lang/python312: update to 3.12.15 Changelog: https://docs.python.org/3.12/whatsnew/changelog.html#python-3-12-15-final7df10fcb23
Port details
lang/python3123.12.15
Interpreted object-oriented programming language
- Maintainer
- python@FreeBSD.org
- Packages
- python312 3.12.15
- Upstream
- up to date
- CPE
python:pythonfrom the port- WWW
- https://www.python.org/
- Links
- cgit · VuXML
Unaddressed (7) · The CVE record lists this version as affected, no VuXML entry names the CVE
Updating to 3.13.14 would fix 6 of 7 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 3.13.10 2 · 3.13.13 4 · 3.13.14 6
| CVE-2026-7210 | 6.3 | 2026-05-11 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding… |
| CVE-2025-12781 | 6.3 | 2026-01-21 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardl… |
| CVE-2026-3087 | 6.0 | 2026-04-27 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target di… |
| CVE-2026-3644 | 6.0 | 2026-03-16 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patc… |
| CVE-2026-6019 | 2.1 | 2026-04-22 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive seq… |
| CVE-2025-13837 | 2.1 | 2025-12-01 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues |
| CVE-2025-13462 | 2.0 | 2026-03-12 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE… |
VuXML only (2) · listed, port not fixed yet
Fixed (10)
Show 10 fixed
VuXML entries whose affected range this version has left, plus CVEs whose record still lists this version although VuXML considers them fixed (usually a backported fix).
| CVE-2026-4519 | 7.0 | 2026-03-20 | VuXML · The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading … |
| CVE-2025-12084 | 6.3 | 2025-12-03 | VuXML · When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability ca… |
python -- more webbrowser.open() command injection vulnerabilitiesentered 2026-04-13
Python -- HTTP proxy CONNECT tunnel does not sanitize CR/LFentered 2026-04-12
Python -- configparser vulnerable to excessive CPU useentered 2026-04-12
no CVE referenced
Python -- The webbrowser.open() API allows leading dashesentered 2026-04-01
python -- several security vulnerabilitiesentered 2026-02-04
python -- several vulnerabilitiesentered 2025-12-08
cpython -- Use-after-free in "unicode_escape" decoder with error handlerentered 2025-05-24
Commits (28)
lang/python312: use upstream commits for divert(4) fix Backport of: https://github.com/python/cpython/pull/142993 https://github.com/python/cpython/pull/143514 PR: 298106116481e77a
lang/python312: fix recvfrom() and sendto() on divert(4) socket This is backport of upstream 05406b221dc that will be available in 3.13.4d84480d7a
lang/python312: update to 3.12.14 Changelog: https://docs.python.org/release/3.12.14/whatsnew/changelog.htmlfa8b2dac79
lang/python312: pull in upstream commits addressing vuxml entries Security: 5ec4dcf6-3588-11f1-b51c-6dd25bec137b Security: b8e9f33c-375d-11f1-a119-e36228bfe7d4 Security: cf75f572-378a-11f1-a119-e36228bfe7d401e6147ab5
lang/python312: pull in upstream commit addressing vuxml entry Security: 30bda1c3-369b-11f1-b51c-6dd25bec137b Event: BSDCan 2026825b436eb1
lang/python3: use textproc/expat2 for pyexpat instead of bundled ...to match lang/python314 Event: Works Must Runb75df1fb4d
lang/python31{0,1,2}: reroll PATCHFILES after repository growth
Each commit checksum now shows one additional character, but the
diff contents are identical.
PR: 2955954b4b105e82lang/python312: pull in upstream commits addressing webbrowser.open() issue Security: 9fdad262-2e0f-11f1-88c7-00a098b42aebd1ce8f060d
devel/libtextstyle, devel/gettext*: Update to 1.0 devel/gettext-tools: Use external libunistring and libxml2. lang/python*: Remove dependency on gettext-tools. It isn't used and it is gettext-tools that depends on python now. PR: 293963 Exp-run by: antoined7a065627c
lang/python312: update to 3.12.13 Changelog: https://docs.python.org/release/3.12.13/whatsnew/changelog.html#python-3-12-13470e01d147
lang/python312: pull in upstream commits addressing vuxml entries Security: bfe9adc8-0224-11f1-8790-c5fb948922ad6ffe928349
lang/python3{12,13}: limit parallel .pyc compilation to MAKE_JOBS
This option is available since python312[0]. This fixes
python312 and python313 builds with qemu-user-static
emulating riscv64.
