CVE-2024-0397

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.(CVE-2024-0397)

The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.

CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.(CVE-2024-4032)

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0.

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0.

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0.

• CVE-2024-0397: fix memory race condition in ssl module's cert_store_stats() and get_ca_certs() methods by ensuring proper synchronization during certificates loading

• CVE-2024-0397: fix memory race condition in ssl.SSLContext methods cert_store_stats() and get_ca_certs()

• SECURITY UPDATE: infinite loop and deadlock when parsing tar archives with negative member offsets
  • debian/patches/CVE-2025-8194.patch: reject negative byte counts in TarInfo._block() with InvalidHeaderError in Lib/tarfile.py, so a crafted negative member size can no longer move the read offset backwards; add regression tests to Lib/test/test_tarfile.py
  • CVE-2025-8194
• SECURITY UPDATE: memory race condition in ssl.SSLContext cert_store_stats() and get_ca_certs()
  • debian/patches/CVE-2024-0397.patch: add an X509_STORE_get1_objects() shim that takes a locked deep copy of the certificate store objects and use it in cert_store_stats() and get_ca_certs() in Modules/_ssl.c, so certificates loaded concurrently can no longer free objects that are being iterated
  • CVE-2024-0397

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. (CVE-2024-0397) The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. (CVE-2024-4032) The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. (CVE-2024-6923) When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected. (CVE-2024-8088) Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives. (CVE-2024-6232) When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value. (CVE-2024-7592) Urlparse insufficient validation leads to open redirect. (CVE-2015-2104) The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python. (CVE-2023-27043)

These are all security issues fixed in the python38-3.8.19-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.19-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-3.10.14-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.9-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.5-1.1 package on the GA media of openSUSE Tumbleweed.

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

This update fixes the following issues:

venv-salt-minion:

• Security fixes on Python 3.11 interpreter:

  • CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059)
  • CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058)
  • CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
  • CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448)
  • CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447)

• Security fixes on Python dependencies:

  • CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996)
  • CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995)
  • CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994)
  • CVE-2024-37891: urllib3: Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654)

• Other bugs fixed:

  • Fixed failing x509 tests with OpenSSL < 1.1
  • Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  • Allow NamedLoaderContexts to be returned from loader
  • Reverted the change making reactor less blocking (bsc#1230322)
  • Use --cachedir for extension_modules in salt-call (bsc#1226141)
  • Prevent using SyncWrapper with no reason
  • Enable post_start_cleanup.sh to work in a transaction
  • Fixed the SELinux context for Salt Minion service (bsc#1219041)
  • Increase warn_until_date date for code we still support
  • Avoid crash on wrong output of systemctl version (bsc#1229539)
  • Improved error handling with different OpenSSL versions
  • Fixed cloud Minion configuration for multiple Masters (bsc#1229109)
  • Use Pygit2 id instead of deprecated oid in gitfs
  • Added passlib Python module to the bundle

This update for python39 fixes the following issues:

• CVE-2024-4032: Rearranging definition of private v global IP. (bsc#1226448)
• CVE-2024-0397: Remove a memory race condition in ssl.SSLContext certificate store methods. (bsc#1226447)

This update for python39 fixes the following issues:

• CVE-2024-4032: Rearranging definition of private v global IP. (bsc#1226448)
• CVE-2024-0397: Remove a memory race condition in ssl.SSLContext certificate store methods. (bsc#1226447)

This update for python39 fixes the following issues:

• CVE-2024-4032: Rearranging definition of private v global IP. (bsc#1226448)
• CVE-2024-0397: Remove a memory race condition in ssl.SSLContext certificate store methods. (bsc#1226447)

This update for python3 fixes the following issues:

• CVE-2023-52425: Fixed backport so it uses features sniffing, not just comparing version number (bsc#1219559).
• CVE-2024-0450: Fixed detecting the vulnerability of 'quoted-overlap' zipbomb (bsc#1221854).
• CVE-2024-4032: Rearranging definition of private v global IP. (bsc#1226448)
• CVE-2024-0397: Remove a memory race condition in ssl.SSLContext certificate store methods. (bsc#1226447)

This update for python312 fixes the following issues:

• CVE-2024-4032: Corrected information about public and private IPv4 and IPv6 address ranges (bsc#1226448).

