All Python ports: Address abort() for ctypes import on FreeBSD/ARM The current FreeBSD/ARM __clear_cache() implementation does nothing #if __i386__ || __x86_64__ #else abort(); cognet@ advises this is an issue for anything !Apple that is using the libcompiler_rt provided by Clang on ARM, and requires upstreaming. This is the root cause of abort() on import for the ctypes module in Python, as they bundle libffi. [1] This change patches the bundled libffi library in all Python ports, even though it is a NOOP for the ports that use devel/libffi. These ports, currently python31, will get the fix via ports/184517 A huge shout out to cognet@ who helped diagnose the issue and created the patch to address it. Thank you! PR: ports/149167 [1] PR: ports/184517 Submitted by: cognet [3] Reviewed by: cognet, eadler, milki, akd536d1d88b
Port details
lang/python272.7.18_5
Interpreted object-oriented programming language
- Maintainer
- python@FreeBSD.org
- Packages
- python27 2.7.18_5
- Upstream
- Higher version available: 3.15.1
- CPE
python:pythonfrom the port- WWW
- https://www.python.org/
- Links
- cgit · VuXML
Unaddressed (33) · The CVE record lists this version as affected, no VuXML entry names the CVE
Updating to 3.13.14 would fix 27 of 33 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 3.9.21 15 · 3.10.0 16 · 3.10.20 17 · 3.10.21 19 · 3.13.10 21 · 3.13.11 22 · 3.13.13 25 · 3.13.14 27
| CVE-2022-48565 | 9.8 | 2023-08-22 | An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vuln… |
| CVE-2007-4559 | 9.8 | 2007-08-28 | Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbi… |
| CVE-2017-17522 | 8.8 | 2017-12-14 | Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote … |
| CVE-2026-15308 | 8.7 | 2026-07-09 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. |
| CVE-2024-6232 | 7.5 | 2024-09-03 | There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulner… |
| CVE-2024-7592 | 7.5 | 2024-08-19 | There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for q… |
| CVE-2022-48560 | 7.5 | 2023-08-22 | A use-after-free exists in Python through 3.9 via heappushpop in heapq. |
| CVE-2023-36632 | 7.5 | 2023-06-25 | The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python o… |
| CVE-2023-24329 | 7.5 | 2023-02-17 | An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. |
| CVE-2022-45061 | 7.5 | 2022-11-09 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such t… |
| CVE-2022-0391 | 7.5 | 2022-02-09 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involv… |
| CVE-2026-4519 | 7.0 | 2026-03-20 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading … |
| CVE-2022-48564 | 6.5 | 2023-08-22 | read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files i… |
| CVE-2021-3733 | 6.5 | 2022-03-10 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could … |
| CVE-2017-18207 | 6.5 | 2018-03-01 | The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of servic… |
| CVE-2026-7210 | 6.3 | 2026-05-11 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding… |
| CVE-2025-12781 | 6.3 | 2026-01-21 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardl… |
| CVE-2025-12084 | 6.3 | 2025-12-03 | When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability ca… |
| CVE-2025-13836 | 6.3 | 2025-12-01 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause … |
| CVE-2026-3087 | 6.0 | 2026-04-27 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target di… |
| CVE-2026-4224 | 6.0 | 2026-03-16 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. |
| CVE-2026-3644 | 6.0 | 2026-03-16 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patc… |
| CVE-2022-48566 | 5.9 | 2023-08-22 | An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac… |
| CVE-2021-23336 | 5.9 | 2021-02-15 | The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache P… |
| CVE-2024-9287 | 5.3 | 2024-10-22 | A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the … |
Show all 33
| CVE-2023-40217 | 5.3 | 2023-08-25 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers… |
| CVE-2023-27043 | 5.3 | 2023-04-19 | The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as t… |
| CVE-2026-0864 | 4.1 | 2026-06-23 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be inje… |
| CVE-2026-6019 | 2.1 | 2026-04-22 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive seq… |
| CVE-2025-13837 | 2.1 | 2025-12-01 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues |
| CVE-2026-4360 | 2.0 | 2026-06-30 | In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar fil… |
| CVE-2025-13462 | 2.0 | 2026-03-12 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE… |
| CVE-2025-6075 | 1.8 | 2025-10-31 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. |
VuXML only (0) · listed, port not fixed yet
None.
pkg audit reports nothing for this version.Fixed (10)
Show 10 fixed
VuXML entries whose affected range this version has left.
