summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-devtools/python/python3/0001-Don-t-search-system-for-headers-libraries.patch2
-rw-r--r--meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch2
-rw-r--r--meta/recipes-devtools/python/python3/0001-bpo-36852-proper-detection-of-mips-architecture-for-.patch227
-rw-r--r--meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch24
-rw-r--r--meta/recipes-devtools/python/python3/0001-test_marshal.py-add-more-elements-in-test_determinis.patch27
-rw-r--r--meta/recipes-devtools/python/python3/12-distutils-prefix-is-inside-staging-area.patch2
-rw-r--r--meta/recipes-devtools/python/python3/cve-2022-37460.patch95
-rw-r--r--meta/recipes-devtools/python/python3_3.11.1.bb (renamed from meta/recipes-devtools/python/python3_3.11.0.bb)7
8 files changed, 17 insertions, 369 deletions
diff --git a/meta/recipes-devtools/python/python3/0001-Don-t-search-system-for-headers-libraries.patch b/meta/recipes-devtools/python/python3/0001-Don-t-search-system-for-headers-libraries.patch
index d6d9e451ff..bd696ade92 100644
--- a/meta/recipes-devtools/python/python3/0001-Don-t-search-system-for-headers-libraries.patch
+++ b/meta/recipes-devtools/python/python3/0001-Don-t-search-system-for-headers-libraries.patch
@@ -1,4 +1,4 @@
1From 910a905aaeb6edb6b042ef65b3e2b73faada80aa Mon Sep 17 00:00:00 2001 1From 32aba1dfba1e27103e7367bbb9e4bef0e31aeac5 Mon Sep 17 00:00:00 2001
2From: Jeremy Puhlman <jpuhlman@mvista.com> 2From: Jeremy Puhlman <jpuhlman@mvista.com>
3Date: Wed, 4 Mar 2020 00:06:42 +0000 3Date: Wed, 4 Mar 2020 00:06:42 +0000
4Subject: [PATCH] Don't search system for headers/libraries 4Subject: [PATCH] Don't search system for headers/libraries
diff --git a/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch b/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch
index 5ca855e7ed..cb79d9c671 100644
--- a/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch
+++ b/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch
@@ -1,4 +1,4 @@
1From 45548f40668d429adcb7532d35db1ac16fe74562 Mon Sep 17 00:00:00 2001 1From a73020a9c388b4882c384087882a77ab2c7b3729 Mon Sep 17 00:00:00 2001
2From: Alexander Kanavin <alex@linutronix.de> 2From: Alexander Kanavin <alex@linutronix.de>
3Date: Fri, 10 Sep 2021 12:28:31 +0200 3Date: Fri, 10 Sep 2021 12:28:31 +0200
4Subject: [PATCH] Lib/sysconfig.py: use values from build configuration file 4Subject: [PATCH] Lib/sysconfig.py: use values from build configuration file
diff --git a/meta/recipes-devtools/python/python3/0001-bpo-36852-proper-detection-of-mips-architecture-for-.patch b/meta/recipes-devtools/python/python3/0001-bpo-36852-proper-detection-of-mips-architecture-for-.patch
deleted file mode 100644
index f303eb35dc..0000000000
--- a/meta/recipes-devtools/python/python3/0001-bpo-36852-proper-detection-of-mips-architecture-for-.patch
+++ /dev/null
@@ -1,227 +0,0 @@
1From d2abe7328cea770425405aa0da2f4c2dac89fcad Mon Sep 17 00:00:00 2001
2From: Matthias Schoepfer <matthias.schoepfer@ithinx.io>
3Date: Fri, 31 May 2019 15:34:34 +0200
4Subject: [PATCH] bpo-36852: proper detection of mips architecture for soft
5
6 float
7
8When (cross) compiling for softfloat mips, __mips_hard_float will not be
9defined and detection of OS triplet in configure.ac / configure will fail.
10
11This also has to do with the custom detection of the build triplet. Trying
12to do this in a more autoconf/autotools manner.
