CVE-2024-4030

These are all security issues fixed in the python313-3.13.0~b3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.20-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python38-3.8.20-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-3.10.15-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.9-7.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python314-3.14.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions.

If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user.

This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.

This update for python312 fixes the following issues:

• CVE-2024-4032: Corrected information about public and private IPv4 and IPv6 address ranges (bsc#1226448).

This update for python311 fixes the following issues:

• Skip PGO with %want_reproducible_builds (bsc#1239210)

• CVE-2025-0938: Disallows square brackets ([ and ]) in domain names for parsed URLs (bsc#1236705).

• Configure externally_managed with a bcond (bsc#1228165).

• Update to 3.11.11:

  • Tools/Demos
    • gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15 and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  • Tests
    • gh-125041: Re-enable skipped tests for zlib on the s390x architecture: only skip checks of the compressed bytes, which can be different between zlib’s software implementation and the hardware-accelerated implementation.
  • Security
    • gh-126623: Upgrade libexpat to 2.6.4
    • gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.
  • Library
    • gh-124651: Properly quote template strings in venv activation scripts (bsc#1232241, CVE-2024-9287).

• Remove -IVendor/ from python-config (bsc#1231795)

• CVE-2024-9287: Properly quote path names provided when creating a virtual environment (bsc#1232241)

• Drop .pyc files from docdir for reproducible builds (bsc#1230906).

• Update to 3.11.10:

  • Security
    • gh-123678: Upgrade libexpat to 2.6.3
    • gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The event in question is cpython.run_stdin.
    • gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows. Patch by Gregory P. Smith [email protected] and Seth Larson [email protected]. Reported by Ellie [email protected]
    • gh-121285: Remove backtracking from tarfile header parsing for hdrcharset, PAX, and GNU sparse headers (bsc#1230227, CVE-2024-6232).
    • gh-118486: :func:os.mkdir on Windows now accepts mode of 0o700 to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting :func:tempfile.mkdtemp in scenarios where the base temporary directory is more permissive than the default.
    • gh-116741: Update bundled libexpat to 2.6.2
  • Library
    • gh-123270: Applied a more surgical fix for malformed payloads in :class:zipfile.Path causing infinite loops (gh-122905) without breaking contents using legitimate characters (bsc#1229704, CVE-2024-8088).
    • gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes by :mod:http.cookies (bsc#1229596, CVE-2024-7592).
    • gh-122905: :class:zipfile.Path objects now sanitize names from the zipfile.
    • gh-121650: :mod:email headers with embedded newlines are now quoted on output. The :mod:~email.generator will now refuse to serialize (write) headers that are unsafely folded or delimited; see :attr:~email.policy.Policy.verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in :gh:121650; CVE-2024-6923, bsc#1228780).
    • gh-119506: Fix :meth:!io.TextIOWrapper.write method breaks internal buffer when the method is called again during flushing internal buffer.
    • gh-118643: Fix an AttributeError in the :mod:email module when re-fold a long address list. Also fix more cases of incorrect encoding of the address separator in the address list.
    • gh-113171: Fixed various false positives and false negatives in * :attr:ipaddress.IPv4Address.is_private (see these docs for details) * :attr:ipaddress.IPv4Address.is_global * :attr:ipaddress.IPv6Address.is_private * …

This update for python311 fixes the following issues:

• CVE-2025-4516: Fixed blocking DecodeError handling vulnerability, which could lead to DoS. (bsc#1243273)

Update to 3.11.12:

• gh-105704: When using urllib.parse.urlsplit() and urllib.parse.urlparse() host parsing would not reject domain names containing square brackets ([ and ]). Square brackets are only valid for IPv6 and IPvFuture hosts according to RFC 3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704).

• gh-121284: Fix bug in the folding of rfc2047 encoded-words when flattening an email message using a modern email policy. Previously when an encoded-word was too long for a line, it would be decoded, split across lines, and re-encoded. But commas and other special characters in the original text could be left unencoded and unquoted. This could theoretically be used to spoof header lines using a carefully constructed encoded-word if the resulting rendered email was transmitted or re-parsed.

• gh-80222: Fix bug in the folding of quoted strings when flattening an email message using a modern email policy. Previously when a quoted string was folded so that it spanned more than one line, the surrounding quotes and internal escapes would be omitted. This could theoretically be used to spoof header lines using a carefully constructed quoted string if the resulting rendered email was transmitted or re-parsed.

• gh-119511: Fix a potential denial of service in the imaplib module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. On many systems this is harmless as unused virtual memory is only a mapping, but if this hit a virtual address size limit it could lead to a MemoryError or other process crash. On unusual systems or builds where all allocated memory is touched and backed by actual ram or storage it could’ve consumed resources doing so until similarly crashing.

• gh-127257: In ssl, system call failures that OpenSSL reports using ERR_LIB_SYS are now raised as OSError.

• gh-121277: Writers of CPython’s documentation can now use next as the version for the versionchanged, versionadded, deprecated directives.

• gh-106883: Disable GC during the _PyThread_CurrentFrames() and _PyThread_CurrentExceptions() calls to avoid the interpreter to deadlock.

• CVE-2025-0938: disallow square brackets ([ and ]) in domain names for parsed URLs (bsc#1236705, gh#python/cpython#105704)

Update to 3.11.11:

• Tools/Demos

  • gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15 and multissltests to use 3.0.15, 3.1.7, and 3.2.3.

• Security

  • gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.

• Library

  • gh-124651: Properly quote template strings in venv activation scripts (bsc#1232241, CVE-2024-9287).

• Remove -IVendor/ from python-config bsc#1231795

• CVE-2024-9287: Properly quote path names provided when creating a virtual environment (bsc#1232241,

• Drop .pyc files from docdir for reproducible builds (bsc#1230906).

Update to 3.11.10:

• Security

  • gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The event in question is cpython.run_stdin.
  • gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows. Patch by Gregory P. Smith [email protected] and Seth Larson [email protected]. Reported by Ellie [email protected]
  • gh-121285: Remove backtracking from…