Note: The release you're looking at is Python 3.11.10, a security bugfix release for the legacy 3.11 series. Python 3.12 is now the latest feature release series of Python 3.
"
-quoted cookie values with backslashes by http.cookies
. Fixes CVE-2024-7592.urllib.parse.urlunparse()
and urllib.parse.urlunsplit()
for URIs with path starting with multiple slashes and no authority. Fixes CVE-2015-2104.python -i
, as well as for python -m asyncio
. The event in question is cpython.run_stdin
.socket.socketpair()
fallback on platforms where AF_UNIX
is not available like Windows.hdrcharset
, PAX, and GNU sparse headers. That's CVE-2024-6232.ssl.SSLContext.cert_store_stats()
and ssl.SSLContext.get_ca_certs()
now correctly lock access to the certificate store, when the ssl.SSLContext
is shared across multiple threads.email.utils.getaddresses()
and email.utils.parseaddr()
now return ('', '')
2-tuples in more situations where invalid email addresses are encountered instead of potentially inaccurate values. Add optional strict parameter to these two functions: use strict=False
to get the old behavior, accept malformed inputs. getattr(email.utils, 'supports_strict_parsing', False)
can be use to check if the strict paramater is available. This improves the CVE-2023-27043 fix.zipfile.Path
to avoid infinite loops (gh-122905) without breaking contents using legitimate characters. That's CVE-2024-8088.email
headers with embedded newlines are now quoted on output. The generator
will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers
. That's CVE-2024-6923._winapi.CreateFile
and _winapi.CreateNamedPipe
.<_overlapped.Overlapped object at 0xXXX> still has pending operation at deallocation, the process may crash
.pystate.c
's HEAD_LOCK
in posixmodule.c
at fork is now fixed.This is a security release of Python 3.9Note: The release you're looking at is Python 3.9.20, a security bugfix release for the legacy 3.9 series. Python 3.12 is now the latest feature release series of Python 3. Get the latest release of 3.12.x here.
os.mkdir()
on Windows now accepts mode of 0o700
to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting tempfile.mkdtemp()
in scenarios where the base temporary directory is more permissive than the default."
-quoted cookie values with backslashes by http.cookies
. Fixes CVE-2024-7592.urllib.parse.urlunparse()
and urllib.parse.urlunsplit()
for URIs with path starting with multiple slashes and no authority. Fixes CVE-2015-2104.python -i
, as well as for python -m asyncio
. The event in question is cpython.run_stdin
.socket.socketpair()
fallback on platforms where AF_UNIX
is not available like Windows.hdrcharset
, PAX, and GNU sparse headers. That's CVE-2024-6232.ssl.SSLContext.cert_store_stats()
and ssl.SSLContext.get_ca_certs()
now correctly lock access to the certificate store, when the ssl.SSLContext
is shared across multiple threads.email.utils.getaddresses()
and email.utils.parseaddr()
now return ('', '')
2-tuples in more situations where invalid email addresses are encountered instead of potentially inaccurate values. Add optional strict parameter to these two functions: use strict=False
to get the old behavior, accept malformed inputs. getattr(email.utils, 'supports_strict_parsing', False)
can be use to check if the strict paramater is available. This improves the CVE-2023-27043 fix.zipfile.Path
to avoid infinite loops (gh-122905) without breaking contents using legitimate characters. That's CVE-2024-8088.email
headers with embedded newlines are now quoted on output. The generator
will now refuse to serialize (write) headers that are unsafely folded or delimited; see [`verUpdates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2024-308628ebb8
Please login to add feedback.
This update has been submitted for testing by churchyard.
This update's test gating status has been changed to 'ignored'.
This update has been pushed to testing.
This update has been submitted for stable by bodhi.
This update has been pushed to stable.