13
14Upstream-Status: Submitted [https://github.com/python/cpython/pull/13196]
15Signed-off-by: Matthias Schoepfer <matthias.schoepfer@ithinx.io>
16
17---
18 configure.ac | 196 ++++++---------------------------------------------
19 1 file changed, 21 insertions(+), 175 deletions(-)
20
21diff --git a/configure.ac b/configure.ac
22index 358b6ea..085fc0b 100644
23--- a/configure.ac
24+++ b/configure.ac
25@@ -907,181 +907,27 @@ then
26 fi
27
28
29-AC_MSG_CHECKING([for the platform triplet based on compiler characteristics])
30-cat > conftest.c <<EOF
31-#undef bfin
32-#undef cris
33-#undef fr30
34-#undef linux
35-#undef hppa
36-#undef hpux
37-#undef i386
38-#undef mips
39-#undef powerpc
40-#undef sparc
41-#undef unix
42-#if defined(__ANDROID__)
43- # Android is not a multiarch system.
44-#elif defined(__linux__)
45-# if defined(__x86_64__) && defined(__LP64__)
46- x86_64-linux-gnu
47-# elif defined(__x86_64__) && defined(__ILP32__)
48- x86_64-linux-gnux32
49-# elif defined(__i386__)
50- i386-linux-gnu
51-# elif defined(__aarch64__) && defined(__AARCH64EL__)
52-# if defined(__ILP32__)
53- aarch64_ilp32-linux-gnu
54-# else
55- aarch64-linux-gnu
56-# endif
57-# elif defined(__aarch64__) && defined(__AARCH64EB__)
58-# if defined(__ILP32__)
59- aarch64_be_ilp32-linux-gnu
60-# else
61- aarch64_be-linux-gnu
62-# endif
63-# elif defined(__alpha__)
64- alpha-linux-gnu
65-# elif defined(__ARM_EABI__) && defined(__ARM_PCS_VFP)
66-# if defined(__ARMEL__)
67- arm-linux-gnueabihf
68-# else
69- armeb-linux-gnueabihf
70-# endif
71-# elif defined(__ARM_EABI__) && !defined(__ARM_PCS_VFP)
72-# if defined(__ARMEL__)
73- arm-linux-gnueabi
74-# else
75- armeb-linux-gnueabi
76-# endif
77-# elif defined(__hppa__)
78- hppa-linux-gnu
79-# elif defined(__ia64__)
80- ia64-linux-gnu
81-# elif defined(__m68k__) && !defined(__mcoldfire__)
82- m68k-linux-gnu
83-# elif defined(__mips_hard_float) && defined(__mips_isa_rev) && (__mips_isa_rev >=6) && defined(_MIPSEL)
84-# if _MIPS_SIM == _ABIO32
85- mipsisa32r6el-linux-gnu
86-# elif _MIPS_SIM == _ABIN32
87- mipsisa64r6el-linux-gnuabin32
88-# elif _MIPS_SIM == _ABI64
89- mipsisa64r6el-linux-gnuabi64
90-# else
91-# error unknown platform triplet
92-# endif
93-# elif defined(__mips_hard_float) && defined(__mips_isa_rev) && (__mips_isa_rev >=6)
94-# if _MIPS_SIM == _ABIO32
95- mipsisa32r6-linux-gnu
96-# elif _MIPS_SIM == _ABIN32
97- mipsisa64r6-linux-gnuabin32
98-# elif _MIPS_SIM == _ABI64
99- mipsisa64r6-linux-gnuabi64
100-# else
101-# error unknown platform triplet
102-# endif
103-# elif defined(__mips_hard_float) && defined(_MIPSEL)
104-# if _MIPS_SIM == _ABIO32
105- mipsel-linux-gnu
106-# elif _MIPS_SIM == _ABIN32
107- mips64el-linux-gnuabin32
108-# elif _MIPS_SIM == _ABI64
109- mips64el-linux-gnuabi64
110-# else
111-# error unknown platform triplet
112-# endif
113-# elif defined(__mips_hard_float)
114-# if _MIPS_SIM == _ABIO32
115- mips-linux-gnu
