.gitignore

@@ -1 +1 @@
-SOURCES/Python-2.7.17-noexe.tar.xz
+SOURCES/Python-2.7.18-noexe.tar.xz

.python2.metadata

@@ -1 +1 @@
-e63124a9a86b4b52c09384915a0842adf00b9d45 SOURCES/Python-2.7.17-noexe.tar.xz
+ce5e27d588d635469bdec487c4b1def2ffa84ba2 SOURCES/Python-2.7.18-noexe.tar.xz

SOURCES/00169-avoid-implicit-usage-of-md5-in-multiprocessing.patch

@@ -1,41 +0,0 @@
-diff --git a/Lib/multiprocessing/connection.py b/Lib/multiprocessing/connection.py
---- a/Lib/multiprocessing/connection.py
-+++ b/Lib/multiprocessing/connection.py
-@@ -41,6 +41,10 @@
- # A very generous timeout when it comes to local connections...
- CONNECTION_TIMEOUT = 20.
- 
-+# The hmac module implicitly defaults to using MD5.
-+# Support using a stronger algorithm for the challenge/response code:
-+HMAC_DIGEST_NAME='sha256'
-+
- _mmap_counter = itertools.count()
- 
- default_family = 'AF_INET'
-@@ -700,12 +704,16 @@
- WELCOME = b'#WELCOME#'
- FAILURE = b'#FAILURE#'
- 
-+def get_digestmod_for_hmac():
-+    import hashlib
-+    return getattr(hashlib, HMAC_DIGEST_NAME)
-+
- def deliver_challenge(connection, authkey):
-     import hmac
-     assert isinstance(authkey, bytes)
-     message = os.urandom(MESSAGE_LENGTH)
-     connection.send_bytes(CHALLENGE + message)
--    digest = hmac.new(authkey, message).digest()
-+    digest = hmac.new(authkey, message, get_digestmod_for_hmac()).digest()
-     response = connection.recv_bytes(256)        # reject large message
-     if response == digest:
-         connection.send_bytes(WELCOME)
-@@ -719,7 +727,7 @@
-     message = connection.recv_bytes(256)         # reject large message
-     assert message[:len(CHALLENGE)] == CHALLENGE, 'message = %r' % message
-     message = message[len(CHALLENGE):]
--    digest = hmac.new(authkey, message).digest()
-+    digest = hmac.new(authkey, message, get_digestmod_for_hmac()).digest()
-     connection.send_bytes(digest)
-     response = connection.recv_bytes(256)        # reject large message
-     if response != WELCOME:

SOURCES/00189-use-rpm-wheels.patch

@@ -0,0 +1,70 @@
+diff --git a/Lib/ensurepip/__init__.py b/Lib/ensurepip/__init__.py
+index 5021ebf..29a7d1b 100644
+--- a/Lib/ensurepip/__init__.py
++++ b/Lib/ensurepip/__init__.py
+@@ -1,9 +1,10 @@
+ #!/usr/bin/env python2
+ from __future__ import print_function
+ 
++import distutils.version
++import glob
+ import os
+ import os.path
+-import pkgutil
+ import shutil
+ import sys
+ import tempfile
+@@ -12,9 +13,19 @@ import tempfile
+ __all__ = ["version", "bootstrap"]
+ 
+ 
+-_SETUPTOOLS_VERSION = "41.2.0"
++_WHEEL_DIR = "/usr/share/python{}-wheels/".format(sys.version_info[0])
+ 
+-_PIP_VERSION = "19.2.3"
++def _get_most_recent_wheel_version(pkg):
++    prefix = os.path.join(_WHEEL_DIR, "{}-".format(pkg))
++    suffix = "-py2.py3-none-any.whl"
++    pattern = "{}*{}".format(prefix, suffix)
++    versions = (p[len(prefix):-len(suffix)] for p in glob.glob(pattern))
++    return str(max(versions, key=distutils.version.LooseVersion))
++
++
++_SETUPTOOLS_VERSION = _get_most_recent_wheel_version("setuptools")
++
++_PIP_VERSION = _get_most_recent_wheel_version("pip")
+ 
+ _PROJECTS = [
+     ("setuptools", _SETUPTOOLS_VERSION),
+@@ -28,8 +39,13 @@ def _run_pip(args, additional_paths=None):
+         sys.path = additional_paths + sys.path
+ 
+     # Install the bundled software
+-    import pip._internal
+-    return pip._internal.main(args)
++    try:
++        # pip 10
++        from pip._internal import main
++    except ImportError:
++        # pip 9
++        from pip import main
++    return main(args)
+ 
+ 
+ def version():
+@@ -100,12 +116,9 @@ def _bootstrap(root=None, upgrade=False, user=False,
+         additional_paths = []
+         for project, version in _PROJECTS:
+             wheel_name = "{}-{}-py2.py3-none-any.whl".format(project, version)
+-            whl = pkgutil.get_data(
+-                "ensurepip",
+-                "_bundled/{}".format(wheel_name),
+-            )
+-            with open(os.path.join(tmpdir, wheel_name), "wb") as fp:
+-                fp.write(whl)
++            with open(os.path.join(_WHEEL_DIR, wheel_name), "rb") as sfp:
++                with open(os.path.join(tmpdir, wheel_name), "wb") as fp:
++                    fp.write(sfp.read())
+ 
+             additional_paths.append(os.path.join(tmpdir, wheel_name))
+ 

SOURCES/00198-add-rewheel-module.patch

@@ -1,249 +0,0 @@
-diff --git a/Lib/ensurepip/__init__.py b/Lib/ensurepip/__init__.py
-index 5021ebf..63c763a 100644
---- a/Lib/ensurepip/__init__.py
-+++ b/Lib/ensurepip/__init__.py
-@@ -7,6 +7,7 @@ import pkgutil
- import shutil
- import sys
- import tempfile
-+from ensurepip import rewheel
- 
- 
- __all__ = ["version", "bootstrap"]
-@@ -29,6 +30,8 @@ def _run_pip(args, additional_paths=None):
- 
-     # Install the bundled software
-     import pip._internal
-+    if args[0] in ["install", "list", "wheel"]:
-+        args.append('--pre')
-     return pip._internal.main(args)
- 
- 
-@@ -93,21 +96,40 @@ def _bootstrap(root=None, upgrade=False, user=False,
-         # omit pip and easy_install
-         os.environ["ENSUREPIP_OPTIONS"] = "install"
- 
-+    whls = []
-+    rewheel_dir = None
-+    # try to see if we have system-wide versions of _PROJECTS
-+    dep_records = rewheel.find_system_records([p[0] for p in _PROJECTS])
-+    # TODO: check if system-wide versions are the newest ones
-+    # if --upgrade is used?
-+    if all(dep_records):
-+        # if we have all _PROJECTS installed system-wide, we'll recreate
-+        # wheels from them and install those
-+        rewheel_dir = tempfile.mkdtemp()
-+        for dr in dep_records:
-+            new_whl = rewheel.rewheel_from_record(dr, rewheel_dir)
-+            whls.append(os.path.join(rewheel_dir, new_whl))
-+    else:
-+        # if we don't have all the _PROJECTS installed system-wide,
-+        # let's just fall back to bundled wheels
-+        for project, version in _PROJECTS:
-+            whl = os.path.join(
-+                os.path.dirname(__file__),
-+                "_bundled",
-+                "{}-{}-py2.py3-none-any.whl".format(project, version)
-+            )
-+            whls.append(whl)
-+
-     tmpdir = tempfile.mkdtemp()
-     try:
-         # Put our bundled wheels into a temporary directory and construct the
-         # additional paths that need added to sys.path
-         additional_paths = []
--        for project, version in _PROJECTS:
--            wheel_name = "{}-{}-py2.py3-none-any.whl".format(project, version)
--            whl = pkgutil.get_data(
--                "ensurepip",
--                "_bundled/{}".format(wheel_name),
--            )
--            with open(os.path.join(tmpdir, wheel_name), "wb") as fp:
--                fp.write(whl)
--
--            additional_paths.append(os.path.join(tmpdir, wheel_name))
-+        for whl in whls:
-+            shutil.copy(whl, tmpdir)
-+            additional_paths.append(os.path.join(tmpdir, os.path.basename(whl)))
-+        if rewheel_dir:
-+            shutil.rmtree(rewheel_dir)
- 
-         # Construct the arguments to be passed to the pip command
-         args = ["install", "--no-index", "--find-links", tmpdir]
-diff --git a/Lib/ensurepip/rewheel/__init__.py b/Lib/ensurepip/rewheel/__init__.py
-new file mode 100644
-index 0000000..75c2094
---- /dev/null
-+++ b/Lib/ensurepip/rewheel/__init__.py
-@@ -0,0 +1,158 @@
-+import argparse
-+import codecs
-+import csv
-+import email.parser
-+import os
-+import io
-+import re
-+import site
-+import subprocess
-+import sys
-+import zipfile
-+
-+def run():
-+    parser = argparse.ArgumentParser(description='Recreate wheel of package with given RECORD.')
-+    parser.add_argument('record_path',
-+                        help='Path to RECORD file')
-+    parser.add_argument('-o', '--output-dir',
-+                        help='Dir where to place the wheel, defaults to current working dir.',
-+                        dest='outdir',
-+                        default=os.path.curdir)
-+
-+    ns = parser.parse_args()
-+    retcode = 0
-+    try:
-+        print(rewheel_from_record(**vars(ns)))
-+    except BaseException as e:
-+        print('Failed: {}'.format(e))
-+        retcode = 1
-+    sys.exit(1)
-+
-+def find_system_records(projects):
-+    """Return list of paths to RECORD files for system-installed projects.
-+
-+    If a project is not installed, the resulting list contains None instead
-+    of a path to its RECORD
-+    """
-+    records = []
-+    # get system site-packages dirs
-+    if hasattr(sys, 'real_prefix'):
-+        #we are in python2 virtualenv and sys.real_prefix is the original sys.prefix
-+        _orig_prefixes = site.PREFIXES
-+        setattr(site, 'PREFIXES', [sys.real_prefix]*2)
-+        sys_sitepack = site.getsitepackages()
-+        setattr(site, 'PREFIXES', _orig_prefixes)
-+    elif hasattr(sys, 'base_prefix'): # python3 venv doesn't inject real_prefix to sys
-+        # we are on python3 and base(_exec)_prefix is unchanged in venv
-+        sys_sitepack = site.getsitepackages([sys.base_prefix, sys.base_exec_prefix])
-+    else:
-+        # we are in python2 without virtualenv
-+        sys_sitepack = site.getsitepackages()
-+
-+    sys_sitepack = [sp for sp in sys_sitepack if os.path.exists(sp)]
-+    # try to find all projects in all system site-packages
-+    for project in projects:
-+        path = None
-+        for sp in sys_sitepack:
-+            dist_info_re = os.path.join(sp, project) + '-[^\{0}]+\.dist-info'.format(os.sep)
-+            candidates = [os.path.join(sp, p) for p in os.listdir(sp)]
-+            # filter out candidate dirs based on the above regexp
-+            filtered = [c for c in candidates if re.match(dist_info_re, c)]
-+            # if we have 0 or 2 or more dirs, something is wrong...
-+            if len(filtered) == 1:
-+                path = filtered[0]
-+        if path is not None:
-+            records.append(os.path.join(path, 'RECORD'))
-+        else:
-+            records.append(None)
-+    return records
-+
-+def rewheel_from_record(record_path, outdir):
-+    """Recreates a whee of package with given record_path and returns path
-+    to the newly created wheel."""
-+    site_dir = os.path.dirname(os.path.dirname(record_path))
-+    record_relpath = record_path[len(site_dir):].strip(os.path.sep)
-+    to_write, to_omit = get_records_to_pack(site_dir, record_relpath)
-+    new_wheel_name = get_wheel_name(record_path)
-+    new_wheel_path = os.path.join(outdir, new_wheel_name + '.whl')
-+
-+    new_wheel = zipfile.ZipFile(new_wheel_path, mode='w', compression=zipfile.ZIP_DEFLATED)
-+    # we need to write a new record with just the files that we will write,
-+    # e.g. not binaries and *.pyc/*.pyo files
-+    if sys.version_info[0] < 3:
-+        new_record = io.BytesIO()
-+    else:
-+        new_record = io.StringIO()
-+    writer = csv.writer(new_record)
-+
-+    # handle files that we can write straight away
-+    for f, sha_hash, size in to_write:
-+        new_wheel.write(os.path.join(site_dir, f), arcname=f)
-+        writer.writerow([f, sha_hash,size])
-+
-+    # rewrite the old wheel file with a new computed one
-+    writer.writerow([record_relpath, '', ''])
-+    new_wheel.writestr(record_relpath, new_record.getvalue())
-+
-+    new_wheel.close()
-+
-+    return new_wheel.filename
-+
-+def get_wheel_name(record_path):
-+    """Return proper name of the wheel, without .whl."""
-+
-+    wheel_info_path = os.path.join(os.path.dirname(record_path), 'WHEEL')
-+    with codecs.open(wheel_info_path, encoding='utf-8') as wheel_info_file:
-+        wheel_info = email.parser.Parser().parsestr(wheel_info_file.read().encode('utf-8'))
-+
-+    metadata_path = os.path.join(os.path.dirname(record_path), 'METADATA')
-+    with codecs.open(metadata_path, encoding='utf-8') as metadata_file:
-+        metadata = email.parser.Parser().parsestr(metadata_file.read().encode('utf-8'))
-+
-+    # construct name parts according to wheel spec
-+    distribution = metadata.get('Name')
-+    version = metadata.get('Version')
-+    build_tag = '' # nothing for now
-+    lang_tag = []
-+    for t in wheel_info.get_all('Tag'):
-+        lang_tag.append(t.split('-')[0])
-+    lang_tag = '.'.join(lang_tag)
-+    abi_tag, plat_tag = wheel_info.get('Tag').split('-')[1:3]
-+    # leave out build tag, if it is empty
-+    to_join = filter(None, [distribution, version, build_tag, lang_tag, abi_tag, plat_tag])
-+    return '-'.join(list(to_join))
-+
-+def get_records_to_pack(site_dir, record_relpath):
-+    """Accepts path of sitedir and path of RECORD file relative to it.
-+    Returns two lists:
-+    - list of files that can be written to new RECORD straight away
-+    - list of files that shouldn't be written or need some processing
-+      (pyc and pyo files, scripts)
-+    """
-+    record_file_path = os.path.join(site_dir, record_relpath)
-+    with codecs.open(record_file_path, encoding='utf-8') as record_file:
-+        record_contents = record_file.read()
-+    # temporary fix for https://github.com/pypa/pip/issues/1376
-+    # we need to ignore files under ".data" directory
-+    data_dir = os.path.dirname(record_relpath).strip(os.path.sep)
-+    data_dir = data_dir[:-len('dist-info')] + 'data'
-+
-+    to_write = []
-+    to_omit = []
-+    for l in record_contents.splitlines():
-+        spl = l.split(',')
-+        if len(spl) == 3:
-+            # new record will omit (or write differently):
-+            # - abs paths, paths with ".." (entry points),
-+            # - pyc+pyo files
-+            # - the old RECORD file
-+            # TODO: is there any better way to recognize an entry point?
-+            if os.path.isabs(spl[0]) or spl[0].startswith('..') or \
-+               spl[0].endswith('.pyc') or spl[0].endswith('.pyo') or \
-+               spl[0] == record_relpath or spl[0].startswith(data_dir):
-+                to_omit.append(spl)
-+            else:
-+                to_write.append(spl)
-+        else:
-+            pass # bad RECORD or empty line
-+    return to_write, to_omit
-diff --git a/Makefile.pre.in b/Makefile.pre.in
-index 877698c..2c43611 100644
---- a/Makefile.pre.in
-+++ b/Makefile.pre.in
-@@ -1065,7 +1065,7 @@ LIBSUBDIRS=	lib-tk lib-tk/test lib-tk/test/test_tkinter \
- 		test/tracedmodules \
- 		encodings compiler hotshot \
- 		email email/mime email/test email/test/data \
--		ensurepip ensurepip/_bundled \
-+		ensurepip ensurepip/_bundled ensurepip/rewheel\
- 		json json/tests \
- 		sqlite3 sqlite3/test \
- 		logging bsddb bsddb/test csv importlib wsgiref \