This update for python311 fixes the following issues:

Security issues fixed:

• CVE-2024-6923: Fixed email header injection due to unquoted newlines (bsc#1228780)
• CVE-2024-5642: Removed support for anything but OpenSSL 1.1.1 or newer (bsc#1227233)
• CVE-2024-4032: Fixed incorrect IPv4 and IPv6 private ranges (bsc#1226448)

Non-security issues fixed:

• Fixed executable bits for /usr/bin/idle* (bsc#1227378).
• Improve python reproducible builds (bsc#1227999)
• Make pip and modern tools install directly in /usr/local when used by the user (bsc#1225660)
• %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999)

This update fixes the following issues:

venv-salt-minion:

• Security fixes on Python 3.11 interpreter:

  • CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059)
  • CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058)
  • CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
  • CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448)
  • CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447)

• Security fixes on Python dependencies:

  • CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996)
  • CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995)
  • CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994)
  • CVE-2024-37891: urllib3: Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654)

• Other bugs fixed:

  • Added passlib Python module to the bundle
  • Allow NamedLoaderContexts to be returned from loader
  • Avoid crash on wrong output of systemctl version (bsc#1229539)
  • Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  • Enable post_start_cleanup.sh to work in a transaction
  • Fixed cloud Minion configuration for multiple Masters (bsc#1229109)
  • Fixed failing x509 tests with OpenSSL < 1.1
  • Fixed the SELinux context for Salt Minion service (bsc#1219041)
  • Fixed zyppnotify plugin after latest zypp/libzypp upgrades (bsc#1231697, bsc#1231045)
  • Improved error handling with different OpenSSL versions
  • Increase warn_until_date date for code we still support
  • Prevent using SyncWrapper with no reason
  • Reverted the change making reactor less blocking (bsc#1230322)
  • Use --cachedir for extension_modules in salt-call (bsc#1226141)
  • Use Pygit2 id instead of deprecated oid in gitfs

This update fixes the following issues:

venv-salt-minion:

• Security fixes on Python 3.11 interpreter:

  • CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059)
  • CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058)
  • CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
  • CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448)
  • CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447)

• Security fixes on Python dependencies:

  • CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996)
  • CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995)
  • CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994)
  • CVE-2024-37891: urllib3: Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654)

• Other bugs fixed:

  • Added passlib Python module to the bundle
  • Allow NamedLoaderContexts to be returned from loader
  • Avoid crash on wrong output of systemctl version (bsc#1229539)
  • Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  • Enable post_start_cleanup.sh to work in a transaction
  • Fixed cloud Minion configuration for multiple Masters (bsc#1229109)
  • Fixed failing x509 tests with OpenSSL < 1.1
  • Fixed the SELinux context for Salt Minion service (bsc#1219041)
  • Fixed too frequent systemd service restart in test_system test
  • Fixed zyppnotify plugin after latest zypp/libzypp upgrades (bsc#1231697, bsc#1231045)
  • Improved error handling with different OpenSSL versions
  • Increase warn_until_date date for code we still support
  • Prevent using SyncWrapper with no reason
  • Reverted the change making reactor less blocking (bsc#1230322)
  • Use --cachedir for extension_modules in salt-call (bsc#1226141)
  • Use Pygit2 id instead of deprecated oid in gitfs

This update fixes the following issues:

venv-salt-minion:

• Security fixes on Python 3.11 interpreter:

  • CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059)
  • CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058)
  • CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
  • CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448)
  • CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447)

• Security fixes on Python dependencies:

  • CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996)
  • CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995)
  • CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994)
  • CVE-2024-37891: urllib3: Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654)

• Other bugs fixed:

  • Fixed failing x509 tests with OpenSSL < 1.1
  • Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  • Allow NamedLoaderContexts to be returned from loader
  • Reverted the change making reactor less blocking (bsc#1230322)
  • Use --cachedir for extension_modules in salt-call (bsc#1226141)
  • Prevent using SyncWrapper with no reason
  • Enable post_start_cleanup.sh to work in a transaction
  • Fixed the SELinux context for Salt Minion service (bsc#1219041)
  • Increase warn_until_date date for code we still support
  • Avoid crash on wrong output of systemctl version (bsc#1229539)
  • Improved error handling with different OpenSSL versions
  • Fixed cloud Minion configuration for multiple Masters (bsc#1229109)
  • Use Pygit2 id instead of deprecated oid in gitfs
  • Added passlib Python module to the bundle