116-# elif _MIPS_SIM == _ABIN32
117- mips64-linux-gnuabin32
118-# elif _MIPS_SIM == _ABI64
119- mips64-linux-gnuabi64
120-# else
121-# error unknown platform triplet
122-# endif
123-# elif defined(__or1k__)
124- or1k-linux-gnu
125-# elif defined(__powerpc__) && defined(__SPE__)
126- powerpc-linux-gnuspe
127-# elif defined(__powerpc64__)
128-# if defined(__LITTLE_ENDIAN__)
129- powerpc64le-linux-gnu
130-# else
131- powerpc64-linux-gnu
132-# endif
133-# elif defined(__powerpc__)
134- powerpc-linux-gnu
135-# elif defined(__s390x__)
136- s390x-linux-gnu
137-# elif defined(__s390__)
138- s390-linux-gnu
139-# elif defined(__sh__) && defined(__LITTLE_ENDIAN__)
140- sh4-linux-gnu
141-# elif defined(__sparc__) && defined(__arch64__)
142- sparc64-linux-gnu
143-# elif defined(__sparc__)
144- sparc-linux-gnu
145-# elif defined(__riscv)
146-# if __riscv_xlen == 32
147- riscv32-linux-gnu
148-# elif __riscv_xlen == 64
149- riscv64-linux-gnu
150-# else
151-# error unknown platform triplet
152-# endif
153-# else
154-# error unknown platform triplet
155-# endif
156-#elif defined(__FreeBSD_kernel__)
157-# if defined(__LP64__)
158- x86_64-kfreebsd-gnu
159-# elif defined(__i386__)
160- i386-kfreebsd-gnu
161-# else
162-# error unknown platform triplet
163-# endif
164-#elif defined(__gnu_hurd__)
165- i386-gnu
166-#elif defined(__APPLE__)
167- darwin
168-#elif defined(__VXWORKS__)
169- vxworks
170-#elif defined(__wasm32__)
171-# if defined(__EMSCRIPTEN__)
172- wasm32-emscripten
173-# elif defined(__wasi__)
174- wasm32-wasi
175-# else
176-# error unknown wasm32 platform
177-# endif
178-#elif defined(__wasm64__)
179-# if defined(__EMSCRIPTEN)
180- wasm64-emscripten
181-# elif defined(__wasi__)
182- wasm64-wasi
183-# else
184-# error unknown wasm64 platform
185-# endif
186-#else
187-# error unknown platform triplet
188-#endif
189-
190-EOF
191-
192-if $CPP $CPPFLAGS conftest.c >conftest.out 2>/dev/null; then
193- PLATFORM_TRIPLET=`grep -v '^#' conftest.out | grep -v '^ *$' | tr -d ' '`
194- case "$build_os" in
195- linux-musl*)
196- PLATFORM_TRIPLET=`echo "$PLATFORM_TRIPLET" | sed 's/linux-gnu/linux-musl/'`
197- ;;
198- esac
199- AC_MSG_RESULT([$PLATFORM_TRIPLET])
200-else
201- AC_MSG_RESULT([none])
202-fi
203-rm -f conftest.c conftest.out
204+AC_CANONICAL_TARGET
205+## Not using $target to filter out vendor
206+## Need to handle macos, vxworks and hurd special (?) :-/
207+case ${target_os} in
208+ darwin*)
209+ PLATFORM_TRIPLET=darwin
210+ ;;
211+ hurd*)
212+ PLATFORM_TRIPLET=i386-gnu
213+ ;;
214+ vxworks*)
215+ PLATFORM_TRIPLET=vxworks
216+ ;;
217+ *)
218+ if test "${target_cpu}" != "i686"; then
219+ PLATFORM_TRIPLET=${target_cpu}-${target_os}
220+ else
221+ PLATFORM_TRIPLET=i386-${target_os}
222+ fi
223+ ;;
224+esac
225
226 AC_MSG_CHECKING([for multiarch])
227 AS_CASE([$ac_sys_system],
diff --git a/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch b/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch
index 4d589dd759..ef8edca51f 100644
--- a/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch
+++ b/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch
@@ -1,4 +1,4 @@
1From 175ed10e0a59a5395546ef88702f23d100b909f9 Mon Sep 17 00:00:00 2001 1From 4ba40ee527f844a804be571e52d9dc5447ae4cdd Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com> 2From: Changqing Li <changqing.li@windriver.com>
3Date: Mon, 22 Oct 2018 15:19:51 +0800 3Date: Mon, 22 Oct 2018 15:19:51 +0800
4Subject: [PATCH] python3: use cc_basename to replace CC for checking compiler 4Subject: [PATCH] python3: use cc_basename to replace CC for checking compiler
@@ -27,7 +27,7 @@ Signed-off-by: Changqing Li <changqing.li@windriver.com>
27 1 file changed, 10 insertions(+), 9 deletions(-) 27 1 file changed, 10 insertions(+), 9 deletions(-)
28 28
29diff --git a/configure.ac b/configure.ac 29diff --git a/configure.ac b/configure.ac
30index 77fb609..358b6ea 100644 30index 90008bc..bf56195 100644
31--- a/configure.ac 31--- a/configure.ac
32+++ b/configure.ac 32+++ b/configure.ac
33@@ -134,6 +134,7 @@ AC_CONFIG_HEADERS([pyconfig.h]) 33@@ -134,6 +134,7 @@ AC_CONFIG_HEADERS([pyconfig.h])
@@ -38,7 +38,7 @@ index 77fb609..358b6ea 100644
38 38
39 AS_VAR_IF([cross_compiling], [maybe], 39 AS_VAR_IF([cross_compiling], [maybe],
40 [AC_MSG_ERROR([Cross compiling required --host=HOST-TUPLE and --build=ARCH])] 40 [AC_MSG_ERROR([Cross compiling required --host=HOST-TUPLE and --build=ARCH])]
41@@ -877,7 +878,7 @@ AC_MSG_RESULT($with_cxx_main) 41@@ -887,7 +888,7 @@ AC_MSG_RESULT($with_cxx_main)
42 preset_cxx="$CXX" 42 preset_cxx="$CXX"
43 if test -z "$CXX" 43 if test -z "$CXX"
44 then 44 then
@@ -47,7 +47,7 @@ index 77fb609..358b6ea 100644
47 gcc) AC_PATH_TOOL(CXX, [g++], [g++], [notfound]) ;; 47 gcc) AC_PATH_TOOL(CXX, [g++], [g++], [notfound]) ;;
48 cc) AC_PATH_TOOL(CXX, [c++], [c++], [notfound]) ;; 48 cc) AC_PATH_TOOL(CXX, [c++], [c++], [notfound]) ;;
49 clang|*/clang) AC_PATH_TOOL(CXX, [clang++], [clang++], [notfound]) ;; 49 clang|*/clang) AC_PATH_TOOL(CXX, [clang++], [clang++], [notfound]) ;;
50@@ -1290,7 +1291,7 @@ rmdir CaseSensitiveTestDir 50@@ -1300,7 +1301,7 @@ rmdir CaseSensitiveTestDir
51 51
52 case $ac_sys_system in 52 case $ac_sys_system in
53 hp*|HP*) 53 hp*|HP*)
@@ -56,16 +56,16 @@ index 77fb609..358b6ea 100644
56 cc|*/cc) CC="$CC -Ae";; 56 cc|*/cc) CC="$CC -Ae";;
57 esac;; 57 esac;;
58 esac 58 esac
59@@ -1798,7 +1799,7 @@ esac 59@@ -1834,7 +1835,7 @@ esac
60 ], 60 ],
61 [AC_MSG_RESULT(no)]) 61 [AC_MSG_RESULT(no)])
62 if test "$Py_LTO" = 'true' ; then 62 if test "$Py_LTO" = 'true' ; then
63- case $CC in 63- case $CC in
64+ case $cc_basename in 64+ case $cc_basename in
65 *clang*) 65 *clang*)
66 dnl flag to disable lto during linking
67 LDFLAGS_NOLTO="-fno-lto" 66 LDFLAGS_NOLTO="-fno-lto"
68@@ -1917,7 +1918,7 @@ then 67 dnl Clang linker requires -flto in order to link objects with LTO information.