SOURCES/00288-ambiguous-python-version-rpmbuild-warn.patch

@@ -0,0 +1,53 @@
+diff -U3 -r Python-2.7.14.orig/Lib/site.py Python-2.7.14/Lib/site.py
+--- Python-2.7.14.orig/Lib/site.py	2018-01-29 15:05:04.517599815 +0100
++++ Python-2.7.14/Lib/site.py	2018-01-30 09:13:17.305270500 +0100
+@@ -515,6 +515,41 @@
+                 "'import usercustomize' failed; use -v for traceback"
+ 
+ 
++def handle_ambiguous_python_version():
++    """Warn or fail if /usr/bin/python is used
++
++    Behavior depends on the value of PYTHON_DISALLOW_AMBIGUOUS_VERSION:
++    - "warn" - print warning to stderr
++    - "1" - print error and exit with positive exit code
++    - otherwise: do nothing
++
++    This is a Fedora modification, see the Change page for details:
++    See https://fedoraproject.org/wiki/Changes/Avoid_usr_bin_python_in_RPM_Build
++    """
++    if sys.executable == "/usr/bin/python":
++        setting = os.environ.get("PYTHON_DISALLOW_AMBIGUOUS_VERSION")
++        if setting == 'warn':
++            print>>sys.stderr, (
++                "DEPRECATION WARNING: python2 invoked with /usr/bin/python.\n"
++                "    Use /usr/bin/python3 or /usr/bin/python2\n"
++                "    /usr/bin/python will be removed or switched to Python 3"
++                    " in the future.\n"
++                "    If you cannot make the switch now, please follow"
++                    " instructions at"
++                    " https://fedoraproject.org/wiki/Changes/"
++                    "Avoid_usr_bin_python_in_RPM_Build#Quick_Opt-Out")
++        elif setting == '1':
++            print>>sys.stderr, (
++                "ERROR: python2 invoked with /usr/bin/python.\n"
++                "    Use /usr/bin/python3 or /usr/bin/python2\n"
++                "    /usr/bin/python will be switched to Python 3"
++                    " in the future.\n"
++                "    More details are at"
++                    " https://fedoraproject.org/wiki/Changes/"
++                    "Avoid_usr_bin_python_in_RPM_Build#Quick_Opt-Out")
++            exit(1)
++
++
+ def main():
+     global ENABLE_USER_SITE
+ 
+@@ -543,6 +578,7 @@
+     # this module is run as a script, because this code is executed twice.
+     if hasattr(sys, "setdefaultencoding"):
+         del sys.setdefaultencoding
++    handle_ambiguous_python_version()
+ 
+ main()
+ 

SOURCES/00288-disable-python2.patch

@@ -1,52 +0,0 @@
---- Python-2.7.15-orig/Python/pythonrun.c
-+++ Python-2.7.15/Python/pythonrun.c
-@@ -180,6 +182,49 @@
-     char buf[128];
- #endif
-     extern void _Py_ReadyTypes(void);
-+    char *py2_allow_flag = getenv("RHEL_ALLOW_PYTHON2_FOR_BUILD");
-+
-+    // Fail unless a specific workaround is applied
-+    if ((!py2_allow_flag || strcmp(py2_allow_flag, "1") != 0)
-+        && (strstr(Py_GetProgramName(), "for-tests") == NULL)
-+    ) {
-+        fprintf(stderr,
-+            "\n"
-+            "ERROR: Python 2 is disabled in RHEL8.\n"
-+            "\n"
-+            "- For guidance on porting to Python 3, see the\n"
-+            "    Conservative Python3 Porting Guide:\n"
-+            "    http://portingguide.readthedocs.io/\n"
-+            "\n"
-+            "- If you need Python 2 at runtime:\n"
-+            "   - Use the python27 module\n"
-+            "\n"
-+            "- If you do not have access to BZ#1533919:\n"
-+            "   - Use the python27 module\n"
-+            "\n"
-+            "- If you need to use Python 2 only at RPM build time:\n"
-+            "   - File a bug blocking BZ#1533919:\n"
-+            "       https://bugzilla.redhat.com/show_bug.cgi?id=1533919\n"
-+            "   - Set the environment variable RHEL_ALLOW_PYTHON2_FOR_BUILD=1\n"
-+            "       (Note that if you do not file the bug as above,\n"
-+            "       this workaround will break without warning in the future.)\n"
-+            "\n"
-+            "- If you need to use Python 2 only for tests:\n"
-+            "   - File a bug blocking BZ#1533919:\n"
-+            "       https://bugzilla.redhat.com/show_bug.cgi?id=1533919\n"
-+            "     (If your test tool does not have a Bugzilla component,\n"
-+            "        feel free to use `python2`.)\n"
-+            "   - Use /usr/bin/python2-for-tests instead of python2 to run\n"
-+            "       your tests.\n"
-+            "       (Note that if you do not file the bug as above,\n"
-+            "       this workaround will break without warning in the future.)\n"
-+            "\n"
-+            "For details, see https://hurl.corp.redhat.com/rhel8-py2\n"
-+            "\n"
-+        );
-+        fflush(stderr);
-+        Py_FatalError("Python 2 is disabled");
-+    }
- 
-     if (initialized)
-         return;

SOURCES/00351-cve-2019-20907-fix-infinite-loop-in-tarfile.patch

@@ -0,0 +1,70 @@
+From b099ce737f6e6cc9f3a1bf756af78eaa1c1480cd Mon Sep 17 00:00:00 2001
+From: Rishi <rishi_devan@mail.com>
+Date: Wed, 15 Jul 2020 13:51:00 +0200
+Subject: [PATCH] 00351-cve-2019-20907-fix-infinite-loop-in-tarfile.patch
+
+00351 #
+Avoid infinite loop when reading specially crafted TAR files using the tarfile module
+(CVE-2019-20907).
+See: https://bugs.python.org/issue39017
+---
+ Lib/tarfile.py                                    |   2 ++
+ Lib/test/recursion.tar                            | Bin 0 -> 516 bytes
+ Lib/test/test_tarfile.py                          |   7 +++++++
+ .../2020-07-12-22-16-58.bpo-39017.x3Cg-9.rst      |   1 +
+ 4 files changed, 10 insertions(+)
+ create mode 100644 Lib/test/recursion.tar
+ create mode 100644 Misc/NEWS.d/next/Library/2020-07-12-22-16-58.bpo-39017.x3Cg-9.rst
+
+diff --git a/Lib/tarfile.py b/Lib/tarfile.py
+index adf91d5..574a6bb 100644
+--- a/Lib/tarfile.py
++++ b/Lib/tarfile.py
+@@ -1400,6 +1400,8 @@ class TarInfo(object):
+ 
+             length, keyword = match.groups()
+             length = int(length)
++            if length == 0:
++                raise InvalidHeaderError("invalid header")
+             value = buf[match.end(2) + 1:match.start(1) + length - 1]
+ 
+             keyword = keyword.decode("utf8")
+diff --git a/Lib/test/recursion.tar b/Lib/test/recursion.tar
+new file mode 100644
+index 0000000000000000000000000000000000000000..b8237251964983f54ed1966297e887636cd0c5f4
+GIT binary patch
+literal 516
+zcmYdFPRz+kEn=W0Fn}74P8%Xw3X=l~85kIuo0>8xq$A1Gm}!7)KUsFc41m#O8A5+e
+I1_}|j06>QaCIA2c
+
+literal 0
+HcmV?d00001
+
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index 89bd738..4592156 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -325,6 +325,13 @@ class CommonReadTest(ReadTest):
+ class MiscReadTest(CommonReadTest):
+     taropen = tarfile.TarFile.taropen
+ 
++    def test_length_zero_header(self):
++        # bpo-39017 (CVE-2019-20907): reading a zero-length header should fail
++        # with an exception
++        with self.assertRaisesRegexp(tarfile.ReadError, "file could not be opened successfully"):
++            with tarfile.open(support.findfile('recursion.tar')) as tar:
++                pass
++
+     def test_no_name_argument(self):
+         with open(self.tarname, "rb") as fobj:
+             tar = tarfile.open(fileobj=fobj, mode=self.mode)
+diff --git a/Misc/NEWS.d/next/Library/2020-07-12-22-16-58.bpo-39017.x3Cg-9.rst b/Misc/NEWS.d/next/Library/2020-07-12-22-16-58.bpo-39017.x3Cg-9.rst
+new file mode 100644
+index 0000000..ad26676
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2020-07-12-22-16-58.bpo-39017.x3Cg-9.rst
+@@ -0,0 +1 @@
++Avoid infinite loop when reading specially crafted TAR files using the tarfile module (CVE-2019-20907).
+-- 
+2.25.4
+

SOURCES/00354-cve-2020-26116-http-request-method-crlf-injection-in-httplib.patch

@@ -0,0 +1,88 @@
+diff --git a/Lib/httplib.py b/Lib/httplib.py
+index fcc4152..a636774 100644
+--- a/Lib/httplib.py
++++ b/Lib/httplib.py
+@@ -257,6 +257,10 @@ _contains_disallowed_url_pchar_re = re.compile('[\x00-\x20\x7f-\xff]')
+ #  _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$")
+ # We are more lenient for assumed real world compatibility purposes.
+ 
++# These characters are not allowed within HTTP method names
++# to prevent http header injection.
++_contains_disallowed_method_pchar_re = re.compile('[\x00-\x1f]')
++
+ # We always set the Content-Length header for these methods because some
+ # servers will otherwise respond with a 411
+ _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'}
+@@ -935,6 +939,8 @@ class HTTPConnection:
+         else:
+             raise CannotSendRequest()
+ 
++        self._validate_method(method)
++
+         # Save the method for use later in the response phase
+         self._method = method
+ 
+@@ -1020,6 +1026,16 @@ class HTTPConnection:
+         # On Python 2, request is already encoded (default)
+         return request
+ 
++    def _validate_method(self, method):
++        """Validate a method name for putrequest."""
++        # prevent http header injection
++        match = _contains_disallowed_method_pchar_re.search(method)
++        if match:
++            raise ValueError(
++                    "method can't contain control characters. %r "
++                    "(found at least %r)"
++                    % (method, match.group()))
++
+     def _validate_path(self, url):
+         """Validate a url for putrequest."""
+         # Prevent CVE-2019-9740.
+diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
+index d8a57f7..96a61dd 100644
+--- a/Lib/test/test_httplib.py
++++ b/Lib/test/test_httplib.py
+@@ -385,6 +385,29 @@ class HeaderTests(TestCase):
+                 conn.putheader(name, value)
+ 
+ 
++class HttpMethodTests(TestCase):
++    def test_invalid_method_names(self):
++        methods = (
++            'GET\r',
++            'POST\n',
++            'PUT\n\r',
++            'POST\nValue',
++            'POST\nHOST:abc',
++            'GET\nrHost:abc\n',
++            'POST\rRemainder:\r',
++            'GET\rHOST:\n',
++            '\nPUT'
++        )
++
++        for method in methods:
++            with self.assertRaisesRegexp(
++                    ValueError, "method can't contain control characters"):
++                conn = httplib.HTTPConnection('example.com')
++                conn.sock = FakeSocket(None)
++                conn.request(method=method, url="/")
++
++
++
+ class BasicTest(TestCase):
+     def test_status_lines(self):
+         # Test HTTP status lines
+@@ -1009,9 +1032,9 @@ class TunnelTests(TestCase):
+ 
+ @test_support.reap_threads
+ def test_main(verbose=None):
+-    test_support.run_unittest(HeaderTests, OfflineTest, BasicTest, TimeoutTest,
+-                              HTTPTest, HTTPSTest, SourceAddressTest,
+-                              TunnelTests)
++    test_support.run_unittest(HeaderTests, OfflineTest, HttpMethodTests,
++                              BasicTest, TimeoutTest, HTTPTest, HTTPSTest,
++                              SourceAddressTest, TunnelTests)
+ 
+ if __name__ == '__main__':
+     test_main()

