.x] Fixed #15799 -- Doc'd that Storage._open() should raise FileNotFoundError when file doesn't exist. 936afc2deb [4.2.x] Refs #34754 -- Added missing FullResultSet import. 3a1863319c [4.2.x] Fixed #34754 -- Fixed JSONField check constraints validation on NULL values. 951dcbb2e6 [4.2.x] Fixed #34756 -- Fixed docs HTML build on Sphinx 7.1+. a750fd0d7f [4.2.x] Added stub release notes for 4.2.5. a56c46642d [4.2.x] Post-release version bump. 6f4c7c124a (tag: 4.2.4) [4.2.x] Bumped version for 4.2.4 release. e53d6239df [4.2.x] Added release date for 4.2.4. 8808d9da6b [4.2.x] Fixed #34750 -- Fixed QuerySet.count() when grouping by unused multi-valued annotations. 2ef2b2ffc0 [4.2.x] Corrected pycon formatting in some docs. 8db9a0b5a0 [4.2.x] Fixed warnings per flake8 6.1.0. 739da73164 [4.2.x] Fixed #34748 -- Fixed queryset crash when grouping by a reference in a subquery. a52a2b6678 [4.2.x] Fixed #34749 -- Corrected QuerySet.acreate() signature in docs. 12ebd9a1ac [4.2.x] Refs #34712 -- Doc'd that defining STORAGES overrides the default configuration. 1f9d00ef9f [4.2.x] Added missing backticks in docs. c99d935600 [4.2.x] Fixed typo in docs/ref/models/querysets.txt. da92a971a0 [4.2.x] Refs #30052 -- Clarified that defer() and only() do not work with aggregated fields. 7a67b065d7 [4.2.x] Fixed #34717 -- Fixed QuerySet.aggregate() crash when referencing window functions. c646412a75 Added reference to TypedChoiceField in ChoiceField docs. f474ba4cb5 [4.2.x] Fixed #34309 -- Doc'd how to fully delete an app. e54f711d42 [4.2.x] Fixed #33405, Refs #7177 -- Clarified docs for filter escapejs regarding safe and unsafe usages. 047844270b [4.2.x] Added stub release notes for 4.2.4. Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.5/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 3.2.20 -> 3.2.21Narpat Mali2023-09-271-2/+2
| | | | | | | | | | | | | | | | | The delta between 3.2.20 and 3.2.21 contains the CVE-2023-41164 fix and other bugfixes. git log --oneline 3.2.20..3.2.21 shows: fd0ccd7fb3 (tag: 3.2.21) [3.2.x] Bumped version for 3.2.21 release. 6f030b1149 [3.2.x] Fixed CVE-2023-41164 -- Fixed potential DoS in django.utils.encoding.uri_to_iri(). 73350a6369 [3.2.x] Added stub release notes for 3.2.21. 75418f8c0e [3.2.x] Fixed #34756 -- Fixed docs HTML build on Sphinx 7.1+. 848fe70f3e [3.2.x] Added CVE-2023-36053 to security archive. 4012a87a58 [3.2.x] Post-release version bump. Release Notes: https://docs.djangoproject.com/en/dev/releases/3.2.21/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 13:11:48 +0000