Repository navigation

3.9.25.1: all upstream security fixes since 3.9.25 + eMudhra ssl distrust, ensurepip pip 26.0.1.post1 - #88

Merged

icanhasmath merged 80 commits into

3.9.25.xfrom

3.9.25.1-security

Oct 28, 2026

Merged

3.9.25.1: all upstream security fixes since 3.9.25 + eMudhra ssl distrust, ensurepip pip 26.0.1.post1#88
icanhasmath merged 80 commits into
3.9.25.xfrom
3.9.25.1-security

Commits on Oct 27, 2026
- [3.10] gh-143916: Reject control characters in wsgiref.headers.Headers
  
  authored and
  icanhasmath
  committed
  cb85e6e
- [3.10] gh-143925: Reject control characters in data: URL mediatypes (#144115)
  
  sethmlarson
  authored and
  icanhasmath
  committed
  39aa82a
- [3.10] gh-143919: Reject control characters in http cookies (#144094)
  
  authored and
  icanhasmath
  committed
  ab10995
- [3.10] gh-144125: email: verify headers are sound in BytesGenerator (#144180)
  
  authored and
  icanhasmath
  committed
  b052613
- [3.10] gh-119452: Fix a potential virtual memory allocation denial of service in http.server (GH-142216) (#142299)
  
  authored and
  icanhasmath
  committed
  16d68aa
- [3.10] gh-142145: Remove quadratic behavior in node ID cache clearing (GH-142146) (#142213)
  
  authored and
  icanhasmath
  committed
  4af6ac6
- [3.10] gh-119451: Fix a potential denial of service in http.client (GH-119454) (#142142)
  
  authored and
  icanhasmath
  committed
  d0bd801
- [3.10] gh-74453: Add stronger security warning to os.path.commonprefix
  
  authored and
  icanhasmath
  committed
  085d85f
- [3.10] gh-144484: Warn users not to use wsgiref in production
  
  authored and
  icanhasmath
  committed
  1229f55
- [3.10] gh-119342: Fix a potential denial of service in plistlib (GH-119343) (#142151)
  
  serhiy-storchaka
  authored and
  icanhasmath
  committed
  9b8fefb
- [3.10] gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843) (#144862)
  
  authored and
  icanhasmath
  committed
  72b2646
- [3.10] gh-143916: Allow HTAB in wsgiref header values (#145140)
  
  authored and
  icanhasmath
  committed
  530073a
- [3.10] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (#144515)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  bbeffdf
- [3.10] gh-143935: Email preserve parens when folding comments (GH-143936) (#144350)
  
  authored and
  icanhasmath
  committed
  1aa4421
- [3.10] gh-143930: Reject leading dashes in webbrowser URLs (GH-143931) (GH-146359)
  
  authored and
  icanhasmath
  committed
  1b02d47
- [3.10] gh-143930: Tweak the exception message and increase test coverage (GH-146476) (GH-148045) (GH-148051) (GH-148053)
  
  authored and
  icanhasmath
  committed
  0ce8343
- [3.10] gh-137586: Open external osascript program with absolute path (GH-137584) (#148177)
  
  authored and
  icanhasmath
  committed
  b4dfdd8
- [3.10] gh-146083: Upgrade bundled Expat to 2.7.5 (GH-146085) (#146608)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  266640f
- [3.10] gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) (GH-145987) (#146002)
  
  authored and
  icanhasmath
  committed
  af2c6c5
- [3.10] gh-148169: Fix webbrowser `%action` substitution bypass of dash-prefix check (GH-148170) (#148521)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  a8ff95c
- [3.10] gh-148395: Fix a possible UAF in `{LZMA,BZ2}Decompressor` (GH-148396) (#148505)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  c8d2f0f
- [3.10] gh-145506: Fixes CVE-2026-2297 by ensuring SourcelessFileLoader uses io.open_code (GH-145507) (#145516)
  
  authored and
  icanhasmath
  committed
  2e2b37c
- [3.10] gh-141707: Skip TarInfo DIRTYPE normalization during GNU long name handling (#145816)
  
  authored and
  icanhasmath
  committed
  207f2a4
- [3.10] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (#144371) (#145673)
  
  vstinner
  authored and
  icanhasmath
  committed
  797bc58
- [3.10] gh-151981: Make tarfile._Stream.seek break at EOF (GH-151982) (#151996)
  