SOURCES/00355-CVE-2020-27619.patch

@@ -0,0 +1,42 @@
+diff --git a/Lib/test/multibytecodec_support.py b/Lib/test/multibytecodec_support.py
+index 5b2329b6d84..53b5d64d453 100644
+--- a/Lib/test/multibytecodec_support.py
++++ b/Lib/test/multibytecodec_support.py
+@@ -279,30 +279,22 @@ class TestBase_Mapping(unittest.TestCase):
+             self._test_mapping_file_plain()
+ 
+     def _test_mapping_file_plain(self):
+-        _unichr = lambda c: eval("u'\\U%08x'" % int(c, 16))
+-        unichrs = lambda s: u''.join(_unichr(c) for c in s.split('+'))
++        def unichrs(s):
++            return ''.join(unichr(int(x, 16)) for x in s.split('+'))
+         urt_wa = {}
+ 
+         with self.open_mapping_file() as f:
+             for line in f:
+                 if not line:
+                     break
+-                data = line.split('#')[0].strip().split()
++                data = line.split('#')[0].split()
+                 if len(data) != 2:
+                     continue
+ 
+-                csetval = eval(data[0])
+-                if csetval <= 0x7F:
+-                    csetch = chr(csetval & 0xff)
+-                elif csetval >= 0x1000000:
+-                    csetch = chr(csetval >> 24) + chr((csetval >> 16) & 0xff) + \
+-                             chr((csetval >> 8) & 0xff) + chr(csetval & 0xff)
+-                elif csetval >= 0x10000:
+-                    csetch = chr(csetval >> 16) + \
+-                             chr((csetval >> 8) & 0xff) + chr(csetval & 0xff)
+-                elif csetval >= 0x100:
+-                    csetch = chr(csetval >> 8) + chr(csetval & 0xff)
+-                else:
++                if data[0][:2] != '0x':
++                    self.fail("Invalid line: {!r}".format(line))
++                csetch = bytes.fromhex(data[0][2:])
++                if len(csetch) == 1 and 0x80 <= csetch[0]:
+                     continue
+ 
+                 unich = unichrs(data[1])

SOURCES/00357-CVE-2021-3177.patch

@@ -0,0 +1,181 @@
+commit 30e41798f40c684be57d7ccfebf5c6ad94c0ff97
+Author: Petr Viktorin <pviktori@redhat.com>
+Date:   Wed Jan 20 15:21:43 2021 +0100
+
+    CVE-2021-3177: Replace snprintf with Python unicode formatting in ctypes param reprs
+    
+    Backport of Python3 commit 916610ef90a0d0761f08747f7b0905541f0977c7:
+    https://bugs.python.org/issue42938
+    https://github.com/python/cpython/pull/24239
+
+diff --git a/Lib/ctypes/test/test_parameters.py b/Lib/ctypes/test/test_parameters.py
+index 23c1b6e2259..77300d71ae1 100644
+--- a/Lib/ctypes/test/test_parameters.py
++++ b/Lib/ctypes/test/test_parameters.py
+@@ -206,6 +206,49 @@ class SimpleTypesTestCase(unittest.TestCase):
+         with self.assertRaises(ZeroDivisionError):
+             WorseStruct().__setstate__({}, b'foo')
+ 
++    def test_parameter_repr(self):
++        from ctypes import (
++            c_bool,
++            c_char,
++            c_wchar,
++            c_byte,
++            c_ubyte,
++            c_short,
++            c_ushort,
++            c_int,
++            c_uint,
++            c_long,
++            c_ulong,
++            c_longlong,
++            c_ulonglong,
++            c_float,
++            c_double,
++            c_longdouble,
++            c_char_p,
++            c_wchar_p,
++            c_void_p,
++        )
++        self.assertRegexpMatches(repr(c_bool.from_param(True)), r"^<cparam '\?' at 0x[A-Fa-f0-9]+>$")
++        self.assertEqual(repr(c_char.from_param('a')), "<cparam 'c' ('a')>")
++        self.assertRegexpMatches(repr(c_wchar.from_param('a')), r"^<cparam 'u' at 0x[A-Fa-f0-9]+>$")
++        self.assertEqual(repr(c_byte.from_param(98)), "<cparam 'b' (98)>")
++        self.assertEqual(repr(c_ubyte.from_param(98)), "<cparam 'B' (98)>")
++        self.assertEqual(repr(c_short.from_param(511)), "<cparam 'h' (511)>")
++        self.assertEqual(repr(c_ushort.from_param(511)), "<cparam 'H' (511)>")
++        self.assertRegexpMatches(repr(c_int.from_param(20000)), r"^<cparam '[li]' \(20000\)>$")
++        self.assertRegexpMatches(repr(c_uint.from_param(20000)), r"^<cparam '[LI]' \(20000\)>$")
++        self.assertRegexpMatches(repr(c_long.from_param(20000)), r"^<cparam '[li]' \(20000\)>$")
++        self.assertRegexpMatches(repr(c_ulong.from_param(20000)), r"^<cparam '[LI]' \(20000\)>$")
++        self.assertRegexpMatches(repr(c_longlong.from_param(20000)), r"^<cparam '[liq]' \(20000\)>$")
++        self.assertRegexpMatches(repr(c_ulonglong.from_param(20000)), r"^<cparam '[LIQ]' \(20000\)>$")
++        self.assertEqual(repr(c_float.from_param(1.5)), "<cparam 'f' (1.5)>")
++        self.assertEqual(repr(c_double.from_param(1.5)), "<cparam 'd' (1.5)>")
++        self.assertEqual(repr(c_double.from_param(1e300)), "<cparam 'd' (1e+300)>")
++        self.assertRegexpMatches(repr(c_longdouble.from_param(1.5)), r"^<cparam ('d' \(1.5\)|'g' at 0x[A-Fa-f0-9]+)>$")
++        self.assertRegexpMatches(repr(c_char_p.from_param(b'hihi')), "^<cparam 'z' \(0x[A-Fa-f0-9]+\)>$")
++        self.assertRegexpMatches(repr(c_wchar_p.from_param('hihi')), "^<cparam 'Z' \(0x[A-Fa-f0-9]+\)>$")
++        self.assertRegexpMatches(repr(c_void_p.from_param(0x12)), r"^<cparam 'P' \(0x0*12\)>$")
++
+ ################################################################
+ 
+ if __name__ == '__main__':
+diff --git a/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst b/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
+new file mode 100644
+index 00000000000..7df65a156fe
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
+@@ -0,0 +1,2 @@
++Avoid static buffers when computing the repr of :class:`ctypes.c_double` and
++:class:`ctypes.c_longdouble` values.
+diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c
+index 066fefc0cca..5cc3c4cf685 100644
+--- a/Modules/_ctypes/callproc.c
++++ b/Modules/_ctypes/callproc.c
+@@ -460,50 +460,62 @@ PyCArg_dealloc(PyCArgObject *self)
+ static PyObject *
+ PyCArg_repr(PyCArgObject *self)
+ {
+-    char buffer[256];
+     switch(self->tag) {
+     case 'b':
+     case 'B':
+-        sprintf(buffer, "<cparam '%c' (%d)>",
++        return PyString_FromFormat("<cparam '%c' (%d)>",
+             self->tag, self->value.b);
+-        break;
+     case 'h':
+     case 'H':
+-        sprintf(buffer, "<cparam '%c' (%d)>",
++        return PyString_FromFormat("<cparam '%c' (%d)>",
+             self->tag, self->value.h);
+-        break;
+     case 'i':
+     case 'I':
+-        sprintf(buffer, "<cparam '%c' (%d)>",
++        return PyString_FromFormat("<cparam '%c' (%d)>",
+             self->tag, self->value.i);
+-        break;
+     case 'l':
+     case 'L':
+-        sprintf(buffer, "<cparam '%c' (%ld)>",
++        return PyString_FromFormat("<cparam '%c' (%ld)>",
+             self->tag, self->value.l);
+-        break;
+ 
+ #ifdef HAVE_LONG_LONG
+     case 'q':
+     case 'Q':
+-        sprintf(buffer,
+-            "<cparam '%c' (%" PY_FORMAT_LONG_LONG "d)>",
++        return PyString_FromFormat("<cparam '%c' (%lld)>",
+             self->tag, self->value.q);
+-        break;
+ #endif
+     case 'd':
+-        sprintf(buffer, "<cparam '%c' (%f)>",
+-            self->tag, self->value.d);
+-        break;
+-    case 'f':
+-        sprintf(buffer, "<cparam '%c' (%f)>",
+-            self->tag, self->value.f);
+-        break;
+-
++    case 'f': {
++        PyObject *s = PyString_FromFormat("<cparam '%c' (", self->tag);
++        if (s == NULL) {
++            return NULL;
++        }
++        PyObject *f = PyFloat_FromDouble((self->tag == 'f') ? self->value.f : self->value.d);
++        if (f == NULL) {
++            Py_DECREF(s);
++            return NULL;
++        }
++        PyObject *r = PyObject_Repr(f);
++        Py_DECREF(f);
++        if (r == NULL) {
++            Py_DECREF(s);
++            return NULL;
++        }
++        PyString_ConcatAndDel(&s, r);
++        if (s == NULL) {
++            return NULL;
++        }
++        r = PyString_FromString(")>");
++        if (r == NULL) {
++            Py_DECREF(s);
++            return NULL;
++        }
++        PyString_ConcatAndDel(&s, r);
++        return s;
++    }
+     case 'c':
+-        sprintf(buffer, "<cparam '%c' (%c)>",
++        return PyString_FromFormat("<cparam '%c' ('%c')>",
+             self->tag, self->value.c);
+-        break;
+ 
+ /* Hm, are these 'z' and 'Z' codes useful at all?
+    Shouldn't they be replaced by the functionality of c_string
+@@ -512,16 +524,13 @@ PyCArg_repr(PyCArgObject *self)
+     case 'z':
+     case 'Z':
+     case 'P':
+-        sprintf(buffer, "<cparam '%c' (%p)>",
++        return PyUnicode_FromFormat("<cparam '%c' (%p)>",
+             self->tag, self->value.p);
+-        break;
+ 
+     default:
+-        sprintf(buffer, "<cparam '%c' at %p>",
+-            self->tag, self);
+-        break;
++        return PyString_FromFormat("<cparam '%c' at %p>",
++            (unsigned char)self->tag, (void *)self);
+     }
+-    return PyString_FromString(buffer);
+ }
+ 
+ static PyMemberDef PyCArgType_members[] = {

