Bug 741560

Summary:	<dev-python/pypy-7.3.2: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	Michał Górny <mgorny>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	minor	CC:	python
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=741496
Whiteboard:	B3 [glsa?]
Package list:		Runtime testing required:	---
Bug Depends on:	752294
Bug Blocks:

Description Michał Górny archtester

2020-09-10 19:56:57 UTC

Ok, so pypy2.7 has all vulnerabilities of CPython 2.7.17.  Speaking in CPython commits:

e176e0c105 [2.7] closes bpo-38576: Disallow control characters in hostnames in http.client. (GH-19052)
69cdeeb93e bpo-39503: CVE-2020-8492: Fix AbstractBasicAuthHandler (GH-18284) (GH-19304)
f02de961b9 bpo-39603: Prevent header injection in http methods (GH-18485) (GH-21539)
47a2955589 bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (#21485)

I'm working on getting the patches upstream.  Either way, they will be part of upcoming pypy 7.3.2 release.

Comment 1 John Helmert III archtester

2021-01-09 21:13:20 UTC

Please cleanup.

Comment 2 Michał Górny archtester

2021-01-09 21:59:41 UTC

Removed old versions.

Comment 3 John Helmert III archtester

2021-01-09 22:08:23 UTC

(In reply to Michał Górny from comment #2)
> Removed old versions.

Thanks!

Comment 4 NATTkA bot gentoo-dev

2021-07-29 17:25:57 UTC

Package list is empty or all packages have requested keywords.