68@@ -1955,7 +1956,7 @@ then
69 fi 69 fi
70 fi 70 fi
71 LLVM_PROF_ERR=no 71 LLVM_PROF_ERR=no
@@ -74,7 +74,7 @@ index 77fb609..358b6ea 100644
74 *clang*) 74 *clang*)
75 # Any changes made here should be reflected in the GCC+Darwin case below 75 # Any changes made here should be reflected in the GCC+Darwin case below
76 PGO_PROF_GEN_FLAG="-fprofile-instr-generate" 76 PGO_PROF_GEN_FLAG="-fprofile-instr-generate"
77@@ -1978,7 +1979,7 @@ esac 77@@ -2016,7 +2017,7 @@ esac
78 # compiler and platform. BASECFLAGS tweaks need to be made even if the 78 # compiler and platform. BASECFLAGS tweaks need to be made even if the
79 # user set OPT. 79 # user set OPT.
80 80
@@ -83,7 +83,7 @@ index 77fb609..358b6ea 100644
83 *clang*) 83 *clang*)
84 cc_is_clang=1 84 cc_is_clang=1
85 ;; 85 ;;
86@@ -2197,7 +2198,7 @@ yes) 86@@ -2235,7 +2236,7 @@ yes)
87 87
88 # ICC doesn't recognize the option, but only emits a warning 88 # ICC doesn't recognize the option, but only emits a warning
89 ## XXX does it emit an unused result warning and can it be disabled? 89 ## XXX does it emit an unused result warning and can it be disabled?
@@ -92,7 +92,7 @@ index 77fb609..358b6ea 100644
92 [*icc*], [ac_cv_disable_unused_result_warning=no] 92 [*icc*], [ac_cv_disable_unused_result_warning=no]
93 [PY_CHECK_CC_WARNING([disable], [unused-result])]) 93 [PY_CHECK_CC_WARNING([disable], [unused-result])])
94 AS_VAR_IF([ac_cv_disable_unused_result_warning], [yes], 94 AS_VAR_IF([ac_cv_disable_unused_result_warning], [yes],
95@@ -2439,7 +2440,7 @@ yes) 95@@ -2477,7 +2478,7 @@ yes)
96 ;; 96 ;;
97 esac 97 esac
98 98
@@ -101,7 +101,7 @@ index 77fb609..358b6ea 100644
101 *icc*) 101 *icc*)
102 # ICC needs -fp-model strict or floats behave badly 102 # ICC needs -fp-model strict or floats behave badly
103 CFLAGS_NODIST="$CFLAGS_NODIST -fp-model strict" 103 CFLAGS_NODIST="$CFLAGS_NODIST -fp-model strict"
104@@ -3281,7 +3282,7 @@ then 104@@ -3319,7 +3320,7 @@ then
105 then 105 then
106 LINKFORSHARED="-Wl,--export-dynamic" 106 LINKFORSHARED="-Wl,--export-dynamic"
107 fi;; 107 fi;;
@@ -110,7 +110,7 @@ index 77fb609..358b6ea 100644
110 *gcc*) 110 *gcc*)
111 if $CC -Xlinker --help 2>&1 | grep export-dynamic >/dev/null 111 if $CC -Xlinker --help 2>&1 | grep export-dynamic >/dev/null
112 then 112 then
113@@ -6370,7 +6371,7 @@ if test "$ac_cv_gcc_asm_for_x87" = yes; then 113@@ -6410,7 +6411,7 @@ if test "$ac_cv_gcc_asm_for_x87" = yes; then
114 # Some versions of gcc miscompile inline asm: 114 # Some versions of gcc miscompile inline asm:
115 # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46491 115 # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46491
116 # http://gcc.gnu.org/ml/gcc/2010-11/msg00366.html 116 # http://gcc.gnu.org/ml/gcc/2010-11/msg00366.html
diff --git a/meta/recipes-devtools/python/python3/0001-test_marshal.py-add-more-elements-in-test_determinis.patch b/meta/recipes-devtools/python/python3/0001-test_marshal.py-add-more-elements-in-test_determinis.patch
deleted file mode 100644
index 9da7f94255..0000000000
--- a/meta/recipes-devtools/python/python3/0001-test_marshal.py-add-more-elements-in-test_determinis.patch
+++ /dev/null
@@ -1,27 +0,0 @@
1From 076a4f9ab06105b94c87386c0dfe17b823502a13 Mon Sep 17 00:00:00 2001
2From: Alexander Kanavin <alex@linutronix.de>
3Date: Thu, 1 Dec 2022 19:02:51 +0100
4Subject: [PATCH] test_marshal.py: add more elements in test_deterministic_sets
5
6Existing elements do produce different output on x86_64, but they
7do not on x86. Let's make the data longer to ensure it differs.