SOURCES/00359-CVE-2021-23336.patch

@@ -0,0 +1,707 @@
+From 976a4010aa4e450855dce5fa4c865bcbdc86cccd Mon Sep 17 00:00:00 2001
+From: Charalampos Stratakis <cstratak@redhat.com>
+Date: Fri, 16 Apr 2021 18:02:00 +0200
+Subject: [PATCH] CVE-2021-23336: Add `separator` argument to parse_qs; warn
+ with default
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Partially backports https://bugs.python.org/issue42967 : [security] Address a web cache-poisoning issue reported in urllib.parse.parse_qsl().
+
+Backported from the python3 branch.
+However, this solution is different than the upstream solution in Python 3.
+
+Based on the downstream solution for python 3.6.13 by Petr Viktorin.
+
+An optional argument seperator is added to specify the separator.
+It is recommended to set it to '&' or ';' to match the application or proxy in use.
+The default can be set with an env variable of a config file.
+If neither the argument, env var or config file specifies a separator, "&" is used
+but a warning is raised if parse_qs is used on input that contains ';'.
+
+Co-authors of the downstream change:
+Co-authored-by: Petr Viktorin <pviktori@redhat.com>
+Co-authors of the upstream change (who do not necessarily agree with this):
+Co-authored-by: Adam Goldschmidt <adamgold7@gmail.com>
+Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
+Co-authored-by: Éric Araujo <merwok@netwok.org>
+---
+ Doc/library/cgi.rst       |   5 +-
+ Doc/library/urlparse.rst  |  15 ++-
+ Lib/cgi.py                |  34 +++---
+ Lib/test/test_cgi.py      |  59 ++++++++++-
+ Lib/test/test_urlparse.py | 210 +++++++++++++++++++++++++++++++++++++-
+ Lib/urlparse.py           |  78 +++++++++++++-
+ 6 files changed, 369 insertions(+), 32 deletions(-)
+
+diff --git a/Doc/library/cgi.rst b/Doc/library/cgi.rst
+index ecd62c8c019..a96cd38717b 100644
+--- a/Doc/library/cgi.rst
++++ b/Doc/library/cgi.rst
+@@ -285,10 +285,10 @@ These are useful if you want more control, or if you want to employ some of the
+ algorithms implemented in this module in other circumstances.
+ 
+ 
+-.. function:: parse(fp[, environ[, keep_blank_values[, strict_parsing]]])
++.. function:: parse(fp[, environ[, keep_blank_values[, strict_parsing[, separator]]]])
+ 
+    Parse a query in the environment or from a file (the file defaults to
+-   ``sys.stdin`` and environment defaults to ``os.environ``).  The *keep_blank_values* and *strict_parsing* parameters are
++   ``sys.stdin`` and environment defaults to ``os.environ``).  The *keep_blank_values*, *strict_parsing* and *separator* parameters are
+    passed to :func:`urlparse.parse_qs` unchanged.
+ 
+ 
+@@ -316,7 +316,6 @@ algorithms implemented in this module in other circumstances.
+    Note that this does not parse nested multipart parts --- use
+    :class:`FieldStorage` for that.
+ 
+-
+ .. function:: parse_header(string)
+ 
+    Parse a MIME header (such as :mailheader:`Content-Type`) into a main value and a
+diff --git a/Doc/library/urlparse.rst b/Doc/library/urlparse.rst
+index 0989c88c302..97d1119257c 100644
+--- a/Doc/library/urlparse.rst
++++ b/Doc/library/urlparse.rst
+@@ -136,7 +136,7 @@ The :mod:`urlparse` module defines the following functions:
+       now raise :exc:`ValueError`.
+ 
+ 
+-.. function:: parse_qs(qs[, keep_blank_values[, strict_parsing[, max_num_fields]]])
++.. function:: parse_qs(qs[, keep_blank_values[, strict_parsing[, max_num_fields[, separator]]]])
+ 
+    Parse a query string given as a string argument (data of type
+    :mimetype:`application/x-www-form-urlencoded`).  Data are returned as a
+@@ -157,6 +157,15 @@ The :mod:`urlparse` module defines the following functions:
+    read. If set, then throws a :exc:`ValueError` if there are more than
+    *max_num_fields* fields read.
+ 
++   The optional argument *separator* is the symbol to use for separating the
++   query arguments. It is recommended to set it to ``'&'`` or ``';'``.
++   It defaults to ``'&'``; a warning is raised if this default is used.
++   This default may be changed with the following environment variable settings:
++
++   - ``PYTHON_URLLIB_QS_SEPARATOR='&'``: use only ``&`` as separator, without warning (as in Python 3.6.13+ or 3.10)
++   - ``PYTHON_URLLIB_QS_SEPARATOR=';'``: use only ``;`` as separator
++   - ``PYTHON_URLLIB_QS_SEPARATOR=legacy``: use both ``&`` and ``;`` (as in previous versions of Python)
++
+    Use the :func:`urllib.urlencode` function to convert such dictionaries into
+    query strings.
+ 
+@@ -186,6 +195,9 @@ The :mod:`urlparse` module defines the following functions:
+    read. If set, then throws a :exc:`ValueError` if there are more than
+    *max_num_fields* fields read.
+ 
++   The optional argument *separator* is the symbol to use for separating the
++   query arguments. It works as in :py:func:`parse_qs`.
++
+    Use the :func:`urllib.urlencode` function to convert such lists of pairs into
+    query strings.
+ 
+@@ -195,6 +207,7 @@ The :mod:`urlparse` module defines the following functions:
+    .. versionchanged:: 2.7.16
+       Added *max_num_fields* parameter.
+ 
++
+ .. function:: urlunparse(parts)
+ 
+    Construct a URL from a tuple as returned by ``urlparse()``. The *parts* argument
+diff --git a/Lib/cgi.py b/Lib/cgi.py
+index 5b903e03477..1421f2d90e0 100755
+--- a/Lib/cgi.py
++++ b/Lib/cgi.py
+@@ -121,7 +121,8 @@ log = initlog           # The current logging function
+ # 0 ==> unlimited input
+ maxlen = 0
+ 
+-def parse(fp=None, environ=os.environ, keep_blank_values=0, strict_parsing=0):
++def parse(fp=None, environ=os.environ, keep_blank_values=0,
++          strict_parsing=0, separator=None):
+     """Parse a query in the environment or from a file (default stdin)
+ 
+         Arguments, all optional:
+@@ -140,6 +141,8 @@ def parse(fp=None, environ=os.environ, keep_blank_values=0, strict_parsing=0):
+         strict_parsing: flag indicating what to do with parsing errors.
+             If false (the default), errors are silently ignored.
+             If true, errors raise a ValueError exception.
++
++        separator: str. The symbol to use for separating the query arguments.
+     """
+     if fp is None:
+         fp = sys.stdin
+@@ -171,25 +174,26 @@ def parse(fp=None, environ=os.environ, keep_blank_values=0, strict_parsing=0):
+         else:
+             qs = ""
+         environ['QUERY_STRING'] = qs    # XXX Shouldn't, really
+-    return urlparse.parse_qs(qs, keep_blank_values, strict_parsing)
++    return urlparse.parse_qs(qs, keep_blank_values, strict_parsing, separator=separator)
+ 
+ 
+ # parse query string function called from urlparse,
+ # this is done in order to maintain backward compatibility.
+ 
+-def parse_qs(qs, keep_blank_values=0, strict_parsing=0):
++def parse_qs(qs, keep_blank_values=0, strict_parsing=0, separator=None):
+     """Parse a query given as a string argument."""
+     warn("cgi.parse_qs is deprecated, use urlparse.parse_qs instead",
+          PendingDeprecationWarning, 2)
+-    return urlparse.parse_qs(qs, keep_blank_values, strict_parsing)
++    return urlparse.parse_qs(qs, keep_blank_values, strict_parsing,
++                             separator=separator)
+ 
+ 
+-def parse_qsl(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None):
++def parse_qsl(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None, separator=None):
+     """Parse a query given as a string argument."""
+     warn("cgi.parse_qsl is deprecated, use urlparse.parse_qsl instead",
+          PendingDeprecationWarning, 2)
+     return urlparse.parse_qsl(qs, keep_blank_values, strict_parsing,
+-                              max_num_fields)
++                              max_num_fields, separator=separator)
+ 
+ def parse_multipart(fp, pdict):
+     """Parse multipart input.
+@@ -288,7 +292,6 @@ def parse_multipart(fp, pdict):
+ 
+     return partdict
+ 
+-
+ def _parseparam(s):
+     while s[:1] == ';':
+         s = s[1:]
+@@ -395,7 +398,7 @@ class FieldStorage:
+ 
+     def __init__(self, fp=None, headers=None, outerboundary="",
+                  environ=os.environ, keep_blank_values=0, strict_parsing=0,
+-                 max_num_fields=None):
++                 max_num_fields=None, separator=None):
+         """Constructor.  Read multipart/* until last part.
+ 
+         Arguments, all optional:
+@@ -430,6 +433,7 @@ class FieldStorage:
+         self.keep_blank_values = keep_blank_values
+         self.strict_parsing = strict_parsing
+         self.max_num_fields = max_num_fields
++        self.separator = separator
+         if 'REQUEST_METHOD' in environ:
+             method = environ['REQUEST_METHOD'].upper()
+         self.qs_on_post = None
+@@ -613,7 +617,8 @@ class FieldStorage:
+         if self.qs_on_post:
+             qs += '&' + self.qs_on_post
+         query = urlparse.parse_qsl(qs, self.keep_blank_values,
+-                                   self.strict_parsing, self.max_num_fields)
++                                   self.strict_parsing, self.max_num_fields,
++                                   self.separator)
+         self.list = [MiniFieldStorage(key, value) for key, value in query]
+         self.skip_lines()
+ 
+@@ -629,7 +634,8 @@ class FieldStorage:
+             query = urlparse.parse_qsl(self.qs_on_post,
+                                        self.keep_blank_values,
+                                        self.strict_parsing,
+-                                       self.max_num_fields)
++                                       self.max_num_fields,
++                                       self.separator)
+             self.list.extend(MiniFieldStorage(key, value)
+                              for key, value in query)
+             FieldStorageClass = None
+@@ -649,7 +655,8 @@ class FieldStorage:
+             headers = rfc822.Message(self.fp)
+             part = klass(self.fp, headers, ib,
+                          environ, keep_blank_values, strict_parsing,
+-                         max_num_fields)
++                         max_num_fields,
++                         separator=self.separator)
+ 
+             if max_num_fields is not None:
+                 max_num_fields -= 1
+@@ -817,10 +824,11 @@ class FormContentDict(UserDict.UserDict):
+     form.dict == {key: [val, val, ...], ...}
+ 
+     """
+-    def __init__(self, environ=os.environ, keep_blank_values=0, strict_parsing=0):
++    def __init__(self, environ=os.environ, keep_blank_values=0, strict_parsing=0, separator=None):
+         self.dict = self.data = parse(environ=environ,
+                                       keep_blank_values=keep_blank_values,
+-                                      strict_parsing=strict_parsing)
++                                      strict_parsing=strict_parsing,
++                                      separator=separator)
+         self.query_string = environ['QUERY_STRING']
+ 
+ 
+diff --git a/Lib/test/test_cgi.py b/Lib/test/test_cgi.py
+index 743c2afbd4c..9956ea9d4e8 100644
+--- a/Lib/test/test_cgi.py
++++ b/Lib/test/test_cgi.py
+@@ -61,12 +61,9 @@ parse_strict_test_cases = [
+     ("", ValueError("bad query field: ''")),
+     ("&", ValueError("bad query field: ''")),
+     ("&&", ValueError("bad query field: ''")),
+-    (";", ValueError("bad query field: ''")),
+-    (";&;", ValueError("bad query field: ''")),
+     # Should the next few really be valid?
+     ("=", {}),
+     ("=&=", {}),
+-    ("=;=", {}),
+     # This rest seem to make sense
+     ("=a", {'': ['a']}),
+     ("&=a", ValueError("bad query field: ''")),
+@@ -81,8 +78,6 @@ parse_strict_test_cases = [
+     ("a=a+b&b=b+c", {'a': ['a b'], 'b': ['b c']}),
+     ("a=a+b&a=b+a", {'a': ['a b', 'b a']}),
+     ("x=1&y=2.0&z=2-3.%2b0", {'x': ['1'], 'y': ['2.0'], 'z': ['2-3.+0']}),
+-    ("x=1;y=2.0&z=2-3.%2b0", {'x': ['1'], 'y': ['2.0'], 'z': ['2-3.+0']}),
+-    ("x=1;y=2.0;z=2-3.%2b0", {'x': ['1'], 'y': ['2.0'], 'z': ['2-3.+0']}),
+     ("Hbc5161168c542333633315dee1182227:key_store_seqid=400006&cuyer=r&view=bustomer&order_id=0bb2e248638833d48cb7fed300000f1b&expire=964546263&lobale=en-US&kid=130003.300038&ss=env",
+      {'Hbc5161168c542333633315dee1182227:key_store_seqid': ['400006'],
+       'cuyer': ['r'],
+@@ -177,6 +172,60 @@ class CgiTests(unittest.TestCase):
+                         self.assertItemsEqual(sd.items(),
+                                                 first_second_elts(expect.items()))
+ 
++    def test_separator(self):
++        parse_semicolon = [
++            ("x=1;y=2.0", {'x': ['1'], 'y': ['2.0']}),
++            ("x=1;y=2.0;z=2-3.%2b0", {'x': ['1'], 'y': ['2.0'], 'z': ['2-3.+0']}),
++            (";", ValueError("bad query field: ''")),
++            (";;", ValueError("bad query field: ''")),
++            ("=;a", ValueError("bad query field: 'a'")),
++            (";b=a", ValueError("bad query field: ''")),
++            ("b;=a", ValueError("bad query field: 'b'")),
++            ("a=a+b;b=b+c", {'a': ['a b'], 'b': ['b c']}),
++            ("a=a+b;a=b+a", {'a': ['a b', 'b a']}),
++        ]
++        for orig, expect in parse_semicolon:
++            env = {'QUERY_STRING': orig}
++            fcd = cgi.FormContentDict(env, separator=';')
++            sd = cgi.SvFormContentDict(env, separator=';')
++            fs = cgi.FieldStorage(environ=env, separator=';')
++            if isinstance(expect, dict):
++                # test dict interface
++                self.assertEqual(len(expect), len(fcd))
++                self.assertItemsEqual(expect.keys(), fcd.keys())
++                self.assertItemsEqual(expect.values(), fcd.values())
++                self.assertItemsEqual(expect.items(), fcd.items())
++                self.assertEqual(fcd.get("nonexistent field", "default"), "default")
++                self.assertEqual(len(sd), len(fs))
++                self.assertItemsEqual(sd.keys(), fs.keys())
++                self.assertEqual(fs.getvalue("nonexistent field", "default"), "default")
++                # test individual fields
++                for key in expect.keys():
++                    expect_val = expect[key]
++                    self.assertTrue(fcd.has_key(key))
++                    self.assertItemsEqual(fcd[key], expect[key])
++                    self.assertEqual(fcd.get(key, "default"), fcd[key])
++                    self.assertTrue(fs.has_key(key))
++                    if len(expect_val) > 1:
++                        single_value = 0
++                    else:
++                        single_value = 1
++                    try:
++                        val = sd[key]
++                    except IndexError:
++                        self.assertFalse(single_value)
++                        self.assertEqual(fs.getvalue(key), expect_val)
++                    else:
++                        self.assertTrue(single_value)
++                        self.assertEqual(val, expect_val[0])
++                        self.assertEqual(fs.getvalue(key), expect_val[0])
++                    self.assertItemsEqual(sd.getlist(key), expect_val)
++                    if single_value:
++                        self.assertItemsEqual(sd.values(),
++                                                first_elts(expect.values()))
++                        self.assertItemsEqual(sd.items(),
++                                                first_second_elts(expect.items()))
++
+     def test_weird_formcontentdict(self):
+         # Test the weird FormContentDict classes
+         env = {'QUERY_STRING': "x=1&y=2.0&z=2-3.%2b0&1=1abc"}
+diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
+index 86c4a0595c4..21875bb2991 100644
+--- a/Lib/test/test_urlparse.py
++++ b/Lib/test/test_urlparse.py
+@@ -3,6 +3,12 @@ import sys
+ import unicodedata
+ import unittest
+ import urlparse
++from test.support import EnvironmentVarGuard
++from warnings import catch_warnings, filterwarnings
++import tempfile
++import contextlib
++import os.path
++import shutil
+ 
+ RFC1808_BASE = "http://a/b/c/d;p?q#f"
+ RFC2396_BASE = "http://a/b/c/d;p?q"
+@@ -24,16 +30,29 @@ parse_qsl_test_cases = [
+     ("&a=b", [('a', 'b')]),
+     ("a=a+b&b=b+c", [('a', 'a b'), ('b', 'b c')]),
+     ("a=1&a=2", [('a', '1'), ('a', '2')]),
++]
++
++parse_qsl_test_cases_semicolon = [
+     (";", []),
+     (";;", []),
+     (";a=b", [('a', 'b')]),