  authored and
  icanhasmath
  committed
  016157f
- [3.10] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) (#149797)
  
  authored and
  icanhasmath
  committed
  04e5bc8
- [3.10] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146… (#148350)
  
  authored and
  icanhasmath
  committed
  18fd839
- [3.10] gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (#145600) (#146027)
  
  authored and
  icanhasmath
  committed
  393784b
- [3.10] gh-150743: Limit trailer lines and interim responses read by http.client (GH-150749) (#152529)
  
  miss-islington
  authored and
  icanhasmath
  committed
  4efce7e
- [3.10] gh-150599: Prevent bz2 decompressor reuse after errors (#150600) (#151133)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  424c1e3
- [3.10] gh-149486: tarfile.data_filter: validate written link target (GH-149487) (#153180)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  fa57774
- [3.10] gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988) (#152613)
  
  authored and
  icanhasmath
  committed
  7324f7b
- [3.10] gh-153438: Update NuGet download URL (GH-153482) (GH-153515) (#153610)
  
  authored and
  icanhasmath
  committed
  140af36
- [3.10] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591) (GH-149071) (#155440)
  
  authored and
  icanhasmath
  committed
  5c5fac3
- [3.10] gh-100372: Use BIO_eof to detect EOF for SSL_FILETYPE_ASN1 (GH-100373) (#153312)
  
  authored and
  icanhasmath
  committed
  d76d4f3
- [3.10] gh-149017: Upgrade bundled Expat to 2.8.0 (#149020) (#149075)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  9a0f5a6
- [3.10] gh-149776: Skip UDP Lite tests if it's not supported (#149777) (#153594)
  
  vstinner
  authored and
  icanhasmath
  committed
  f43369a
- [3.10] gh-149079: Fix O(n^2) canonical ordering in unicodedata.normalize() (GH-149080) (GH-150843) (#155159)
  
  authored and
  icanhasmath
  committed
  81a27a9
- [3.10] gh-109638: Fix exponential time in csv.Sniffer for doubled quotes (GH-154868) (GH-155113) (#155116)
  
  authored and
  icanhasmath
  committed
  11c739e
- [3.10] gh-152674: Avoid quadratic behavior in xml.etree.ElementPath index predicates (GH-152676) (#154814)
  
  authored and
  icanhasmath
  committed
  31c0075
- [3.10] gh-153030: Fix quadratic complexity in incremental parsing in HTMLParser (GH-153031) (#153043)
  
  authored and
  icanhasmath
  committed
  59ac1ca
- [3.10] gh-151558: Fix symlink escape via `tarfile` hardlink-extraction fallback (GH-151559) (#152080)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  afabbd2
- [3.10] gh-146333: Fix quadratic regex backtracking in configparser option parsing (GH-146399) (GH-148559) (#154878)
  
  authored and
  icanhasmath
  committed
  1a6c57f
- [3.10] gh-143927: Normalize all line endings (CR, CRLF, and LF) in configparser (GH-143929) (#152007)
  
  authored and
  icanhasmath
  committed
  4202bdf
- [3.10] gh-98820: Fix quadratic time in csv.Sniffer for quoted fields (GH-154867) (#155539)
  
  serhiy-storchaka
  authored and
  icanhasmath
  committed
  dd92d43
- [3.10] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (#155551)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  53de65e
- [3.10] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (#155577)
  
  authored and
  icanhasmath
  committed
  bba6648
- [3.10] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree` when possible (GH-149023) (#155611)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  33218ba
- [3.10] gh-155558: Update bundled Expat to 2.8.3 (GH-155560) (#155618)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  4b39da7
- [3.10] gh-145548: Use VMADDR_CID_LOCAL in VSOCK socket tests (GH-145589) (GH-145809) (#148617)
  
  authored and
  icanhasmath
  committed
  2dea9d8
- [3.10] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) (#156787)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  d4d36ff
- [3.10] gh-157190: Fix tarfile `data`/`tar` filter bypass via hard link to a symlink (GH-157191) (#158457)
  
  freakboy3742
  authored and
  icanhasmath
  committed
  e12471f
- [3.10] gh-155694: Scope HTTPPasswordMgr credentials by URL scheme (GH-155696) (#155973)
  
