openembedded-core.git/meta/recipes-devtools/python, branch daisy

python: CVE-2014-7185

2015-04-27T14:20:32+00:00

Integer overflow in bufferobject.c in Python before 2.7.8 allows
context-dependent attackers to obtain sensitive information from
process memory via a large size and offset in a "buffer" function.

PoC:

Signed-off-by: Richard Purdie

python: Disables SSLv3

2015-02-06T14:48:40+00:00

This is related to "SSLv3 POODLE vulnerability" CVE-2014-3566

Building python without SSLv3 support when openssl is built without
any support for SSLv3 (e.g. by adding EXTRA_OECONF = " -no-ssl3" in
the openssl recipes).

Backport from:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=768611#22
[python2.7-nossl3.patch] only Modules/_ssl.c is backported.

References:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=7015
https://bugzilla.yoctoproject.org/show_bug.cgi?id=6843
http://bugs.python.org/issue22638
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566

Signed-off-by: Sona Sarmadi 
Signed-off-by: Saul Wold

python: force off_t size to 8 to enable large file support

2014-11-06T11:38:50+00:00

If DISTRO_FEATURES contains "largefile", force the size of off_t to 8 as
a workaround for having ac_cv_sizeof_off_t=4 on 32-bit systems. In
future we will likely drop the value from the site file, but for now
this is a slightly safer fix.

Fixes [YOCTO #6813].

(From OE-Core master rev: a8216030ee6c65531de8fbf3eed878a345a94edc)

Signed-off-by: Paul Eggleton 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie

python-native : Add patch to fix configure error with gcc 4.8.

2014-06-17T08:00:20+00:00

We apply this patch to the python recipe already. Without this patch
the zeroc-ice-native recipe will not build.

See: http://bugs.python.org/issue17547 for more details.

Signed-off-by: Philip Balister 
Signed-off-by: Saul Wold

python3: Revert python-config to distutils.sysconfig

2014-05-29T12:42:07+00:00

The newer sysconfig module shares some code with distutils.sysconfig,
but the same modifications as in

12-distutils-prefix-is-inside-staging-area.patch

makes distutils.sysconfig affect the native runtime as well as cross
building.  Use the old, patched implementation which returns paths in
the staging directory and for the target, as appropriate.

This change reverts this upstream patch
http://hg.python.org/cpython/diff/712970b019f7/Misc/python-config.in

(From OE-Core rev: 7b2ffd68ae8235dcc3ddff9cbe8525e61f3b3d28)

Signed-off-by: Tyler Hall 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

python3: Substitute correct python version in shebang

2014-05-29T12:42:06+00:00

If python2 and python3 are both available, scripts that are subject to
this substitution can possibly run with the wrong python version.
python3-config is one such script.

(From OE-Core rev: 23849347d0fe60a01578efdd6c6e23ebb444dcd6)

Signed-off-by: Tyler Hall 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

python: Fix CVE-2014-1912

2014-04-08T16:51:04+00:00

A remote user can send specially crafted data to trigger a buffer overflow
in socket.recvfrom_into() and execute arbitrary code on the target system.
The code will run with the privileges of the target service.

This back-ported patch fixes CVE-2014-1912

Signed-off-by: Maxin B. John 
Signed-off-by: Richard Purdie

python: fix build error with Readline 6.3

2014-04-04T10:51:27+00:00

Backport two patches from upstream:

use new readline function types (closes #20374)
Issue #20374: Avoid compiler warnings when compiling readline with libedit.

[YOCTO #6107]

Signed-off-by: Chong Lu 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

python3: sync module dependencies from 2.7

2014-03-21T12:05:32+00:00

These have been added recently to 2.7 but were missing in the 3.3
script/inc file.

Signed-off-by: Paul Eggleton

generate-manifest-3.3.py: sync descriptions with 2.7 version

2014-03-21T12:05:32+00:00

Signed-off-by: Paul Eggleton