+     ("a=a+b;b=b+c", [('a', 'a b'), ('b', 'b c')]),
+     ("a=1;a=2", [('a', '1'), ('a', '2')]),
+-    (b";", []),
+-    (b";;", []),
+-    (b";a=b", [(b'a', b'b')]),
+-    (b"a=a+b;b=b+c", [(b'a', b'a b'), (b'b', b'b c')]),
+-    (b"a=1;a=2", [(b'a', b'1'), (b'a', b'2')]),
++]
++
++parse_qsl_test_cases_legacy = [
++    ("a=1;a=2&a=3", [('a', '1'), ('a', '2'), ('a', '3')]),
++    ("a=1;b=2&c=3", [('a', '1'), ('b', '2'), ('c', '3')]),
++    ("a=1&b=2&c=3;", [('a', '1'), ('b', '2'), ('c', '3')]),
++]
++
++parse_qsl_test_cases_warn = [
++    (";a=b", [(';a', 'b')]),
++    ("a=a+b;b=b+c", [('a', 'a b;b=b c')]),
++    (b";a=b", [(b';a', b'b')]),
++    (b"a=a+b;b=b+c", [(b'a', b'a b;b=b c')]),
++    ("a=1;a=2&a=3", [('a', '1;a=2'), ('a', '3')]),
++    (b"a=1;a=2&a=3", [(b'a', b'1;a=2'), (b'a', b'3')]),
+ ]
+ 
+ parse_qs_test_cases = [
+@@ -57,6 +76,9 @@ parse_qs_test_cases = [
+     (b"&a=b", {b'a': [b'b']}),
+     (b"a=a+b&b=b+c", {b'a': [b'a b'], b'b': [b'b c']}),
+     (b"a=1&a=2", {b'a': [b'1', b'2']}),
++]
++
++parse_qs_test_cases_semicolon = [
+     (";", {}),
+     (";;", {}),
+     (";a=b", {'a': ['b']}),
+@@ -69,6 +91,24 @@ parse_qs_test_cases = [
+     (b"a=1;a=2", {b'a': [b'1', b'2']}),
+ ]
+ 
++parse_qs_test_cases_legacy = [
++    ("a=1;a=2&a=3", {'a': ['1', '2', '3']}),
++    ("a=1;b=2&c=3", {'a': ['1'], 'b': ['2'], 'c': ['3']}),
++    ("a=1&b=2&c=3;", {'a': ['1'], 'b': ['2'], 'c': ['3']}),
++    (b"a=1;a=2&a=3", {b'a': [b'1', b'2', b'3']}),
++    (b"a=1;b=2&c=3", {b'a': [b'1'], b'b': [b'2'], b'c': [b'3']}),
++    (b"a=1&b=2&c=3;", {b'a': [b'1'], b'b': [b'2'], b'c': [b'3']}),
++]
++
++parse_qs_test_cases_warn = [
++    (";a=b", {';a': ['b']}),
++    ("a=a+b;b=b+c", {'a': ['a b;b=b c']}),
++    (b";a=b", {b';a': [b'b']}),
++    (b"a=a+b;b=b+c", {b'a':[ b'a b;b=b c']}),
++    ("a=1;a=2&a=3", {'a': ['1;a=2', '3']}),
++    (b"a=1;a=2&a=3", {b'a': [b'1;a=2', b'3']}),
++]
++
+ class UrlParseTestCase(unittest.TestCase):
+ 
+     def checkRoundtrips(self, url, parsed, split):
+@@ -141,6 +181,40 @@ class UrlParseTestCase(unittest.TestCase):
+             self.assertEqual(result, expect_without_blanks,
+                     "Error parsing %r" % orig)
+ 
++    def test_qs_default_warn(self):
++        for orig, expect in parse_qs_test_cases_warn:
++            with catch_warnings(record=True) as w:
++                filterwarnings(action='always',
++                                        category=urlparse._QueryStringSeparatorWarning)
++                result = urlparse.parse_qs(orig, keep_blank_values=True)
++                self.assertEqual(result, expect, "Error parsing %r" % orig)
++            self.assertEqual(len(w), 1)
++            self.assertEqual(w[0].category, urlparse._QueryStringSeparatorWarning)
++
++    def test_qsl_default_warn(self):
++        for orig, expect in parse_qsl_test_cases_warn:
++            with catch_warnings(record=True) as w:
++                filterwarnings(action='always',
++                               category=urlparse._QueryStringSeparatorWarning)
++                result = urlparse.parse_qsl(orig, keep_blank_values=True)
++                self.assertEqual(result, expect, "Error parsing %r" % orig)
++            self.assertEqual(len(w), 1)
++            self.assertEqual(w[0].category, urlparse._QueryStringSeparatorWarning)
++
++    def test_default_qs_no_warnings(self):
++        for orig, expect in parse_qs_test_cases:
++            with catch_warnings(record=True) as w:
++                result = urlparse.parse_qs(orig, keep_blank_values=True)
++                self.assertEqual(result, expect, "Error parsing %r" % orig)
++            self.assertEqual(len(w), 0)
++
++    def test_default_qsl_no_warnings(self):
++        for orig, expect in parse_qsl_test_cases:
++            with catch_warnings(record=True) as w:
++                result = urlparse.parse_qsl(orig, keep_blank_values=True)
++                self.assertEqual(result, expect, "Error parsing %r" % orig)
++            self.assertEqual(len(w), 0)
++
+     def test_roundtrips(self):
+         testcases = [
+             ('file:///tmp/junk.txt',
+@@ -626,6 +700,132 @@ class UrlParseTestCase(unittest.TestCase):
+         self.assertEqual(urlparse.urlparse("http://www.python.org:80"),
+                 ('http','www.python.org:80','','','',''))
+ 
++    def test_parse_qs_separator_bytes(self):
++        expected = {b'a': [b'1'], b'b': [b'2']}
++
++        result = urlparse.parse_qs(b'a=1;b=2', separator=b';')
++        self.assertEqual(result, expected)
++        result = urlparse.parse_qs(b'a=1;b=2', separator=';')
++        self.assertEqual(result, expected)
++        result = urlparse.parse_qs('a=1;b=2', separator=';')
++        self.assertEqual(result, {'a': ['1'], 'b': ['2']})
++
++    @contextlib.contextmanager
++    def _qsl_sep_config(self, sep):
++        """Context for the given parse_qsl default separator configured in config file"""
++        old_filename = urlparse._QS_SEPARATOR_CONFIG_FILENAME
++        urlparse._default_qs_separator = None
++        try:
++            tmpdirname = tempfile.mkdtemp()
++            filename = os.path.join(tmpdirname, 'conf.cfg')
++            with open(filename, 'w') as file:
++                file.write('[parse_qs]\n')
++                file.write('PYTHON_URLLIB_QS_SEPARATOR = {}'.format(sep))
++            urlparse._QS_SEPARATOR_CONFIG_FILENAME = filename
++            yield
++        finally:
++            urlparse._QS_SEPARATOR_CONFIG_FILENAME = old_filename
++            urlparse._default_qs_separator = None
++            shutil.rmtree(tmpdirname)
++
++    def test_parse_qs_separator_semicolon(self):
++        for orig, expect in parse_qs_test_cases_semicolon:
++            result = urlparse.parse_qs(orig, separator=';')
++            self.assertEqual(result, expect, "Error parsing %r" % orig)
++            with EnvironmentVarGuard() as environ, catch_warnings(record=True) as w:
++                environ['PYTHON_URLLIB_QS_SEPARATOR'] = ';'
++                result = urlparse.parse_qs(orig)
++            self.assertEqual(result, expect, "Error parsing %r" % orig)
++            self.assertEqual(len(w), 0)
++            with self._qsl_sep_config(';'), catch_warnings(record=True) as w:
++                result = urlparse.parse_qs(orig)
++            self.assertEqual(result, expect, "Error parsing %r" % orig)
++            self.assertEqual(len(w), 0)
++
++    def test_parse_qsl_separator_semicolon(self):
++        for orig, expect in parse_qsl_test_cases_semicolon:
++            result = urlparse.parse_qsl(orig, separator=';')
++            self.assertEqual(result, expect, "Error parsing %r" % orig)
++            with EnvironmentVarGuard() as environ, catch_warnings(record=True) as w:
++                environ['PYTHON_URLLIB_QS_SEPARATOR'] = ';'
++                result = urlparse.parse_qsl(orig)
++            self.assertEqual(result, expect, "Error parsing %r" % orig)
++            self.assertEqual(len(w), 0)
++            with self._qsl_sep_config(';'), catch_warnings(record=True) as w:
++                result = urlparse.parse_qsl(orig)
++            self.assertEqual(result, expect, "Error parsing %r" % orig)
++            self.assertEqual(len(w), 0)
++
++    def test_parse_qs_separator_legacy(self):
++        for orig, expect in parse_qs_test_cases_legacy:
++            with EnvironmentVarGuard() as environ, catch_warnings(record=True) as w:
++                environ['PYTHON_URLLIB_QS_SEPARATOR'] = 'legacy'
++                result = urlparse.parse_qs(orig)
++            self.assertEqual(result, expect, "Error parsing %r" % orig)
++            self.assertEqual(len(w), 0)
++            with self._qsl_sep_config('legacy'), catch_warnings(record=True) as w:
++                result = urlparse.parse_qs(orig)
++            self.assertEqual(result, expect, "Error parsing %r" % orig)
++            self.assertEqual(len(w), 0)
++
++    def test_parse_qsl_separator_legacy(self):
++        for orig, expect in parse_qsl_test_cases_legacy:
++            with EnvironmentVarGuard() as environ, catch_warnings(record=True) as w:
++                environ['PYTHON_URLLIB_QS_SEPARATOR'] = 'legacy'
++                result = urlparse.parse_qsl(orig)
++            self.assertEqual(result, expect, "Error parsing %r" % orig)
++            self.assertEqual(len(w), 0)
++            with self._qsl_sep_config('legacy'), catch_warnings(record=True) as w:
++                result = urlparse.parse_qsl(orig)
++            self.assertEqual(result, expect, "Error parsing %r" % orig)
++            self.assertEqual(len(w), 0)
++
++    def test_parse_qs_separator_bad_value_env_or_config(self):
++        for bad_sep in '', 'abc', 'safe', '&;', 'SEP':
++            with EnvironmentVarGuard() as environ, catch_warnings(record=True) as w:
++                environ['PYTHON_URLLIB_QS_SEPARATOR'] = bad_sep
++                with self.assertRaises(ValueError):
++                    urlparse.parse_qsl('a=1;b=2')
++            with self._qsl_sep_config('bad_sep'), catch_warnings(record=True) as w:
++                with self.assertRaises(ValueError):
++                    urlparse.parse_qsl('a=1;b=2')
++
++    def test_parse_qs_separator_bad_value_arg(self):
++        for bad_sep in True, {}, '':
++            with self.assertRaises(ValueError):
++                urlparse.parse_qsl('a=1;b=2', separator=bad_sep)
++
++    def test_parse_qs_separator_num_fields(self):
++        for qs, sep in (
++            ('a&b&c', '&'),
++            ('a;b;c', ';'),
++            ('a&b;c', 'legacy'),
++        ):
++            with EnvironmentVarGuard() as environ, catch_warnings(record=True) as w:
++                if sep != 'legacy':
++                    with self.assertRaises(ValueError):
++                        urlparse.parse_qsl(qs, separator=sep, max_num_fields=2)
++                if sep:
++                    environ['PYTHON_URLLIB_QS_SEPARATOR'] = sep
++                with self.assertRaises(ValueError):
++                    urlparse.parse_qsl(qs, max_num_fields=2)
++
++    def test_parse_qs_separator_priority(self):
++        # env variable trumps config file
++        with self._qsl_sep_config('~'), EnvironmentVarGuard() as environ:
++            environ['PYTHON_URLLIB_QS_SEPARATOR'] = '!'
++            result = urlparse.parse_qs('a=1!b=2~c=3')
++            self.assertEqual(result, {'a': ['1'], 'b': ['2~c=3']})
++        # argument trumps config file
++        with self._qsl_sep_config('~'):
++            result = urlparse.parse_qs('a=1$b=2~c=3', separator='$')
++            self.assertEqual(result, {'a': ['1'], 'b': ['2~c=3']})
++        # argument trumps env variable
++        with EnvironmentVarGuard() as environ:
++            environ['PYTHON_URLLIB_QS_SEPARATOR'] = '~'
++            result = urlparse.parse_qs('a=1$b=2~c=3', separator='$')
++            self.assertEqual(result, {'a': ['1'], 'b': ['2~c=3']})
++
+     def test_urlsplit_normalization(self):
+         # Certain characters should never occur in the netloc,
+         # including under normalization.
+diff --git a/Lib/urlparse.py b/Lib/urlparse.py
+index 798b467b605..69504d8fd93 100644
+--- a/Lib/urlparse.py
++++ b/Lib/urlparse.py
+@@ -29,6 +29,7 @@ test_urlparse.py provides a good indicator of parsing behavior.
+ """
+ 
+ import re
++import os
+ 
+ __all__ = ["urlparse", "urlunparse", "urljoin", "urldefrag",
+            "urlsplit", "urlunsplit", "parse_qs", "parse_qsl"]
+@@ -382,7 +383,8 @@ def unquote(s):
+             append(item)
+     return ''.join(res)
+ 
+-def parse_qs(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None):
++def parse_qs(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None,
++             separator=None):
+     """Parse a query given as a string argument.
+ 
+         Arguments:
+@@ -405,14 +407,23 @@ def parse_qs(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None):
+     """
+     dict = {}
+     for name, value in parse_qsl(qs, keep_blank_values, strict_parsing,
+-                                 max_num_fields):
++                                 max_num_fields, separator):
+         if name in dict:
+             dict[name].append(value)
+         else:
+             dict[name] = [value]
+     return dict
+ 
+-def parse_qsl(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None):
++class _QueryStringSeparatorWarning(RuntimeWarning):
++    """Warning for using default `separator` in parse_qs or parse_qsl"""
++
++# The default "separator" for parse_qsl can be specified in a config file.
++# It's cached after first read.
++_QS_SEPARATOR_CONFIG_FILENAME = '/etc/python/urllib.cfg'
++_default_qs_separator = None
++
++def parse_qsl(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None,
++              separator=None):
+     """Parse a query given as a string argument.
+ 
+     Arguments:
+@@ -434,15 +445,72 @@ def parse_qsl(qs, keep_blank_values=0, strict_parsing=0, max_num_fields=None):
+ 
+     Returns a list, as G-d intended.
+     """
++
++    if (not separator or (not isinstance(separator, (str, bytes)))) and separator is not None:
++        raise ValueError("Separator must be of type string or bytes.")
++
++    # Used when both "&" and ";" act as separators. (Need a non-string value.)
++    _legacy = object()
++
++    if separator is None:
++        global _default_qs_separator
++        separator = _default_qs_separator
++        envvar_name = 'PYTHON_URLLIB_QS_SEPARATOR'
++        if separator is None:
++            # Set default separator from environment variable
++            separator = os.environ.get(envvar_name)
++            config_source = 'environment variable'
++        if separator is None:
++            # Set default separator from the configuration file
++            try:
++                file = open(_QS_SEPARATOR_CONFIG_FILENAME)
++            except EnvironmentError:
++                pass
++            else:
++                with file:
++                    import ConfigParser
++                    config = ConfigParser.ConfigParser()
++                    config.readfp(file)
++                    separator = config.get('parse_qs', envvar_name)
++                    _default_qs_separator = separator
++                config_source = _QS_SEPARATOR_CONFIG_FILENAME
++        if separator is None:
++            # The default is '&', but warn if not specified explicitly
++            if ';' in qs:
++                from warnings import warn
++                warn("The default separator of urlparse.parse_qsl and "
++                    + "parse_qs was changed to '&' to avoid a web cache "
++                    + "poisoning issue (CVE-2021-23336). "
++                    + "By default, semicolons no longer act as query field "
++                    + "separators. "
++                    + "See https://access.redhat.com/articles/5860431 for "
++                    + "more details.",
++                    _QueryStringSeparatorWarning, stacklevel=2)
++            separator = '&'
++        elif separator == 'legacy':
++            separator = _legacy
++        elif len(separator) != 1:
++            raise ValueError(
++                '{} (from {}) must contain '.format(envvar_name, config_source)
++                + '1 character, or "legacy". See '
++                + 'https://access.redhat.com/articles/5860431 for more details.'
++            )
++
+     # If max_num_fields is defined then check that the number of fields
+     # is less than max_num_fields. This prevents a memory exhaustion DOS
+     # attack via post bodies with many fields.
+     if max_num_fields is not None:
+-        num_fields = 1 + qs.count('&') + qs.count(';')
++        if separator is _legacy:
++            num_fields = 1 + qs.count('&') + qs.count(';')
++        else:
++            num_fields = 1 + qs.count(separator)
+         if max_num_fields < num_fields:
+             raise ValueError('Max number of fields exceeded')
+ 
+-    pairs = [s2 for s1 in qs.split('&') for s2 in s1.split(';')]
++    if separator is _legacy:
++        pairs = [s2 for s1 in qs.split('&') for s2 in s1.split(';')]
++    else:
++        pairs = [s1 for s1 in qs.split(separator)]
+     r = []
+     for name_value in pairs:
+         if not name_value and not strict_parsing:
+-- 
+2.30.2
+