8
9Upstream-Status: Submitted [https://github.com/python/cpython/pull/99935]
10Signed-off-by: Alexander Kanavin <alex@linutronix.de>
11---
12 Lib/test/test_marshal.py | 2 +-
13 1 file changed, 1 insertion(+), 1 deletion(-)
14
15diff --git a/Lib/test/test_marshal.py b/Lib/test/test_marshal.py
16index aae86cc..29d95ad 100644
17--- a/Lib/test/test_marshal.py
18+++ b/Lib/test/test_marshal.py
19@@ -352,7 +352,7 @@ class BugsTestCase(unittest.TestCase):
20 for elements in (
21 "float('nan'), b'a', b'b', b'c', 'x', 'y', 'z'",
22 # Also test for bad interactions with backreferencing:
23- "('Spam', 0), ('Spam', 1), ('Spam', 2)",
24+ "('Spam', 0), ('Spam', 1), ('Spam', 2), ('Spam', 3), ('Spam', 4), ('Spam', 5)",
25 ):
26 s = f"{kind}([{elements}])"
27 with self.subTest(s):
diff --git a/meta/recipes-devtools/python/python3/12-distutils-prefix-is-inside-staging-area.patch b/meta/recipes-devtools/python/python3/12-distutils-prefix-is-inside-staging-area.patch
index 7b497b83ca..1879024e16 100644
--- a/meta/recipes-devtools/python/python3/12-distutils-prefix-is-inside-staging-area.patch
+++ b/meta/recipes-devtools/python/python3/12-distutils-prefix-is-inside-staging-area.patch
@@ -1,4 +1,4 @@
1From 2918d431cb5607933755fc80a6220135dd7fcb1d Mon Sep 17 00:00:00 2001 1From 3bdf292be303e239e78ed39dd8106fbd5f7ee645 Mon Sep 17 00:00:00 2001
2From: Khem Raj <raj.khem@gmail.com> 2From: Khem Raj <raj.khem@gmail.com>
3Date: Tue, 14 May 2013 15:00:26 -0700 3Date: Tue, 14 May 2013 15:00:26 -0700
4Subject: [PATCH] python3: Add target and native recipes 4Subject: [PATCH] python3: Add target and native recipes
diff --git a/meta/recipes-devtools/python/python3/cve-2022-37460.patch b/meta/recipes-devtools/python/python3/cve-2022-37460.patch
deleted file mode 100644
index 12177684fd..0000000000
--- a/meta/recipes-devtools/python/python3/cve-2022-37460.patch
+++ /dev/null
@@ -1,95 +0,0 @@
1From 94582bb643f98bc58b1ff206d1d2a56f97c3a7e5 Mon Sep 17 00:00:00 2001
2From: "Miss Islington (bot)"
3 <31488909+miss-islington@users.noreply.github.com>
4Date: Wed, 28 Sep 2022 16:46:11 -0700
5Subject: [PATCH] gh-97612: Fix shell injection in get-remote-certificate.py
6 (GH-97613)
7
8Fix a shell code injection vulnerability in the
9get-remote-certificate.py example script. The script no longer uses a
10shell to run "openssl" commands. Issue reported and initial fix by
11Caleb Shortt.