Python -- Regular Expression DoS attack against cliententered 2020-04-23
Python -- NULL pointer dereference vulnerabilityentered 2019-03-26
python 2.7 -- multiple vulnerabilitiesentered 2018-05-05
CVE-2012-0876, CVE-2016-0718, CVE-2016-4472, CVE-2016-9063, CVE-2017-9233, CVE-2018-1060, CVE-2018-1061
Python 2.7 -- multiple vulnerabilitiesentered 2017-10-11
CVE-2012-0876, CVE-2016-0718, CVE-2016-4472, CVE-2016-5300, CVE-2016-9063, CVE-2017-9233
Python -- smtplib StartTLS stripping vulnerabilityentered 2016-07-03
Python -- HTTP Header Injection in Python urllibentered 2016-06-30
Python -- Integer overflow in zipimport moduleentered 2016-06-17
Python -- buffer overflow in socket.recvfrom_into()entered 2014-03-01
Python -- DoS via malformed XML-RPC / HTTP POST requestentered 2012-02-14
Commits (342)
lang/python27: Remove patch-configure, its now a NOOP lang/python26, lang/python27 and lang/python31 now add ac_cv_opt_olimit_ok=no to CONFIGURE_ENV to disable functionality that was removed in Python 3.2+ [1] Pending a backport of the commit [2] to 2.7, we can now remove the locally maintained patch to configure that disabled the functionality when CC = clang. Apart from being narrower in scope than ac_cv_opt_olimit_ok=no, the patch doesn't work for FreeBSD versions where clang *is* cc (eg: 10.0+) [1] http://hg.python.org/lookup/r85656 [2] http://bugs.python.org/issue877121 Reviewed by: antoinea8610b8d32
lang/python27: Update to 2.7.6
- Update to 2.7.6
- Update pkg-plist
- Temporarily override OPT:Olimit using CONFIGURE_ENV (ports/182952) [1]
- Replace patch: extra-patch-configure-pth with CONFIGURE_ENV instead
- Remove patch: patch-Modules-_ctypes-libffi_fficonfig.py.in [2]
- QA: Clean up and group related USE_*, WRKSRC and CONFIGURE entries
- QA: Whitespace alignment
Changes: 2.7.6 - November 10, 2013
http://www.python.org/download/releases/2.7.6/
[1] Python removed OPT:Olimit in 3.2+, requested backport or
alternative upstream patch: http://bugs.python.org/issue877121
[2] Upstreamed: http://bugs.python.org/issue18178
PR: ports/182952
PR: ports/156759
Reviewed by: antoine, mva9c597eecc6lang/python27: fix patch for SEM option PR: ports/183884f451bf37d7
lang/python27: add support for freebsd11 PR: ports/183597 Submitted by: avillaf760a28ec7
Add NO_STAGE all over the place in preparation for the staging support (cat: lang)888ab73a81
Resolve gettext (libintl) detection and linking in all Python ports Fix gettext (NLS) detection, includes and linking: - all: Use LDFLAGS and CPPFLAGS over CFLAGS for NLS option (with comment) - python26,27: Pass LIBS="-lintl" to CONFIGURE_ENV Workaround Pythons odd build mechanics causing duplicate args: - all: Remove CFLAGS from OPT= in CONFIGURE_ENV - python32,33: Remove CONFIGURE_* variables from Makefile.pre.in Other: - python32: Patch setup.py to pass OPT correctly to shared modules PR: ports/181721 Reported by: pawel Reviewed by: bapt mva sbzec7259ec32
- Move the symlink magic for the default python version into lang/python and lang/python2 and lang/python3. This change brings us closer to the goal of making Python ports usable with different Python versions at the same time. - Add a new lang/python2 port to handle the symlinks for bin/python2, bin/idle2, bin/pydoc2 and so on. - Add a new lang/python3 port to handle the symlinks for bin/7452555915