This update for python311 fixes the following issues:

Security issues fixed:

• CVE-2024-6923: Fixed email header injection due to unquoted newlines (bsc#1228780)
• CVE-2024-0397: Fixed memory race condition in ssl.SSLContext certificate store methods (bsc#1226447)
• CVE-2024-4032: Fixed incorrect IPv4 and IPv6 private ranges (bsc#1226448)

Non-security issues fixed:

• Fixed executable bits for /usr/bin/idle* (bsc#1227378).
• Improve python reproducible builds (bsc#1227999)
• Make pip and modern tools install directly in /usr/local when used by the user (bsc#1225660)
• %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999)

This update for python311, python-rpm-macros fixes the following issues:

python311:

• CVE-2024-0450: Fixed zipfile module vulnerability with "quoted-overlap" zipbomb (bsc#1221854)
• CVE-2024-4032: Fixed incorrect IPv4 and IPv6 private ranges (bsc#1226448)
• CVE-2024-0397: Fixed memory race condition in ssl.SSLContext certificate store methods (bsc#1226447)
• CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
• Fixed executable bits for /usr/bin/idle* (bsc#1227378).

python-rpm-macros:

• Update to version 20240618.c146b29:

  • Add %FLAVOR_pytest and %FLAVOR_pyunittest variants

• Update to version 20240618.1e386da:

  • Fix python_clone sed regex

• Update to version 20240614.02920b8:

  • Make sure that RPM_BUILD_ROOT env is set
  • don't eliminate any cmdline arguments in the shebang line
  • Create python313 macros

• Update to version 20240415.c664b45:

  • Fix typo 310 -> 312 in default-prjconf

• Update to version 20240202.501440e:

  • SPEC0: Drop python39, add python312 to buildset (#169)

• Update to version 20231220.98427f3:

  • fix python2_compile macro

• Update to version 20231207.46c2ec3:

  • make FLAVOR_compile compatible with python2

• Update to version 20231204.dd64e74:

  • Combine fix_shebang in one line
  • New macro FLAVOR_fix_shebang_path
  • Use realpath in %python_clone macro shebang replacement
  • Compile and fix_shebang in %python_install macros

• Update to version 20231010.0a1f0d9:

  • Revert "Compile and fix_shebang in %python_install macros"
  • gh#openSUSE/python-rpm-macros#163

• Update to version 20231010.a32e110:

  • Compile and fix_shebang in %python_install macros

• Update to version 20231005.bf2d3ab:

  • Fix shebang also in sbin with macro _fix_shebang

This update for python311 fixes the following issues:

• Skip PGO with %want_reproducible_builds (bsc#1239210)

• CVE-2025-0938: Disallows square brackets ([ and ]) in domain names for parsed URLs (bsc#1236705).

• Configure externally_managed with a bcond (bsc#1228165).

• Update to 3.11.11:

  • Tools/Demos
    • gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15 and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  • Tests
    • gh-125041: Re-enable skipped tests for zlib on the s390x architecture: only skip checks of the compressed bytes, which can be different between zlib’s software implementation and the hardware-accelerated implementation.
  • Security
    • gh-126623: Upgrade libexpat to 2.6.4
    • gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.
  • Library
    • gh-124651: Properly quote template strings in venv activation scripts (bsc#1232241, CVE-2024-9287).

• Remove -IVendor/ from python-config (bsc#1231795)

• CVE-2024-9287: Properly quote path names provided when creating a virtual environment (bsc#1232241)

• Drop .pyc files from docdir for reproducible builds (bsc#1230906).

• Update to 3.11.10:

  • Security
    • gh-123678: Upgrade libexpat to 2.6.3
    • gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The event in question is cpython.run_stdin.
    • gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows. Patch by Gregory P. Smith [email protected] and Seth Larson [email protected]. Reported by Ellie [email protected]
    • gh-121285: Remove backtracking from tarfile header parsing for hdrcharset, PAX, and GNU sparse headers (bsc#1230227, CVE-2024-6232).
    • gh-118486: :func:os.mkdir on Windows now accepts mode of 0o700 to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting :func:tempfile.mkdtemp in scenarios where the base temporary directory is more permissive than the default.
    • gh-116741: Update bundled libexpat to 2.6.2
  • Library
    • gh-123270: Applied a more surgical fix for malformed payloads in :class:zipfile.Path causing infinite loops (gh-122905) without breaking contents using legitimate characters (bsc#1229704, CVE-2024-8088).
    • gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes by :mod:http.cookies (bsc#1229596, CVE-2024-7592).
    • gh-122905: :class:zipfile.Path objects now sanitize names from the zipfile.
    • gh-121650: :mod:email headers with embedded newlines are now quoted on output. The :mod:~email.generator will now refuse to serialize (write) headers that are unsafely folded or delimited; see :attr:~email.policy.Policy.verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in :gh:121650; CVE-2024-6923, bsc#1228780).
    • gh-119506: Fix :meth:!io.TextIOWrapper.write method breaks internal buffer when the method is called again during flushing internal buffer.
    • gh-118643: Fix an AttributeError in the :mod:email module when re-fold a long address list. Also fix more cases of incorrect encoding of the address separator in the address list.
    • gh-113171: Fixed various false positives and false negatives in * :attr:ipaddress.IPv4Address.is_private (see these docs for details) * :attr:ipaddress.IPv4Address.is_global * :attr:ipaddress.IPv6Address.is_private * …

This update for python311 fixes the following issues:

• CVE-2025-4516: Fixed blocking DecodeError handling vulnerability, which could lead to DoS. (bsc#1243273)

Update to 3.11.12:

• gh-105704: When using urllib.parse.urlsplit() and urllib.parse.urlparse() host parsing would not reject domain names containing square brackets ([ and ]). Square brackets are only valid for IPv6 and IPvFuture hosts according to RFC 3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704).

• gh-121284: Fix bug in the folding of rfc2047 encoded-words when flattening an email message using a modern email policy. Previously when an encoded-word was too long for a line, it would be decoded, split across lines, and re-encoded. But commas and other special characters in the original text could be left unencoded and unquoted. This could theoretically be used to spoof header lines using a carefully constructed encoded-word if the resulting rendered email was transmitted or re-parsed.

• gh-80222: Fix bug in the folding of quoted strings when flattening an email message using a modern email policy. Previously when a quoted string was folded so that it spanned more than one line, the surrounding quotes and internal escapes would be omitted. This could theoretically be used to spoof header lines using a carefully constructed quoted string if the resulting rendered email was transmitted or re-parsed.

• gh-119511: Fix a potential denial of service in the imaplib module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. On many systems this is harmless as unused virtual memory is only a mapping, but if this hit a virtual address size limit it could lead to a MemoryError or other process crash. On unusual systems or builds where all allocated memory is touched and backed by actual ram or storage it could’ve consumed resources doing so until similarly crashing.

• gh-127257: In ssl, system call failures that OpenSSL reports using ERR_LIB_SYS are now raised as OSError.

• gh-121277: Writers of CPython’s documentation can now use next as the version for the versionchanged, versionadded, deprecated directives.

• gh-106883: Disable GC during the _PyThread_CurrentFrames() and _PyThread_CurrentExceptions() calls to avoid the interpreter to deadlock.

• CVE-2025-0938: disallow square brackets ([ and ]) in domain names for parsed URLs (bsc#1236705, gh#python/cpython#105704)

Update to 3.11.11:

• Tools/Demos

  • gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15 and multissltests to use 3.0.15, 3.1.7, and 3.2.3.

• Security

  • gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.

• Library

  • gh-124651: Properly quote template strings in venv activation scripts (bsc#1232241, CVE-2024-9287).

• Remove -IVendor/ from python-config bsc#1231795

• CVE-2024-9287: Properly quote path names provided when creating a virtual environment (bsc#1232241,

• Drop .pyc files from docdir for reproducible builds (bsc#1230906).

Update to 3.11.10:

• Security

  • gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The event in question is cpython.run_stdin.
  • gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows. Patch by Gregory P. Smith [email protected] and Seth Larson [email protected]. Reported by Ellie [email protected]
  • gh-121285: Remove backtracking from…

It was discovered that the Python ssl module contained a memory race condition when handling the APIs to obtain the CA certificates and certificate store statistics. This could possibly result in applications obtaining wrong results, leading to various SSL issues. (CVE-2024-0397)

It was discovered that the Python ipaddress module contained incorrect information about which IP address ranges were considered "private" or "globally reachable". This could possibly result in applications applying incorrect security policies. (CVE-2024-4032)