An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.
Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the d…
The incremental HTML parser (html.parser.HTMLParser) allows for CPU
denial-of-service through repeated unterminated markup declarations when
processing uncontrolled data.
There is a MEDIUM severity vulnerability affecting CPython.
Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module.
When parsing cookies that contained backslashes for quoted characters in
the cookie value, the parser would use an algorithm with quadratic
complexity, resulting in excess CPU resources being used while parsing the
value.
The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.par…
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malic…
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks…
Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point."
The webbrowser.open() API would accept leading dashes in the URL which
could be handled as command line options for certain web browsers. New
behavior rejects leading dashes. Users are recommended to sanitize URLs
prior to passing to webbrowser.open().
In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repai…
read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that th…
The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of except…
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier bas…
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
When an Expat parser with a registered ElementDeclHandler parses an inline
document type definition containing a deeply nested content model a C stack
overflow occurs.
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cau…
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands wh…
An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket in…
The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific dom…
When using the "configparser" module to write configuration files
containing multi-line text values with carriage return characters (\r) the
resulting file could be injected with unexpected keys and values if the
attacker controls the written value.
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
all: drop support for FreeBSD 13, mips and risc64sf
Reviewed by: many (*)
Differential Revision: https://reviews.freebsd.org/D55624
Differential Revision: https://reviews.freebsd.org/D55642 (merged in from bofh)
many (*)
acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga
jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka
nobutaka pkubaj se tagattie thj
Anton Saietskii
GenericRikka
Gert Doering
Jan Bramkamp
Oleh Hushchenkov
Oleksandr Kryvulia
Ralf van der Enden
Yamagi
desktop kde python tcltk office
devel/libtextstyle, devel/gettext*: Update to 1.0
devel/gettext-tools: Use external libunistring and libxml2.
lang/python*: Remove dependency on gettext-tools. It isn't used and
it is gettext-tools that depends on python now.
PR: 293963
Exp-run by: antoine
lang/python27: re-add _tkinter into the distribution
x11-toolkits/py-tkinter is otherwise built separately, ie disabled
in the main Python distribution build, due to circular (build)
dependencies with Python itself in lang/tk*. Since this Python
version is never default anymore, having been EOLed for years among
other things, it is safe to re-add _tkinter as part of the main
distribution build. Also update pkg-message to reflect extension
module ports unavailability.
This is to benefit the only remaining consumer, games/renpy, as
x11-toolkits/py-tkinter transitions to Python 3+ only. The relevant
OPTION has been removed as having _tkinter always present makes the
option a no-op.
PR: 268283
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree
- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
Also move conditional flags for non sparc64/arm ARCH to fixed flags.
Reviewed by: brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
lang/python27: Fix build with OpenSSL 3
This was fixed in an earlier commit but an arbitrary OSVERSION was used
to check the side effects in exp-run. As there is a proper OSVERSION now
this patch fixes the OSVERSION.
Approved by: portmgr (blanket)
Sponsored by: The FreeBSD Foundation
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
Mk: switch from PYTHON_PORTVERSION to PYTHON_DISTVERSION
This brings python framework in consistense with handbook recommendations
to prefer DISTVERSION and simplifies adding prerelease versions of
python
PR: 255013
Differential Revision: https://reviews.freebsd.org/D29418
Exp-run by: antoine
Approved by: wen@, no objection from python@ or portmgr@
Chanse update of devel/libffi
Chase the devel/libffi update
Bump portrevision of all dependent ports to chace shard library version bump
in libffi.
Update LIB_DEPENDS lines where needed to not require a specific version of
libffi.so.
PR: 247028 (for tracking)
lang/python{27,35,36,37,38}: Add closefrom(2) support
A single close(fd) syscall is cheap, but when MAXFDS (maximum file
descriptor number) is high, the loop calling close(fd) on each file
descriptor can take several milliseconds.
The default value of subprocess.Popen "close_fds" parameter changed to True
in Python 3. Compared to Python 2, close_fds=True can make Popen 10x
slower: see bpo-37790 [1]
The present workaround on FreeBSD to improve performance is to load and
mount the fdescfs kernel module, but this is not enabled by default.
This change adds minimum viable (and upstreamable) closefrom(2) syscall
support to Python's subprocess and posix modules, improving performance
significantly for loads that involve working with many processes, such as
diffoscope, ansible, and many others.
For additional optimizations, upstream recently (3.8) landed posix_spawn(2)
support [3] and has stated that they will adopt close_range(2) after Linux
merges it [4]. Linux/FreeBSD developers are already collaborating on
ensuring compatible implementations, with FreeBSD's implementation pending
in D21627. [5]
Thank you emaste, cem, kevans for providing analysis, input,
clarifications, comms/upstream support and patches.
[1] https://bugs.python.org/issue37790
[2] https://bugs.python.org/issue38061
[3] https://bugs.python.org/issue35537
[4] https://lwn.net/Articles/789023/
[5] https://reviews.freebsd.org/D21627
Additional References:
https://bugs.python.org/issue8052
https://bugs.python.org/issue11284
https://bugs.python.org/issue13788
https://bugs.python.org/issue1663329
https://www.python.org/dev/peps/pep-0446/
PR: 242274, 221700
Submitted by: kevans (emaste, cem)
Approved by: koobs (python (maintainer), santa)
In various places in the ports tree, tests against ARCH are iterated one-by-one when a pattern test would be more robust.