- Remove MAKE_JOBS_SAFE variable Approved by: portmgr (bdrewery)d4041784dc
Correct syntax in kernel config is 'options' Submitted by: kevlo5ad157df04
Add patch that resolves the issue, found after r250991 in src HEAD. Investigation and the patch are from Marcel Moolenaar. I also added upstream bug-report, based on Marcel's info: http://bugs.python.org/issue18178 There also was relevant discussion on current@: http://lists.freebsd.org/pipermail/freebsd-current/2013-June/ Please see there for details of the issue. Submitted by: marcel (python@ ML) Reported by: manyb922bed77e
- update to latest upstream versions: . lang/python27: 2.7.3 -> 2.7.5 . lang/python32: 3.2.3 -> 3.2.4 . lang/python33: 3.3.0 -> 3.3.1 - update Mk/bsd.python.mk with new versions - mark lang/python26 and lang/python31 as deprecated (set them to upstream EoL dates) - update docs (lang/python-doc-html) - align databases/py-bsddb patch for python27 - most of it was applied upstream. Raise BD Many thanks to Martin (miwi) for his time on this update. PR: 178506 Submitted by: rm (myself) Exp-run by: portmgr (miwi) - revert erroneous threads patch in lang/python26 and lang/python27, that was added after ports/131080. It was rejected upstream, because it's not actually a bug, but misuse. Gabor Pali (pgj) in collaboration with Kubilay Kocak (koobs) did an independent investigation regard the issue. See here for details: http://lists.freebsd.org/pipermail/freebsd-python/2013-April/005376.html PR: 153167 Submitted by: Duncan Findlay <duncan@duncf.ca> Reported by: pgj/koobs (at python@ ML) Exp-run by: portmgr (miwi)11bf569497
Commit all the non-functional changes to python ports to reduce the diff size for an exp-run of updated python versions. - trim Makefile headers - remove leading indefinite article from COMMENT - use PYTHON shortcut in MASTER_SITES - whitespace fixes - remove checks for unsupported versions of FreeBSD - use static value ``33'' instead of PYTHON_SUFFIX in lang/python33/pkg-plist, because this value is not supposed to be changed across the branch and for consistency with other python3 ports - remove conflicts in lang/python-mode.el with not more existing python-2.4f831a5f25d
- adoption of USES for gettext Approved by: portmgr (bapt@)7cdc62b981
- Update devel/libffi to 3.0.11. - Reset maintainership for libffi. See ports/164941. PR: ports/171768 Submitted by: Takefu <takefu@airport.fm>57945c1ebe
- Fix the -OPT:Olimit=X detection for clang, which could pollute the output of python27-config --cflags PR: ports/172859 ports/161494 ports/174525 Submitted by: Oleg Nauman <oleg.nauman@gmail.com>996e4b60c3
- Remove "first-installed-win" logic for automatically setting ${PYTHON_DEFAULT_VERSION}, this generates conflicting packages.
- Create symbolic links as PEP 394 [1] suggests. ${PYTHON_DEFAULT_VERSION}
will create python and python${MAJOR_VERSION} links. In current default,
lang/python27 will create: python -> python2 -> python2.7
- Introduce ${PYTHON3_DEFAULT_VERSION}, which will handle bin/python3 link.