[0] https://github.com/python/cpython/commit/9a7e9f9921804f3f90151ca42703e612697dd430
Approved by: vishwin (#python), lwhsu (mentor)
Signed-off-by: Siva Mahadevan <siva@FreeBSD.org>
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D54906c4faf46ff4lang/python312: pull in upstream commits addressing vuxml entries Security: 613d0f9e-d477-11f0-9e85-03ddfea11990 PR: 291609efc17c651b
Revert "Reapply "lang/python31[012]: deprecate 2026-03-31"" This reverts commit a132acab8736bad2fa59e941d5d77da4ea7688a0. This commit is disrespectful for people trying to make the ports tree work with version 3.12 With hat: pkgmgrac6809aadf
Reapply "lang/python31[012]: deprecate 2026-03-31" This reverts commit 666108a04abc08a18791425f967b26357dd4d96d.a132acab87
Revert "lang/python31[012]: deprecate 2026-03-31" The latest 3.12 release contains the referenced security fixes. The other two branches are not EOL. PR: 291609 With hat: python Requested by: antoine This reverts commit 66173037774d8648a59e30b424692ae80dbc20b3.666108a04a
lang/python31[012]: deprecate 2026-03-31 Since the current Python upstream maintainers have not yet released security fix releases to match 3.14.2 and 3.13.11, meaning that we have about three unfixed security issues per 3.12/3.11/3.10 release, and the current FreeBSD python@ team is unwilling to take approved upstream patches individually (see PR), we need to expedite the removal of vulnerable versions and the transition to 3.13/3.14. Deprecate all "security support" releases of Python that are not in the bugfix phase. PR: 2916096617303777
lang/python312: Fix pkg-plist when build with DEBUG optionf06f9baf8f
lang/python312: Update to 3.12.12c7a8e0562b
lang/python31{1,2}: enable LTO on powerpc64le
The crash doesn't happen anymoree787c6603f*: Update comment references to e2fsprogs-libuuid to libuuid. PR: 251489169ac0b938
python.mk: rename PYTHON_EXT_SUFFIX to PYTHON_TAG, document, etc EXT_SUFFIX, according to PEP 3149, refers to the full tag and extension for compiled extension module objects, eg .cpython-311.so, .cpython-313t.so, etc. We do not use the correct semantic meaning, and this usage becomes ambiguous and confusing when tags do not match between bytecode and compiled extension module objects. Rename our PYTHON_EXT_SUFFIX to PYTHON_TAG to align with PEP 3147's specification of a magic tag, which consists of implementation name and shorthand version only. This is meant for bytecode and other files containing this tag in their filename that do not depend on a specific Python ABI for the same version. Chase all existing consumers. Introduce PYTHON_SOABI to align with PEP 3149's specification of a tag, which consists of implementation name, shorthand version and any ABI flags present (this and PYTHON_TAG are identical without ABI flags). This is meant for compiled extension module objects and other files that depend on a specific Python ABI for the same version. Add documentation for these variables that our PYTHON_EXT_SUFFIX never had. PR: 274671 Event: Kitchener-Waterloo Hackathon 2025064f0eba1efd
lang/python312: fix plist with DEBUG enabled While here, use %%PYTHON_INCLUDEDIR%% fully Event: FreeBSD Developer Summit June 2025 Event: BSDCan 2025c5eb0ed77f
lang/python312: Update to 3.12.11b340ca5a9a
lang/python312: pull in upstream commit addressing CVE-2025-4516 Reference: https://github.com/python/cpython/pull/134337 PR: 287009feea6ed68d
lang/python312: Update to 3.12.1030653d5002
lang/python312: add 3.12.9 What's new: https://docs.python.org/3/whatsnew/3.12.html PR: 271673 Co-authored-by: vishwin Differential Revision: https://reviews.freebsd.org/D49679deb31699f1