This consolidates the tests for 64-bit functionality.
PR: 239163
Approved by: sunpoet (python, maintainer)
Update devel/readline to 8.0
- Bump PORTREVISION of dependent ports for shlib change
Changes: https://tiswww.case.edu/php/chet/readline/CHANGES
PR: 236156
Exp-run by: antoine
Remove compatibility code for FreeBSD < 11.2 from all ports.
Simplify some ports where DragonFlyBSD no longer needs to be special-cased.
Submitted by: rene
Reviewed by: bapt, jbeich
Differential Revision: https://reviews.freebsd.org/D17724
lang/python27,35+: Remove MAKE_JOBS_UNSAFE
ports r393217 via bug 200622 [1] originally set MAKE_JOBS_UNSAFE=yes due to
incorrect uses of recursive make [2], causing intermittent build failures when
run with multiple jobs (-jN).
Upstream committed a fix for the issue in default (3.6, at the time), 3.5 and
2.7 which are now contained in all released lang/python?? port versions. 3.4 did
not receieve a backport merge.
lang/python3.5+ ports inadvertently inherited MAKE_JOBS_UNSAFE=yes, via
repocopies from lang/python34 on their creation, when they were infact safe to
use with -j.
Remove MAKE_JOBS_UNSAFE in all lang/python?? ports except python34 accordingly.
[1] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=200622
[2] https://bugs.python.org/issue22359
PR: 232308
Reported by: cem
Reviewed by: cem
Approved by: koobs (python)
MFH: 2018Q4
Differential Revision: D17579
lang/python27: Fix build regression
r462630 added OpenSSL include/library paths to CFLAGS/LIBS which caused
the _elementtree and pyexpat modules to fail to build. Adding paths to CFLAGS
is known to cause issues [1].
Accordingly:
- Switch to using CPPFLAGS for OpenSSL include/library paths (like NLS).
- Move the comment describing why this is necessary to the top of the port
with reasonable warning about what can happen and why.
[1] https://svnweb.freebsd.org/ports?view=revision&revision=326729
PR: 226135, 222795)
Reported by: many
Reviewed by: sunpoet (python)
Approved by: koobs (python)
Set PORTNAME to python and add PKGNAMESUFFIX
- Sort USES
- Remove CPE_*: all of them are default values
- Update http:// links in Makefile comments and patch files
Add a code block for the qemu-user enabled cross build environment. When using this environment in poudriere, CC is not set to the default of /usr/bin/cc and a cross-compile toolchain is used. We need to hand edit this so that the run time configuration for python matches what the FreeBSD base system provides.
PR: 208282
Submitted by: manu
Approved by: portmgr (mat)
lang/python{27,33,34,35,36}: Make Python curses module work with Unicode
Use readline from ports (USES= readline:port) and patch
setup.py to ignore readline from base. The patch is necessary for
FreeBSD < 1100000, as after this the readline library became an
INTERNALLIB, see base r268461 [1]
Link devel/readline against termcapw instead of termcap is part of
this change, see ports r444463 [2]
Note that this is the **ports** approach for getting Python curses
module working with Unicode. The other way is splitting libncurses
into separate libncurses and libtinfo in base, for which an open
issue exists [3].
Apart from Python language ports, at least www/rtv and
sysutils/py-ranger ports have been tested to work correctly
(display Unicode) after this change.
[1] https://svnweb.freebsd.org/changeset/base/268461
[2] https://svnweb.freebsd.org/changeset/ports/444463
[3] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=197317
PR: 171246, 197317
Reported by: Vitaly Magerya <vmagerya gmail com>
Reviewed by: garga, koobs, miwi, sunpoet
Approved by: garga (mentor), sunpoet (python, with hat)
Differential Revision: https://reviews.freebsd.org/D11127
lang/python{27,33,34,35,36}: Install GDB debugging script
Users with a GDB that supports [1] Python extensions will automatically
load the extra debugging extensions when debugging programs that are
linked with libpythonX.Y.so.foo.
This enables extensions like 'py-bt' and 'py-frame' as described in
the Fedora Wiki Article: Easier Python Debugging [2], which can be
useful for debugging Python program state from crashes in C extensions,
for example.
[1] PYTHON option enabled in devel/gdb
[2] https://fedoraproject.org/wiki/Features/EasierPythonDebugging
PR: 203021
Submitted by: cem
Reviewed by: mat, koobs (python)
Approved by: koobs (python)
Differential Revision: D10398
- Remove SEM option by making it always avalible
Since FreeBSD 8.x EOL in 2015-08-01 the option doesn't have any value beyond
footshooting[1]. sem_open() and sem_init(pshared=1) always work FreeBSD 9.0
or later after base r201546.
[1] https://lists.freebsd.org/pipermail/freebsd-ports/2017-April/108116.html
PR: 218641
Reported by: jbeich
Exp-run: antoine
MFH: 2017Q2
Differential Revision: https://reviews.freebsd.org/D10446