At this point, lang/python33 will create python3 -> python3.3
- Minor cleanups
* Trim Makefile headers
* Remove ${OSVERSION} detection for xz, whihc is done by USE_XZ
[1] http://www.python.org/dev/peps/pep-0394/6e2fa0573bCreate python2 symlink for the latest version of python2.X executable and python3 symlink for the latest version of python3.X executable. People who really want to use older python version for both python branches should specify explicit version number in interpreter invocation. Discussed on python@ long ago.10277be714
Don't try to tidy up user-created directories. Approved by: crees (python@)4e9d93dbac
- do not hardcode distfile extension for lang/python ports in bsd.python.mk (PYTHON_DISTFILE variable) - switch lang/python ports (and it's slaves) to tar.xz I compared all the four pairs .tgz/.tar.xz and they have no content differences. Discussed on: python@309da33d2f
- fix PORT_OPTIONS s/)/}/f1ddff4b92
- Fix Python OPT flags for WITH_PTH knob PR: ports/168767 Submitted by: Marcus von Appen <mva@freebsd.org>a9682d1571
- Fix builds, if the NLS option switch is set. In some cases expat-related modules are not built correctly. PR: ports/169276 Submitted by: Greg Byshenk <freebsd@byshenk.net>2f377af2d0
- Fix gettext detection for the locale module - Explicitly enable/disable gettext support via a new NLS OPTION switch. PR: ports/168684 ports/136917 On behalf of: python@b89f9ab26f
- unbreak WITH_PTH option support PR: ports/155936 Submitted by: Kalten <kalten@gmx.at> On behalf of: python@66adb13649
Fix permissions for Tools and Demo folders. PR: 152224 Submitted by: John Hein <jhein@symmetricom.com> Silence from: python@2b56d23731
- Revert back UCS changes58183419a8
- Correct PYMALLOC logic (that fix the build of devel/gobject-introspection) - Remove old OPTION layout from py32 - Bump PORTREVISON7e94fe3d3d
- Convert to new options framework Reviewed by: bapt8c2c328510
- Update: * python26 -> 2.6.8 * python27 -> 2.7.3 * python31 -> 3.1.5 * python32 -> 3.2.1 Security: http://www.vuxml.org/freebsd/b4f8be9e-56b2-11e1-9fb7-003067b2972c.html CVE-2012-0845 CVE-2012-0876 CVE-2012-1150 CVE-2012-0845 CVE-2011-338919425757a8
- Mark Python as Secure - Fix DoS via malformed XML-RPC / HTTP POST Submitted by: rm@ Reported by: many Obtained from: python hg Security: http://www.vuxml.org/freebsd/b4f8be9e-56b2-11e1-9fb7-003067b2972c.htmlc70027929c
- Remove WITH_FBSD10_FIX, is no longer needede1c6649edf
- Remove outdated patch to prune __wchar_t from CFLAGS (python-config --cflags) - Bump PORTREVISION for package change PR: ports/161564 Submitted by: Nali Toja <nalitoja@gmail.com>03ff71952d
- Replace pre-configure target with WITH_FBSD10_FIX as we have a fix in bsd.port.mk now. Approved by: miwi2fbda21282
Fix build on powerpc as is done on other python ports Submitted by: linimon Tested on: pointyhatce2f38ec49
Fix build on FreeBSD 10 Submitted by: beat Tested on: pointyhat i386-9-exp and i386-10d7364df969
- Remove the HUGE_STACK_SIZE option, now Python will use default thread stack size of the system.fc7b20b6d4
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS) - Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead
PR: 157936
Submitted by: myself
Exp-runs by: pav
Approved by: pav6f6fbe4bdfHandle built world without NIS more gracefully; detect missing ypcat and disable NIS module. PR: ports/115940 Submitted by: Alex Deiter <tiamat@komi.mts.ru> Reviewed by: bfd03cd9afc5
- Fix pkg-plist when building with WITHOUT_THREADS PR: ports/159842 Submitted by: Ruslan Mahmatkhanov <cvs-src@yandex.ru>80b804c403
- Clarify error message PR: ports/158812 Submitted by: Warren Block <wblock@wonkity.com> Reviewed by: lwhsu With Hat: pythone35f6b3ffb
- Remove patch-Makefile.pre.in, now build with pthread correctly, bump PORTREVISION Reported by: rhurlin@gwdg.de (via email)d08126833f
- Update to 2.7.2 - Mark BROKEN when build with pth Reviewed by: miwi@d3a995e088
Enable build on powerpc64. Tested on i386, no regression. PR: ports/155310 Submitted by: andreast Approved by: lwhsu (python team)674f8a50d0
- Fix the run error when build c extensions PR: ports/152671 Submitted by: Milos Negovanovic <milos.negovanovic@gmail.com>8ce9760c30
- Update to 2.7.191993cc40d
- Fix build to create _curses module correctly. Submitted by: olli@lurza.secnetix.de (via Email)40d7ee37de
- Introduce Python 2.7.0 Original work by: wen61b31f74b4
- Update lang/python26 to 2.6.5 - Update lang/python31 to 3.1.2 Reviewed by: miwi@, lwhsu@25e48ae956
- Update to 2.6.4 Changelog: http://python.org/download/releases/2.6.4/NEWS.txt492dce90c8