  authored and
  icanhasmath
  committed
  a202954
- [3.10] gh-156293: Use-after-free for server-side SSLContext with sni_callback (GH-158504) (#158524)
  
  gpshead
  authored and
  icanhasmath
  committed
  ab74e9e
- [3.10] gh-158446: Reject float format precision near INT_MAX (GH-158474) (#158482)
  
  gpshead
  authored and
  icanhasmath
  committed
  a57751b
- [3.10] gh-157953: Update bundled Expat to 2.8.5 (GH-157957) (#158327)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  bc08e44
- [3.10] gh-155292: Don't consider Unicode codepoint attributes outside RFC 3454 (GH-155293) (GH-156020) (#156932)
  
  authored and
  icanhasmath
  committed
  d0f7216
- [3.10] gh-156353: Fix configparser space delimiter parsing (GH-156382) (#156562)
  
  authored and
  icanhasmath
  committed
  48a763a
- [3.10] gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266) (#157304)
  
  authored and
  icanhasmath
  committed
  078087f
- [3.10] gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard (GH-156003) (GH-156362) (#156741)
  
  authored and
  icanhasmath
  committed
  9aecf9a
- [3.10] gh-155999: `tarfile`: handle a member that leaves the destination but comes back (GH-156000) (#156046)
  
  authored and
  icanhasmath
  committed
  d322062
- [3.10] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap_socket() (GH-158503) (#158533)
  
  authored and
  icanhasmath
  committed
  cdbacb7
- [3.11] gh-87720 Fix additional header refolding-quoting edge case (GH-134271) (#159065)
  
  authored and
  icanhasmath
  committed
  c00553d
- [3.11] gh-159428: Don't read mimetypes.knownfiles by default on Windows (GH-159445) (#159573)
  
  cjames23
  authored and
  icanhasmath
  committed
  954fe5b
- [3.11] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) (#160261)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  8fc22f5
- [3.11] gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301) (#160649)
  
  authored and
  icanhasmath
  committed
  4c152e5
- [3.11] gh-160097: Reject links replacing the destination in `tarfile.tar_filter` (GH-160098) (#160343)
  
  authored and
  icanhasmath
  committed
  937b4e6
- [3.11] Add Sphinx markup for CVEs in Changelog entries (GH-159415) (#159938)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  7a0e7df
- [3.11] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) (GH-160572)
  
  gpshead
  authored and
  icanhasmath
  committed
  32332b2
- [3.11] gh-160040: Add ssl eMudhra distrust entry to whatsnew (3.9.25.1) (#160591)
  
  tiran
  authored and
  icanhasmath
  committed
  1f91fa4
- 3.9.25.x: adapt backported tests to the 3.9 test.support API
  icanhasmath
  committed
  0ccdf36
- Upgrade bundled pip to 26.0.1.post1 (3.9.25.x)
  icanhasmath
  committed
  88118a4
- Update version to 3.9.25.1 and add release notes
  icanhasmath
  committed
  2b21fed
- 3.9.25.x: catch socket.timeout in the gh-119452 CGI read loop
  icanhasmath
  committed
  c516861
Commits on Oct 28, 2026
- [3.13] gh-143921: Reject NUL, CR and LF in IMAP commands (GH-143922, GH-153067) (GH-153137) (GH-153287)
  
  serhiy-storchaka
  authored and
  icanhasmath
  committed
  5ef191a
- gh-143923: Reject control characters in POP3 commands
  
  sethmlarson
  authored and
  icanhasmath
  committed
  e1e2dcf
- gh-150751: validate http.client Content-Length and chunk-size (GH-150752)
  
  metsw24-max
  authored and
  icanhasmath
  committed
  18cd6aa
- gh-150751: Ignore optional whitespace around Content-Length in http.client (GH-159156)
  
  danilablagorodniy37
  authored and
  icanhasmath
  committed
  efec30f
- Release notes: imaplib, poplib and http.client fixes in 3.9.25.1
  
  icanhasmath
  and
  claude
  committed
  fe5c972
- Upgrade bundled setuptools to 82.0.1.post1 (3.9.25.x)
  
  icanhasmath
  and
  claude
  committed
  69cb071

Commits

Commits on Oct 27, 2026

Commits on Oct 28, 2026