pypy3 - Debian Package Tracker

general

source: pypy3 (main)
version: 7.3.17+dfsg-2
maintainer: Stefano Rivera (DMD)
arch: all any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 7.0.0+dfsg-3
oldstable: 7.3.5+dfsg-2+deb11u2
old-sec: 7.3.5+dfsg-2+deb11u4
stable: 7.3.11+dfsg-2+deb12u2
testing: 7.3.17+dfsg-2
unstable: 7.3.17+dfsg-2

versioned links

7.0.0+dfsg-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.3.5+dfsg-2+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.3.5+dfsg-2+deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.3.11+dfsg-2+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.3.17+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

pypy3 (1 bugs: 0, 1, 0, 0)
pypy3-dev
pypy3-doc
pypy3-lib
pypy3-lib-testsuite
pypy3-tk
pypy3-venv

action needed

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2024-9287: A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
CVE-2023-27043: The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Created: 2024-05-01 Last update: 2024-11-26 12:00

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2024-9287: A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
CVE-2023-27043: The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Created: 2024-05-01 Last update: 2024-11-26 12:00

2 security issues in bookworm high

There are 2 open security issues in bookworm.

1 important issue:

CVE-2024-9287: A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

1 issue left for the package maintainer to handle:

CVE-2023-27043: (postponed; to be fixed through a stable update) The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

You can find information about how to handle this issue in the security team's documentation.

Created: 2023-09-29 Last update: 2024-11-26 12:00

lintian reports 48 errors and 65 warnings high

Lintian reports 48 errors and 65 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2024-04-27 Last update: 2024-10-06 03:32

21 security issues in buster high

There are 21 open security issues in buster.

7 important issues:

CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.
CVE-2019-20907: In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
CVE-2020-26116: http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
CVE-2020-27619: In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
CVE-2022-48564: read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
CVE-2022-48565: An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
CVE-2022-48566: An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

14 issues postponed or untriaged:

CVE-2021-3426: (needs triaging) There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.
CVE-2021-3733: (needs triaging) There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
CVE-2021-3737: (needs triaging) A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.
CVE-2021-4189: (needs triaging) A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
CVE-2022-0391: (needs triaging) A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
CVE-2023-6597: (needs triaging) An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.
CVE-2020-10735: (needs triaging) A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.
CVE-2021-23336: (needs triaging) The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
CVE-2021-29921: (needs triaging) In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
CVE-2022-42919: (needs triaging) Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can execute arbitrary code. Thus, this allows for local user privilege escalation to the user that any forkserver process is running as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start method for multiprocessing is not the default start method. This issue is Linux specific because only Linux supports abstract namespace sockets. CPython before 3.9 does not make use of Linux abstract namespace sockets by default. Support for users manually specifying an abstract namespace socket was added as a bugfix in 3.7.8 and 3.8.3, but users would need to make specific uncommon API calls in order to do that in CPython before 3.9.
CVE-2022-45061: (needs triaging) An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.
CVE-2023-24329: (needs triaging) An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
CVE-2023-27043: (postponed; to be fixed through a stable update) The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.
CVE-2023-40217: (needs triaging) An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)

Created: 2024-05-01 Last update: 2024-06-29 13:15

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 7.3.17+dfsg-3, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 5ab75a2c1ebecdc0fba6139750880b8096d73263
Author: Stefano Rivera <stefanor@debian.org>
Date:   Thu Sep 12 14:19:05 2024 +0200

    Do a wide build of Python 2.7 for the translation.

commit a5a8ae4fe72e5df0323aeffb8e5aa387806d4ebd
Author: Stefano Rivera <stefanor@debian.org>
Date:   Sat Aug 31 22:00:05 2024 +0200

    Avoid writing build environment paths into _sysconfigdata.

Created: 2024-09-09 Last update: 2024-12-03 12:33

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2023-10-05 Last update: 2024-12-03 12:33

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2024-09-01 Last update: 2024-09-01 00:02

debian/patches: 10 patches to forward upstream low

Among the 22 debian patches available in version 7.3.17+dfsg-2 of the package, we noticed the following issues:

10 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2024-08-31 23:35

news

[rss feed]

[2024-11-26] Accepted pypy3 7.3.5+dfsg-2+deb11u4 (source) into oldstable-security (Andrej Shadura) (signed by: Andrew Shadura)
[2024-11-07] Accepted pypy3 7.3.5+dfsg-2+deb11u3 (source) into oldstable-security (Andrej Shadura) (signed by: Andrew Shadura)
[2024-09-02] pypy3 7.3.17+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-08-31] Accepted pypy3 7.3.17+dfsg-2 (source) into unstable (Stefano Rivera)
[2024-08-30] Accepted pypy3 7.3.17+dfsg-1 (source) into unstable (Stefano Rivera)
[2024-05-20] Accepted pypy3 7.3.11+dfsg-2+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Stefano Rivera)
[2024-05-03] pypy3 7.3.16+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-04-26] Accepted pypy3 7.3.16+dfsg-2 (source) into unstable (Stefano Rivera)
[2024-04-24] Accepted pypy3 7.3.16+dfsg-1 (source) into unstable (Stefano Rivera)
[2024-02-02] Accepted pypy3 7.3.11+dfsg-2+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Stefano Rivera)
[2024-01-21] pypy3 7.3.15+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-01-18] Accepted pypy3 7.3.15+dfsg-1 (source) into unstable (Stefano Rivera)
[2023-12-28] pypy3 7.3.14+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-12-28] pypy3 7.3.14+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-12-25] Accepted pypy3 7.3.14+dfsg-1 (source) into unstable (Stefano Rivera)
[2023-10-02] pypy3 7.3.13+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-09-29] Accepted pypy3 7.3.13+dfsg-1 (source) into unstable (Stefano Rivera)
[2023-06-21] pypy3 7.3.12+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-06-21] pypy3 7.3.12+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-06-16] Accepted pypy3 7.3.12+dfsg-1 (source) into unstable (Stefano Rivera)
[2023-05-28] Accepted pypy3 7.3.12~rc2+dfsg-1 (source) into experimental (Stefano Rivera)
[2023-05-14] Accepted pypy3 7.3.12~rc1+dfsg-1 (source) into experimental (Stefano Rivera)
[2023-02-10] pypy3 7.3.11+dfsg-2 MIGRATED to testing (Debian testing watch)
[2023-02-06] Accepted pypy3 7.3.11+dfsg-2 (source) into unstable (Stefano Rivera)
[2023-01-01] pypy3 7.3.11+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-12-30] Accepted pypy3 7.3.11+dfsg-1 (source) into unstable (Stefano Rivera)
[2022-12-13] pypy3 7.3.10+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-12-06] Accepted pypy3 7.3.10+dfsg-1 (source) into unstable (Stefano Rivera)
[2022-11-25] Accepted pypy3 7.3.10~rc3+dfsg-2 (source) into experimental (Stefano Rivera)
[2022-11-25] Accepted pypy3 7.3.10~rc3+dfsg-1 (source) into experimental (Stefano Rivera)

bugs [bug history graph]

all: 2
RC: 0
I&N: 2
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (48, 65)
buildd: logs, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 7.3.17+dfsg-2ubuntu1
1 bug
patches for 7.3.17+dfsg-2ubuntu1