SOURCES/00366-CVE-2021-3733.patch

@@ -0,0 +1,35 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lumir Balhar <lbalhar@redhat.com>
+Date: Tue, 14 Sep 2021 11:34:43 +0200
+Subject: [PATCH] 00366-CVE-2021-3733.patch
+
+00366 #
+CVE-2021-3733: Fix ReDoS in urllib AbstractBasicAuthHandler
+
+Fix Regular Expression Denial of Service (ReDoS) vulnerability in
+urllib2.AbstractBasicAuthHandler. The ReDoS-vulnerable regex
+has quadratic worst-case complexity and it allows cause a denial of
+service when identifying crafted invalid RFCs. This ReDoS issue is on
+the client side and needs remote attackers to control the HTTP server.
+
+Backported from Python 3 together with another backward-compatible
+improvement of the regex from fix for CVE-2020-8492.
+
+Co-authored-by: Yeting Li <liyt@ios.ac.cn>
+---
+ Lib/urllib2.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Lib/urllib2.py b/Lib/urllib2.py
+index fd19e1ae943..e286583ecba 100644
+--- a/Lib/urllib2.py
++++ b/Lib/urllib2.py
+@@ -858,7 +858,7 @@ class AbstractBasicAuthHandler:
+ 
+     # allow for double- and single-quoted realm values
+     # (single quotes are a violation of the RFC, but appear in the wild)
+-    rx = re.compile('(?:.*,)*[ \t]*([^ \t]+)[ \t]+'
++    rx = re.compile('(?:[^,]*,)*[ \t]*([^ \t,]+)[ \t]+'
+                     'realm=(["\']?)([^"\']*)\\2', re.I)
+ 
+     # XXX could pre-emptively send auth info already accepted (RFC 2617,

SOURCES/00368-CVE-2021-3737.patch

@@ -0,0 +1,89 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lumir Balhar <lbalhar@redhat.com>
+Date: Fri, 17 Sep 2021 07:56:50 +0200
+Subject: [PATCH] 00368-CVE-2021-3737.patch
+
+00368 #
+CVE-2021-3737: http client infinite line reading (DoS) after a HTTP 100 Continue
+
+Fixes http.client potential denial of service where it could get stuck reading
+lines from a malicious server after a 100 Continue response.
+
+Backported from Python 3.
+
+Co-authored-by: Gregory P. Smith <greg@krypto.org>
+Co-authored-by: Gen Xu <xgbarry@gmail.com>
+---
+ Lib/httplib.py           | 32 +++++++++++++++++++++++---------
+ Lib/test/test_httplib.py |  8 ++++++++
+ 2 files changed, 31 insertions(+), 9 deletions(-)
+
+diff --git a/Lib/httplib.py b/Lib/httplib.py
+index a63677477d5..f9a27619e62 100644
+--- a/Lib/httplib.py
++++ b/Lib/httplib.py
+@@ -365,6 +365,25 @@ class HTTPMessage(mimetools.Message):
+                 # It's not a header line; skip it and try the next line.
+                 self.status = 'Non-header line where header expected'
+ 
++
++def _read_headers(fp):
++    """Reads potential header lines into a list from a file pointer.
++    Length of line is limited by _MAXLINE, and number of
++    headers is limited by _MAXHEADERS.
++    """
++    headers = []
++    while True:
++        line = fp.readline(_MAXLINE + 1)
++        if len(line) > _MAXLINE:
++            raise LineTooLong("header line")
++        headers.append(line)
++        if len(headers) > _MAXHEADERS:
++            raise HTTPException("got more than %d headers" % _MAXHEADERS)
++        if line in (b'\r\n', b'\n', b''):
++            break
++    return headers
++
++
+ class HTTPResponse:
+ 
+     # strict: If true, raise BadStatusLine if the status line can't be
+@@ -453,15 +472,10 @@ class HTTPResponse:
+             if status != CONTINUE:
+                 break
+             # skip the header from the 100 response
+-            while True:
+-                skip = self.fp.readline(_MAXLINE + 1)
+-                if len(skip) > _MAXLINE:
+-                    raise LineTooLong("header line")
+-                skip = skip.strip()
+-                if not skip:
+-                    break
+-                if self.debuglevel > 0:
+-                    print "header:", skip
++            skipped_headers = _read_headers(self.fp)
++            if self.debuglevel > 0:
++                print("headers:", skipped_headers)
++            del skipped_headers
+ 
+         self.status = status
+         self.reason = reason.strip()
+diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
+index b5fec9aa1ec..d05c0fc28d2 100644
+--- a/Lib/test/test_httplib.py
++++ b/Lib/test/test_httplib.py
+@@ -700,6 +700,14 @@ class BasicTest(TestCase):
+         resp = httplib.HTTPResponse(FakeSocket(body))
+         self.assertRaises(httplib.LineTooLong, resp.begin)
+ 
++    def test_overflowing_header_limit_after_100(self):
++        body = (
++            'HTTP/1.1 100 OK\r\n'
++            'r\n' * 32768
++        )
++        resp = httplib.HTTPResponse(FakeSocket(body))
++        self.assertRaises(httplib.HTTPException, resp.begin)
++
+     def test_overflowing_chunked_line(self):
+         body = (
+             'HTTP/1.1 200 OK\r\n'

SOURCES/00372-CVE-2021-4189.patch

@@ -0,0 +1,80 @@
+diff --git a/Lib/ftplib.py b/Lib/ftplib.py
+index 6644554..0550f0a 100644
+--- a/Lib/ftplib.py
++++ b/Lib/ftplib.py
+@@ -108,6 +108,8 @@ class FTP:
+     file = None
+     welcome = None
+     passiveserver = 1
++    # Disables https://bugs.python.org/issue43285 security if set to True.
++    trust_server_pasv_ipv4_address = False
+ 
+     # Initialization method (called by class instantiation).
+     # Initialize host to localhost, port to standard ftp port
+@@ -310,8 +312,13 @@ class FTP:
+         return sock
+ 
+     def makepasv(self):
++        """Internal: Does the PASV or EPSV handshake -> (address, port)"""
+         if self.af == socket.AF_INET:
+-            host, port = parse227(self.sendcmd('PASV'))
++            untrusted_host, port = parse227(self.sendcmd('PASV'))
++            if self.trust_server_pasv_ipv4_address:
++                host = untrusted_host
++            else:
++                host = self.sock.getpeername()[0]
+         else:
+             host, port = parse229(self.sendcmd('EPSV'), self.sock.getpeername())
+         return host, port
+diff --git a/Lib/test/test_ftplib.py b/Lib/test/test_ftplib.py
+index 8a3eb06..62a3f5e 100644
+--- a/Lib/test/test_ftplib.py
++++ b/Lib/test/test_ftplib.py
+@@ -67,6 +67,10 @@ class DummyFTPHandler(asynchat.async_chat):
+         self.rest = None
+         self.next_retr_data = RETR_DATA
+         self.push('220 welcome')
++        # We use this as the string IPv4 address to direct the client
++        # to in response to a PASV command.  To test security behavior.
++        # https://bugs.python.org/issue43285/.
++        self.fake_pasv_server_ip = '252.253.254.255'
+ 
+     def collect_incoming_data(self, data):
+         self.in_buffer.append(data)
+@@ -109,7 +113,8 @@ class DummyFTPHandler(asynchat.async_chat):
+         sock.bind((self.socket.getsockname()[0], 0))
+         sock.listen(5)
+         sock.settimeout(10)
+-        ip, port = sock.getsockname()[:2]
++        port = sock.getsockname()[1]
++        ip = self.fake_pasv_server_ip
+         ip = ip.replace('.', ',')
+         p1, p2 = divmod(port, 256)
+         self.push('227 entering passive mode (%s,%d,%d)' %(ip, p1, p2))
+@@ -577,6 +582,26 @@ class TestFTPClass(TestCase):
+         # IPv4 is in use, just make sure send_epsv has not been used
+         self.assertEqual(self.server.handler_instance.last_received_cmd, 'pasv')
+ 
++    def test_makepasv_issue43285_security_disabled(self):
++        """Test the opt-in to the old vulnerable behavior."""
++        self.client.trust_server_pasv_ipv4_address = True
++        bad_host, port = self.client.makepasv()
++        self.assertEqual(
++                bad_host, self.server.handler_instance.fake_pasv_server_ip)
++        # Opening and closing a connection keeps the dummy server happy
++        # instead of timing out on accept.
++        socket.create_connection((self.client.sock.getpeername()[0], port),
++                                 timeout=TIMEOUT).close()
++
++    def test_makepasv_issue43285_security_enabled_default(self):
++        self.assertFalse(self.client.trust_server_pasv_ipv4_address)
++        trusted_host, port = self.client.makepasv()
++        self.assertNotEqual(
++                trusted_host, self.server.handler_instance.fake_pasv_server_ip)
++        # Opening and closing a connection keeps the dummy server happy
++        # instead of timing out on accept.
++        socket.create_connection((trusted_host, port), timeout=TIMEOUT).close()
++
+     def test_line_too_long(self):
+         self.assertRaises(ftplib.Error, self.client.sendcmd,
+                           'x' * self.client.maxline * 2)

