Python is een objectgeoriënteerde programmeertaal die kan worden gebruikt om eenvoudige tot complexe, platformonafhankelijke applicaties te ontwikkelen. Het is in de jaren negentig ontworpen door Guido van Rossum, die destijds in Amsterdam voor het CWI werkte. Guido was als BDFL betrokken bij de ontwikkeling van Python. Hij heeft daarnaast voor Dropbox gewerkt, ging daarna met pensioen en toen dat niet echt beviel, ging hij aan de slag bij Microsoft. Er zijn nu updates van Python 3.7, 3.8, 3.9, 3.10 en 3.11 verschenen, die een verzameling van fouten en beveiligingsproblemen moeten verhelpen.
Python 3.11.1, 3.10.9, 3.9.16, 3.8.16, 3.7.16, and 3.12.0 alpha 3 are now availableGreetings! We bring you a slew of releases this fine Saint Nicholas / Sinterklaas day. Six simultaneous releases has got to be some record. There’s one more record we broke this time, you’ll see below. In any case, updating is recommended due to security content:
- 3.7 - 3.12: gh-98739: Updated bundled libexpat to 2.5.0 to fix CVE-2022-43680 (heap use-after-free).
- 3.7 - 3.12: gh-98433: The IDNA codec decoder used on DNS hostnames by
socketorasynciorelated name resolution functions no longer involves a quadratic algorithm to fix CVE-2022-45061. This prevents a potential CPU denial of service if an out-of-spec excessive length hostname involving bidirectional characters were decoded. Some protocols such asurllibhttp 3xx redirects potentially allow for an attacker to supply such a name.- 3.7 - 3.12: gh-100001:
python -m http.serverno longer allows terminal control characters sent within a garbage request to be printed to the stderr server log.- 3.8 - 3.12: gh-87604: Avoid publishing list of active per-interpreter audit hooks via the
gcmodule.- 3.9 - 3.10 (already released in 3.11+ before): gh-97514: On Linux the
multiprocessingmodule returns to using filesystem backed unix domain sockets for communication with the forkserver process instead of the Linux abstract socket namespace. Only code that chooses to use the “forkserver” start method is affected. This prevents Linux CVE-2022-42919 (potential privilege escalation) as abstract sockets have no permissions and could allow any user on the system in the same network namespace (often the whole system) to inject code into themultiprocessingforkserver process. This was a potential privilege escalation. Filesystem based socket permissions restrict this to the forkserver process user as was the default in Python 3.8 and earlier.- 3.7 - 3.10: gh-98517: Port XKCP’s fix for the buffer overflows in SHA-3 to fix CVE-2022-37454.
- 3.7 - 3.9 (already released in 3.10+ before): gh-68966: The deprecated mailcap module now refuses to inject unsafe text (filenames, MIME types, parameters) into shell commands to address CVE-2015-20107. Instead of using such text, it will warn and act as if a match was not found (or for test commands, as if the test failed).
:strip_exif()/i/1395392811.png?f=thumbmedium)
/u/96692/chili_pepper.png?f=community){kind=small}
:strip_icc():strip_exif()/u/301917/imgg.jpg?f=community){kind=small}
:strip_exif()/u/1054665/crop5be31086906cf_cropped.gif?f=community){kind=small}
/u/151149/crop5fde11d32f663_cropped.png?f=community){kind=small}
/u/290755/crop5df8dd10bad1e_cropped.png?f=community){kind=small}
/u/28429/crop59eb40ac5dc83_cropped.png?f=community){kind=small}
:strip_exif()/u/214177/crop5b157c29026bd_cropped.gif?f=community){kind=small}