12
13Remove the Windows code path to send "quit" on stdin to the "openssl
14s_client" command: use DEVNULL on all platforms instead.
15
16Co-authored-by: Caleb Shortt <caleb@rgauge.com>
17(cherry picked from commit 83a0f44ffd8b398673ae56c310cf5768d359c341)
18
19Co-authored-by: Victor Stinner <vstinner@python.org>
20---
21CVE: CVE-2022-37460
22
23Upstream-Status: Backport [https://github.com/python/cpython.git]
24 [commit 94582bb643... unmodified]
25
26Signed-off-by: Joe Slater <joe.slater@windriver.com>
27
28---
29 ...2-09-28-12-10-57.gh-issue-97612.y6NvOQ.rst | 3 +++
30 Tools/scripts/get-remote-certificate.py | 25 ++++++-------------
31 2 files changed, 10 insertions(+), 18 deletions(-)
32 create mode 100644 Misc/NEWS.d/next/Security/2022-09-28-12-10-57.gh-issue-97612.y6NvOQ.rst
33
34diff --git a/Misc/NEWS.d/next/Security/2022-09-28-12-10-57.gh-issue-97612.y6NvOQ.rst b/Misc/NEWS.d/next/Security/2022-09-28-12-10-57.gh-issue-97612.y6NvOQ.rst
35new file mode 100644
36index 0000000000..2f113492d4
37--- /dev/null
38+++ b/Misc/NEWS.d/next/Security/2022-09-28-12-10-57.gh-issue-97612.y6NvOQ.rst
39@@ -0,0 +1,3 @@
40+Fix a shell code injection vulnerability in the ``get-remote-certificate.py``
41+example script. The script no longer uses a shell to run ``openssl`` commands.
42+Issue reported and initial fix by Caleb Shortt. Patch by Victor Stinner.
43diff --git a/Tools/scripts/get-remote-certificate.py b/Tools/scripts/get-remote-certificate.py
44index 38901286e1..68272fca83 100755
45--- a/Tools/scripts/get-remote-certificate.py
46+++ b/Tools/scripts/get-remote-certificate.py
47@@ -15,8 +15,8 @@
48 def fetch_server_certificate (host, port):
49
50 def subproc(cmd):
51- from subprocess import Popen, PIPE, STDOUT
52- proc = Popen(cmd, stdout=PIPE, stderr=STDOUT, shell=True)
53+ from subprocess import Popen, PIPE, STDOUT, DEVNULL
54+ proc = Popen(cmd, stdout=PIPE, stderr=STDOUT, stdin=DEVNULL)
55 status = proc.wait()
56 output = proc.stdout.read()
57 return status, output
58@@ -33,8 +33,8 @@ def strip_to_x509_cert(certfile_contents, outfile=None):
59 fp.write(m.group(1) + b"\n")
60 try:
61 tn2 = (outfile or tempfile.mktemp())
62- status, output = subproc(r'openssl x509 -in "%s" -out "%s"' %
63- (tn, tn2))
64+ cmd = ['openssl', 'x509', '-in', tn, '-out', tn2]
65+ status, output = subproc(cmd)
66 if status != 0:
67 raise RuntimeError('OpenSSL x509 failed with status %s and '
68 'output: %r' % (status, output))
69@@ -45,20 +45,9 @@ def strip_to_x509_cert(certfile_contents, outfile=None):
70 finally:
71 os.unlink(tn)
72
73- if sys.platform.startswith("win"):
74- tfile = tempfile.mktemp()
75- with open(tfile, "w") as fp:
76- fp.write("quit\n")
77- try:
78- status, output = subproc(
79- 'openssl s_client -connect "%s:%s" -showcerts < "%s"' %
80- (host, port, tfile))
81- finally:
82- os.unlink(tfile)
83- else:
84- status, output = subproc(
85- 'openssl s_client -connect "%s:%s" -showcerts < /dev/null' %
86- (host, port))
87+ cmd = ['openssl', 's_client', '-connect', '%s:%s' % (host, port), '-showcerts']
88+ status, output = subproc(cmd)
89+
90 if status != 0:
91 raise RuntimeError('OpenSSL connect failed with status %s and '