SOURCES/00377-CVE-2022-0391.patch

@@ -0,0 +1,127 @@
+diff --git a/Doc/library/urlparse.rst b/Doc/library/urlparse.rst
+index 97d1119257c..c08c3dc8e8f 100644
+--- a/Doc/library/urlparse.rst
++++ b/Doc/library/urlparse.rst
+@@ -125,6 +125,9 @@ The :mod:`urlparse` module defines the following functions:
+    decomposed before parsing, or is not a Unicode string, no error will be
+    raised.
+ 
++   Following the `WHATWG spec`_ that updates RFC 3986, ASCII newline
++   ``\n``, ``\r`` and tab ``\t`` characters are stripped from the URL.
++
+    .. versionchanged:: 2.5
+       Added attributes to return value.
+ 
+@@ -321,6 +324,10 @@ The :mod:`urlparse` module defines the following functions:
+ 
+ .. seealso::
+ 
++   `WHATWG`_ -  URL Living standard
++      Working Group for the URL Standard that defines URLs, domains, IP addresses, the
++      application/x-www-form-urlencoded format, and their API.
++
+    :rfc:`3986` - Uniform Resource Identifiers
+       This is the current standard (STD66). Any changes to urlparse module
+       should conform to this. Certain deviations could be observed, which are
+@@ -345,6 +352,7 @@ The :mod:`urlparse` module defines the following functions:
+    :rfc:`1738` - Uniform Resource Locators (URL)
+       This specifies the formal syntax and semantics of absolute URLs.
+ 
++.. _WHATWG: https://url.spec.whatwg.org/
+ 
+ .. _urlparse-result-object:
+ 
+diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
+index 21875bb2991..16eefed56f6 100644
+--- a/Lib/test/test_urlparse.py
++++ b/Lib/test/test_urlparse.py
+@@ -618,6 +618,55 @@ class UrlParseTestCase(unittest.TestCase):
+         self.assertEqual(p1.path, '863-1234')
+         self.assertEqual(p1.params, 'phone-context=+1-914-555')
+ 
++    def test_urlsplit_remove_unsafe_bytes(self):
++        # Remove ASCII tabs and newlines from input, for http common case scenario.
++        url = "h\nttp://www.python\n.org\t/java\nscript:\talert('msg\r\n')/?query\n=\tsomething#frag\nment"
++        p = urlparse.urlsplit(url)
++        self.assertEqual(p.scheme, "http")
++        self.assertEqual(p.netloc, "www.python.org")
++        self.assertEqual(p.path, "/javascript:alert('msg')/")
++        self.assertEqual(p.query, "query=something")
++        self.assertEqual(p.fragment, "fragment")
++        self.assertEqual(p.username, None)
++        self.assertEqual(p.password, None)
++        self.assertEqual(p.hostname, "www.python.org")
++        self.assertEqual(p.port, None)
++        self.assertEqual(p.geturl(), "http://www.python.org/javascript:alert('msg')/?query=something#fragment")
++
++        # Remove ASCII tabs and newlines from input as bytes, for http common case scenario.
++        url = b"h\nttp://www.python\n.org\t/java\nscript:\talert('msg\r\n')/?query\n=\tsomething#frag\nment"
++        p = urlparse.urlsplit(url)
++        self.assertEqual(p.scheme, b"http")
++        self.assertEqual(p.netloc, b"www.python.org")
++        self.assertEqual(p.path, b"/javascript:alert('msg')/")
++        self.assertEqual(p.query, b"query=something")
++        self.assertEqual(p.fragment, b"fragment")
++        self.assertEqual(p.username, None)
++        self.assertEqual(p.password, None)
++        self.assertEqual(p.hostname, b"www.python.org")
++        self.assertEqual(p.port, None)
++        self.assertEqual(p.geturl(), b"http://www.python.org/javascript:alert('msg')/?query=something#fragment")
++
++        # any scheme
++        url = "x-new-scheme\t://www.python\n.org\t/java\nscript:\talert('msg\r\n')/?query\n=\tsomething#frag\nment"
++        p = urlparse.urlsplit(url)
++        self.assertEqual(p.geturl(), "x-new-scheme://www.python.org/javascript:alert('msg')/?query=something#fragment")
++
++        # Remove ASCII tabs and newlines from input as bytes, any scheme.
++        url = b"x-new-scheme\t://www.python\n.org\t/java\nscript:\talert('msg\r\n')/?query\n=\tsomething#frag\nment"
++        p = urlparse.urlsplit(url)
++        self.assertEqual(p.geturl(), b"x-new-scheme://www.python.org/javascript:alert('msg')/?query=something#fragment")
++
++        # Unsafe bytes is not returned from urlparse cache.
++        # scheme is stored after parsing, sending an scheme with unsafe bytes *will not* return an unsafe scheme
++        url = "https://www.python\n.org\t/java\nscript:\talert('msg\r\n')/?query\n=\tsomething#frag\nment"
++        scheme = "htt\nps"
++        for _ in range(2):
++            p = urlparse.urlsplit(url, scheme=scheme)
++            self.assertEqual(p.scheme, "https")
++            self.assertEqual(p.geturl(), "https://www.python.org/javascript:alert('msg')/?query=something#fragment")
++
++
+ 
+     def test_attributes_bad_port(self):
+         """Check handling of non-integer ports."""
+diff --git a/Lib/urlparse.py b/Lib/urlparse.py
+index 69504d8fd93..6cc40a8d2fb 100644
+--- a/Lib/urlparse.py
++++ b/Lib/urlparse.py
+@@ -63,6 +63,9 @@ scheme_chars = ('abcdefghijklmnopqrstuvwxyz'
+                 '0123456789'
+                 '+-.')
+ 
++# Unsafe bytes to be removed per WHATWG spec
++_UNSAFE_URL_BYTES_TO_REMOVE = ['\t', '\r', '\n']
++
+ MAX_CACHE_SIZE = 20
+ _parse_cache = {}
+ 
+@@ -185,12 +188,19 @@ def _checknetloc(netloc):
+                              "under NFKC normalization"
+                              % netloc)
+ 
++def _remove_unsafe_bytes_from_url(url):
++    for b in _UNSAFE_URL_BYTES_TO_REMOVE:
++        url = url.replace(b, "")
++    return url
++
+ def urlsplit(url, scheme='', allow_fragments=True):
+     """Parse a URL into 5 components:
+     <scheme>://<netloc>/<path>?<query>#<fragment>
+     Return a 5-tuple: (scheme, netloc, path, query, fragment).
+     Note that we don't break the components up in smaller bits
+     (e.g. netloc is a single string) and we don't expand % escapes."""
++    url = _remove_unsafe_bytes_from_url(url)
++    scheme = _remove_unsafe_bytes_from_url(scheme)
+     allow_fragments = bool(allow_fragments)
+     key = url, scheme, allow_fragments, type(url), type(scheme)
+     cached = _parse_cache.get(key, None)

SOURCES/00378-support-expat-2-4-5.patch

@@ -0,0 +1,94 @@
+From 35f5707b555d3bca92858de16760918e76463a1e Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Mon, 21 Feb 2022 15:48:32 +0100
+Subject: [PATCH] 00378-support-expat-2-4-5.patch
+
+00378 #
+Support expat 2.4.5
+
+Curly brackets were never allowed in namespace URIs
+according to RFC 3986, and so-called namespace-validating
+XML parsers have the right to reject them a invalid URIs.
+
+libexpat >=2.4.5 has become strcter in that regard due to
+related security issues; with ET.XML instantiating a
+namespace-aware parser under the hood, this test has no
+future in CPython.
+
+References:
+- https://datatracker.ietf.org/doc/html/rfc3968
+- https://www.w3.org/TR/xml-names/
+
+Also, test_minidom.py: Support Expat >=2.4.5
+
+Upstream: https://bugs.python.org/issue46811
+
+Backported from Python 3.
+
+Co-authored-by: Sebastian Pipping <sebastian@pipping.org>
+---
+ Lib/test/test_minidom.py                                  | 8 ++++++--
+ Lib/test/test_xml_etree.py                                | 6 ------
+ .../next/Library/2022-02-20-21-03-31.bpo-46811.8BxgdQ.rst | 1 +
+ 3 files changed, 7 insertions(+), 8 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2022-02-20-21-03-31.bpo-46811.8BxgdQ.rst
+
+diff --git a/Lib/test/test_minidom.py b/Lib/test/test_minidom.py
+index 2eb6423..2c9a7a3 100644
+--- a/Lib/test/test_minidom.py
++++ b/Lib/test/test_minidom.py
+@@ -6,12 +6,14 @@ from StringIO import StringIO
+ from test import support
+ import unittest
+ 
++import pyexpat
+ import xml.dom
+ import xml.dom.minidom
+ import xml.parsers.expat
+ 
+ from xml.dom.minidom import parse, Node, Document, parseString
+ from xml.dom.minidom import getDOMImplementation
++from xml.parsers.expat import ExpatError
+ 
+ 
+ tstfile = support.findfile("test.xml", subdir="xmltestdata")
+@@ -1051,8 +1053,10 @@ class MinidomTest(unittest.TestCase):
+ 
+         # Verify that character decoding errors raise exceptions instead
+         # of crashing
+-        self.assertRaises(UnicodeDecodeError, parseString,
+-                '<fran\xe7ais>Comment \xe7a va ? Tr\xe8s bien ?</fran\xe7ais>')
++        self.assertRaises(ExpatError, parseString,
++                '<fran\xe7ais></fran\xe7ais>')
++        self.assertRaises(ExpatError, parseString,
++                '<franais>Comment \xe7a va ? Tr\xe8s bien ?</franais>')
+ 
+         doc.unlink()
+ 
+diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
+index c75d55f..0855bc0 100644
+--- a/Lib/test/test_xml_etree.py
++++ b/Lib/test/test_xml_etree.py
+@@ -1482,12 +1482,6 @@ class BugsTest(unittest.TestCase):
+                 b"<?xml version='1.0' encoding='ascii'?>\n"
+                 b'<body>t&#227;g</body>')
+ 
+-    def test_issue3151(self):
+-        e = ET.XML('<prefix:localname xmlns:prefix="${stuff}"/>')
+-        self.assertEqual(e.tag, '{${stuff}}localname')
+-        t = ET.ElementTree(e)
+-        self.assertEqual(ET.tostring(e), b'<ns0:localname xmlns:ns0="${stuff}" />')
+-
+     def test_issue6565(self):
+         elem = ET.XML("<body><tag/></body>")
+         self.assertEqual(summarize_list(elem), ['tag'])
+diff --git a/Misc/NEWS.d/next/Library/2022-02-20-21-03-31.bpo-46811.8BxgdQ.rst b/Misc/NEWS.d/next/Library/2022-02-20-21-03-31.bpo-46811.8BxgdQ.rst
+new file mode 100644
+index 0000000..6969bd1
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2022-02-20-21-03-31.bpo-46811.8BxgdQ.rst
+@@ -0,0 +1 @@
++Make test suite support Expat >=2.4.5
+-- 
+2.35.1
+

