package/python3: add upstream security fix for CVE-2021-3177
authorPeter Korsgaard <peter@korsgaard.com>
Fri, 5 Feb 2021 13:07:56 +0000 (14:07 +0100)
committerPeter Korsgaard <peter@korsgaard.com>
Sat, 6 Feb 2021 09:51:45 +0000 (10:51 +0100)
commit5405b295703055c9ea030e67279b5f6c37f6a51a
tree06122ff052770ab72b5aeac07a0f9a6b5299cdaa
parent87bef179222ee8a0b0f39c8f96113a4ecf813085
package/python3: add upstream security fix for CVE-2021-3177

Fixes the following security issue:

- CVE-2021-3177: Python 3.x through 3.9.1 has a buffer overflow in
  PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution
  in certain Python applications that accept floating-point numbers as
  untrusted input, as demonstrated by a 1e300 argument to
  c_double.from_param.  This occurs because sprintf is used unsafely.

For details, see the advisory:
https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
package/python3/0035-closes-bpo-42938-Replace-snprintf-with-Python-unicod.patch [new file with mode: 0644]
package/python3/python3.mk