92 'output: %r' % (status, output))
93--
942.38.1
95
diff --git a/meta/recipes-devtools/python/python3_3.11.0.bb b/meta/recipes-devtools/python/python3_3.11.1.bb
index ff25fe1ac4..37092d30d2 100644
--- a/meta/recipes-devtools/python/python3_3.11.0.bb
+++ b/meta/recipes-devtools/python/python3_3.11.1.bb
@@ -4,7 +4,7 @@ DESCRIPTION = "Python is a programming language that lets you work more quickly
4LICENSE = "PSF-2.0" 4LICENSE = "PSF-2.0"
5SECTION = "devel/python" 5SECTION = "devel/python"
6 6
7LIC_FILES_CHKSUM = "file://LICENSE;md5=4b8801e752a2c70ac41a5f9aa243f766" 7LIC_FILES_CHKSUM = "file://LICENSE;md5=a1822df8d0f068628ca6090aedc5bfc8"
8 8
9SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ 9SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
10 file://run-ptest \ 10 file://run-ptest \
@@ -18,7 +18,6 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
18 ${@bb.utils.contains('PACKAGECONFIG', 'tk', '', 'file://avoid_warning_about_tkinter.patch', d)} \ 18 ${@bb.utils.contains('PACKAGECONFIG', 'tk', '', 'file://avoid_warning_about_tkinter.patch', d)} \
19 file://0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch \ 19 file://0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch \
20 file://0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch \ 20 file://0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch \
21 file://0001-bpo-36852-proper-detection-of-mips-architecture-for-.patch \
22 file://crosspythonpath.patch \ 21 file://crosspythonpath.patch \
23 file://0001-test_locale.py-correct-the-test-output-format.patch \ 22 file://0001-test_locale.py-correct-the-test-output-format.patch \
24 file://0017-setup.py-do-not-report-missing-dependencies-for-disa.patch \ 23 file://0017-setup.py-do-not-report-missing-dependencies-for-disa.patch \
@@ -32,8 +31,6 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
32 file://0001-setup.py-Do-not-detect-multiarch-paths-when-cross-co.patch \ 31 file://0001-setup.py-Do-not-detect-multiarch-paths-when-cross-co.patch \
33 file://deterministic_imports.patch \ 32 file://deterministic_imports.patch \
34 file://0001-Avoid-shebang-overflow-on-python-config.py.patch \ 33 file://0001-Avoid-shebang-overflow-on-python-config.py.patch \
35 file://cve-2022-37460.patch \
36 file://0001-test_marshal.py-add-more-elements-in-test_determinis.patch \
37 " 34 "
38 35
39SRC_URI:append:class-native = " \ 36SRC_URI:append:class-native = " \
@@ -41,7 +38,7 @@ SRC_URI:append:class-native = " \
41 file://12-distutils-prefix-is-inside-staging-area.patch \ 38 file://12-distutils-prefix-is-inside-staging-area.patch \
42 file://0001-Don-t-search-system-for-headers-libraries.patch \ 39 file://0001-Don-t-search-system-for-headers-libraries.patch \
43 " 40 "
44SRC_URI[sha256sum] = "a57dc82d77358617ba65b9841cee1e3b441f386c3789ddc0676eca077f2951c3" 41SRC_URI[sha256sum] = "85879192f2cffd56cb16c092905949ebf3e5e394b7f764723529637901dfb58f"
45 42
46# exclude pre-releases for both python 2.x and 3.x 43# exclude pre-releases for both python 2.x and 3.x
47UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar" 44UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-06-01 08:08:11 +0000