SOURCES/00382-cve-2015-20107.patch

@@ -0,0 +1,440 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Petr Viktorin <encukou@gmail.com>
+Date: Fri, 3 Jun 2022 11:43:35 +0200
+Subject: [PATCH] 00382-cve-2015-20107.patch
+
+00382 #
+Make mailcap refuse to match unsafe filenames/types/params (GH-91993)
+
+Upstream: https://github.com/python/cpython/issues/68966
+
+Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390
+
+Backported from python3.
+---
+ Doc/library/mailcap.rst                       |  12 +
+ Lib/mailcap.py                                |  29 +-
+ Lib/test/mailcap.txt                          |  39 +++
+ Lib/test/test_mailcap.py                      | 259 ++++++++++++++++++
+ ...2-04-27-18-25-30.gh-issue-68966.gjS8zs.rst |   4 +
+ 5 files changed, 341 insertions(+), 2 deletions(-)
+ create mode 100644 Lib/test/mailcap.txt
+ create mode 100644 Lib/test/test_mailcap.py
+ create mode 100644 Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst
+
+diff --git a/Doc/library/mailcap.rst b/Doc/library/mailcap.rst
+index 750d085796f..5f75ee6086e 100644
+--- a/Doc/library/mailcap.rst
++++ b/Doc/library/mailcap.rst
+@@ -54,6 +54,18 @@ standard.  However, mailcap files are supported on most Unix systems.
+    use) to determine whether or not the mailcap line applies.  :func:`findmatch`
+    will automatically check such conditions and skip the entry if the check fails.
+ 
++   .. versionchanged:: 3.11
++
++      To prevent security issues with shell metacharacters (symbols that have
++      special effects in a shell command line), ``findmatch`` will refuse
++      to inject ASCII characters other than alphanumerics and ``@+=:,./-_``
++      into the returned command line.
++
++      If a disallowed character appears in *filename*, ``findmatch`` will always
++      return ``(None, None)`` as if no entry was found.
++      If such a character appears elsewhere (a value in *plist* or in *MIMEtype*),
++      ``findmatch`` will ignore all mailcap entries which use that value.
++      A :mod:`warning <warnings>` will be raised in either case.
+ 
+ .. function:: getcaps()
+ 
+diff --git a/Lib/mailcap.py b/Lib/mailcap.py
+index 04077ba0db2..1108b447b1d 100644
+--- a/Lib/mailcap.py
++++ b/Lib/mailcap.py
+@@ -1,9 +1,18 @@
+ """Mailcap file handling.  See RFC 1524."""
+ 
+ import os
++import warnings
++import re
+ 
+ __all__ = ["getcaps","findmatch"]
+ 
++
++_find_unsafe = re.compile(r'[^\xa1-\xff\w@+=:,./-]').search
++
++class UnsafeMailcapInput(Warning):
++    """Warning raised when refusing unsafe input"""
++
++
+ # Part 1: top-level interface.
+ 
+ def getcaps():
+@@ -144,15 +153,22 @@ def findmatch(caps, MIMEtype, key='view', filename="/dev/null", plist=[]):
+     entry to use.
+ 
+     """
++    if _find_unsafe(filename):
++        msg = "Refusing to use mailcap with filename %r. Use a safe temporary filename." % (filename,)
++        warnings.warn(msg, UnsafeMailcapInput)
++        return None, None
+     entries = lookup(caps, MIMEtype, key)
+     # XXX This code should somehow check for the needsterminal flag.
+     for e in entries:
+         if 'test' in e:
+             test = subst(e['test'], filename, plist)
++            if test is None:
++                continue
+             if test and os.system(test) != 0:
+                 continue
+         command = subst(e[key], MIMEtype, filename, plist)
+-        return command, e
++        if command is not None:
++            return command, e
+     return None, None
+ 
+ def lookup(caps, MIMEtype, key=None):
+@@ -184,6 +200,10 @@ def subst(field, MIMEtype, filename, plist=[]):
+             elif c == 's':
+                 res = res + filename
+             elif c == 't':
++                if _find_unsafe(MIMEtype):
++                    msg = "Refusing to substitute MIME type %r into a shell command." % (MIMEtype,)
++                    warnings.warn(msg, UnsafeMailcapInput)
++                    return None
+                 res = res + MIMEtype
+             elif c == '{':
+                 start = i
+@@ -191,7 +211,12 @@ def subst(field, MIMEtype, filename, plist=[]):
+                     i = i+1
+                 name = field[start:i]
+                 i = i+1
+-                res = res + findparam(name, plist)
++                param = findparam(name, plist)
++                if _find_unsafe(param):
++                    msg = "Refusing to substitute parameter %r (%s) into a shell command" % (param, name)
++                    warnings.warn(msg, UnsafeMailcapInput)
++                    return None
++                res = res + param
+             # XXX To do:
+             # %n == number of parts if type is multipart/*
+             # %F == list of alternating type and filename for parts
+diff --git a/Lib/test/mailcap.txt b/Lib/test/mailcap.txt
+new file mode 100644
+index 00000000000..08a76e65941
+--- /dev/null
++++ b/Lib/test/mailcap.txt
+@@ -0,0 +1,39 @@
++# Mailcap file for test_mailcap; based on RFC 1524
++# Referred to by test_mailcap.py
++
++#
++# This is a comment.
++#
++
++application/frame; showframe %s; print="cat %s | lp"
++application/postscript; ps-to-terminal %s;\
++    needsterminal
++application/postscript; ps-to-terminal %s; \
++    compose=idraw %s
++application/x-dvi; xdvi %s
++application/x-movie; movieplayer %s; compose=moviemaker %s; \
++       description="Movie"; \
++       x11-bitmap="/usr/lib/Zmail/bitmaps/movie.xbm"
++application/*; echo "This is \"%t\" but \
++       is 50 \% Greek to me" \; cat %s; copiousoutput
++
++audio/basic; showaudio %s; compose=audiocompose %s; edit=audiocompose %s;\
++description="An audio fragment"
++audio/* ; /usr/local/bin/showaudio %t
++
++image/rgb; display %s
++#image/gif; display %s
++image/x-xwindowdump; display %s
++
++# The continuation char shouldn't \
++# make a difference in a comment.
++
++message/external-body; showexternal %s %{access-type} %{name} %{site} \
++    %{directory} %{mode} %{server}; needsterminal; composetyped = extcompose %s; \
++    description="A reference to data stored in an external location"
++
++text/richtext; shownonascii iso-8859-8 -e richtext -p %s; test=test "`echo \
++    %{charset} | tr '[A-Z]' '[a-z]'`"  = iso-8859-8; copiousoutput
++
++video/*; animate %s
++video/mpeg; mpeg_play %s
+\ No newline at end of file
+diff --git a/Lib/test/test_mailcap.py b/Lib/test/test_mailcap.py
+new file mode 100644
+index 00000000000..35da7fb0741
+--- /dev/null
++++ b/Lib/test/test_mailcap.py
+@@ -0,0 +1,259 @@
++import copy
++import os
++import sys
++import test.support
++import unittest
++from test import support as os_helper
++from test import support as warnings_helper
++from collections import OrderedDict
++
++import mailcap
++
++
++# Location of mailcap file
++MAILCAPFILE = test.support.findfile("mailcap.txt")
++
++# Dict to act as mock mailcap entry for this test
++# The keys and values should match the contents of MAILCAPFILE
++
++MAILCAPDICT = {
++    'application/x-movie':
++        [{'compose': 'moviemaker %s',
++          'x11-bitmap': '"/usr/lib/Zmail/bitmaps/movie.xbm"',
++          'description': '"Movie"',
++          'view': 'movieplayer %s',
++          'lineno': 4}],
++    'application/*':
++        [{'copiousoutput': '',
++          'view': 'echo "This is \\"%t\\" but        is 50 \\% Greek to me" \\; cat %s',
++          'lineno': 5}],
++    'audio/basic':
++        [{'edit': 'audiocompose %s',
++          'compose': 'audiocompose %s',
++          'description': '"An audio fragment"',
++          'view': 'showaudio %s',
++          'lineno': 6}],
++    'video/mpeg':
++        [{'view': 'mpeg_play %s', 'lineno': 13}],
++    'application/postscript':
++        [{'needsterminal': '', 'view': 'ps-to-terminal %s', 'lineno': 1},
++         {'compose': 'idraw %s', 'view': 'ps-to-terminal %s', 'lineno': 2}],
++    'application/x-dvi':
++        [{'view': 'xdvi %s', 'lineno': 3}],
++    'message/external-body':
++        [{'composetyped': 'extcompose %s',
++          'description': '"A reference to data stored in an external location"',
++          'needsterminal': '',
++          'view': 'showexternal %s %{access-type} %{name} %{site}     %{directory} %{mode} %{server}',
++          'lineno': 10}],
++    'text/richtext':
++        [{'test': 'test "`echo     %{charset} | tr \'[A-Z]\' \'[a-z]\'`"  = iso-8859-8',
++          'copiousoutput': '',
++          'view': 'shownonascii iso-8859-8 -e richtext -p %s',
++          'lineno': 11}],
++    'image/x-xwindowdump':
++        [{'view': 'display %s', 'lineno': 9}],
++    'audio/*':
++        [{'view': '/usr/local/bin/showaudio %t', 'lineno': 7}],
++    'video/*':
++        [{'view': 'animate %s', 'lineno': 12}],
++    'application/frame':
++        [{'print': '"cat %s | lp"', 'view': 'showframe %s', 'lineno': 0}],
++    'image/rgb':
++        [{'view': 'display %s', 'lineno': 8}]
++}
++
++# In Python 2, mailcap doesn't return line numbers.
++# This test suite is copied from Python 3.11; for easier backporting we keep
++# data from there and remove the lineno.
++# So, for Python 2, MAILCAPDICT_DEPRECATED is the same as MAILCAPDICT
++MAILCAPDICT_DEPRECATED = MAILCAPDICT
++for entry_list in MAILCAPDICT_DEPRECATED.values():
++    for entry in entry_list:
++        entry.pop('lineno')
++
++
++class HelperFunctionTest(unittest.TestCase):
++
++    def test_listmailcapfiles(self):
++        # The return value for listmailcapfiles() will vary by system.
++        # So verify that listmailcapfiles() returns a list of strings that is of
++        # non-zero length.
++        mcfiles = mailcap.listmailcapfiles()
++        self.assertIsInstance(mcfiles, list)
++        for m in mcfiles:
++            self.assertIsInstance(m, str)
++        with os_helper.EnvironmentVarGuard() as env:
++            # According to RFC 1524, if MAILCAPS env variable exists, use that
++            # and only that.
++            if "MAILCAPS" in env:
++                env_mailcaps = env["MAILCAPS"].split(os.pathsep)
++            else:
++                env_mailcaps = ["/testdir1/.mailcap", "/testdir2/mailcap"]
++                env["MAILCAPS"] = os.pathsep.join(env_mailcaps)
++                mcfiles = mailcap.listmailcapfiles()
++        self.assertEqual(env_mailcaps, mcfiles)
++
++    def test_readmailcapfile(self):
++        # Test readmailcapfile() using test file. It should match MAILCAPDICT.
++        with open(MAILCAPFILE, 'r') as mcf:
++                d = mailcap.readmailcapfile(mcf)
++        self.assertDictEqual(d, MAILCAPDICT_DEPRECATED)
++
++    def test_lookup(self):
++        # Test without key
++
++        # In Python 2, 'video/mpeg' is tried before 'video/*'
++        # (unfixed bug: https://github.com/python/cpython/issues/59182 )
++        # So, these are in reverse order:
++        expected = [{'view': 'mpeg_play %s', },
++                    {'view': 'animate %s', }]
++        actual = mailcap.lookup(MAILCAPDICT, 'video/mpeg')
++        self.assertListEqual(expected, actual)
++
++        # Test with key
++        key = 'compose'
++        expected = [{'edit': 'audiocompose %s',
++                     'compose': 'audiocompose %s',
++                     'description': '"An audio fragment"',
++                     'view': 'showaudio %s',
++                     }]
++        actual = mailcap.lookup(MAILCAPDICT, 'audio/basic', key)
++        self.assertListEqual(expected, actual)
++
++        # Test on user-defined dicts without line numbers
++        expected = [{'view': 'mpeg_play %s'}, {'view': 'animate %s'}]
++        actual = mailcap.lookup(MAILCAPDICT_DEPRECATED, 'video/mpeg')
++        self.assertListEqual(expected, actual)
++
++    def test_subst(self):
++        plist = ['id=1', 'number=2', 'total=3']
++        # test case: ([field, MIMEtype, filename, plist=[]], <expected string>)
++        test_cases = [
++            (["", "audio/*", "foo.txt"], ""),
++            (["echo foo", "audio/*", "foo.txt"], "echo foo"),
++            (["echo %s", "audio/*", "foo.txt"], "echo foo.txt"),
++            (["echo %t", "audio/*", "foo.txt"], None),
++            (["echo %t", "audio/wav", "foo.txt"], "echo audio/wav"),
++            (["echo \\%t", "audio/*", "foo.txt"], "echo %t"),
++            (["echo foo", "audio/*", "foo.txt", plist], "echo foo"),
++            (["echo %{total}", "audio/*", "foo.txt", plist], "echo 3")
++        ]
++        for tc in test_cases:
++            self.assertEqual(mailcap.subst(*tc[0]), tc[1])
++
++class GetcapsTest(unittest.TestCase):
++
++    def test_mock_getcaps(self):
++        # Test mailcap.getcaps() using mock mailcap file in this dir.
++        # Temporarily override any existing system mailcap file by pointing the
++        # MAILCAPS environment variable to our mock file.
++        with os_helper.EnvironmentVarGuard() as env:
++            env["MAILCAPS"] = MAILCAPFILE
++            caps = mailcap.getcaps()
++            self.assertDictEqual(caps, MAILCAPDICT)
++
++    def test_system_mailcap(self):
++        # Test mailcap.getcaps() with mailcap file(s) on system, if any.
++        caps = mailcap.getcaps()
++        self.assertIsInstance(caps, dict)
++        mailcapfiles = mailcap.listmailcapfiles()
++        existingmcfiles = [mcf for mcf in mailcapfiles if os.path.exists(mcf)]
++        if existingmcfiles:
++            # At least 1 mailcap file exists, so test that.
++            for (k, v) in caps.items():
++                self.assertIsInstance(k, str)
++                self.assertIsInstance(v, list)
++                for e in v:
++                    self.assertIsInstance(e, dict)
++        else:
++            # No mailcap files on system. getcaps() should return empty dict.
++            self.assertEqual({}, caps)
++
++
++class FindmatchTest(unittest.TestCase):
++
++    def test_findmatch(self):
++
++        # default findmatch arguments
++        c = MAILCAPDICT
++        fname = "foo.txt"
++        plist = ["access-type=default", "name=john", "site=python.org",
++                 "directory=/tmp", "mode=foo", "server=bar"]
++        audio_basic_entry = {
++            'edit': 'audiocompose %s',
++            'compose': 'audiocompose %s',
++            'description': '"An audio fragment"',
++            'view': 'showaudio %s',
++        }
++        audio_entry = {"view": "/usr/local/bin/showaudio %t", }
++        video_entry = {'view': 'animate %s', }
++        mpeg_entry = {'view': 'mpeg_play %s', }
++        message_entry = {
++            'composetyped': 'extcompose %s',
++            'description': '"A reference to data stored in an external location"', 'needsterminal': '',
++            'view': 'showexternal %s %{access-type} %{name} %{site}     %{directory} %{mode} %{server}',
++        }
++
++        # test case: (findmatch args, findmatch keyword args, expected output)
++        #   positional args: caps, MIMEtype
++        #   keyword args: key="view", filename="/dev/null", plist=[]
++        #   output: (command line, mailcap entry)
++        cases = [
++            ([{}, "video/mpeg"], {}, (None, None)),
++            ([c, "foo/bar"], {}, (None, None)),
++
++            # In Python 2, 'video/mpeg' is tried before 'video/*'
++            # (unfixed bug: https://github.com/python/cpython/issues/59182 )
++            #([c, "video/mpeg"], {}, ('animate /dev/null', video_entry)),
++            ([c, "video/mpeg"], {}, ('mpeg_play /dev/null', mpeg_entry)),
++
++            ([c, "audio/basic", "edit"], {}, ("audiocompose /dev/null", audio_basic_entry)),
++            ([c, "audio/basic", "compose"], {}, ("audiocompose /dev/null", audio_basic_entry)),
++            ([c, "audio/basic", "description"], {}, ('"An audio fragment"', audio_basic_entry)),
++            ([c, "audio/basic", "foobar"], {}, (None, None)),
++            ([c, "video/*"], {"filename": fname}, ("animate %s" % fname, video_entry)),
++            ([c, "audio/basic", "compose"],
++             {"filename": fname},
++             ("audiocompose %s" % fname, audio_basic_entry)),
++            ([c, "audio/basic"],
++             {"key": "description", "filename": fname},
++             ('"An audio fragment"', audio_basic_entry)),
++            ([c, "audio/*"],
++             {"filename": fname},
++             (None, None)),
++            ([c, "audio/wav"],
++             {"filename": fname},
++             ("/usr/local/bin/showaudio audio/wav", audio_entry)),
++            ([c, "message/external-body"],
++             {"plist": plist},
++             ("showexternal /dev/null default john python.org     /tmp foo bar", message_entry))
++        ]
++        self._run_cases(cases)
++
++    @unittest.skipUnless(os.name == "posix", "Requires 'test' command on system")
++    @unittest.skipIf(sys.platform == "vxworks", "'test' command is not supported on VxWorks")
++    def test_test(self):
++        # findmatch() will automatically check any "test" conditions and skip
++        # the entry if the check fails.
++        caps = {"test/pass": [{"test": "test 1 -eq 1"}],
++                "test/fail": [{"test": "test 1 -eq 0"}]}
++        # test case: (findmatch args, findmatch keyword args, expected output)
++        #   positional args: caps, MIMEtype, key ("test")
++        #   keyword args: N/A
++        #   output: (command line, mailcap entry)
++        cases = [
++            # findmatch will return the mailcap entry for test/pass because it evaluates to true
++            ([caps, "test/pass", "test"], {}, ("test 1 -eq 1", {"test": "test 1 -eq 1"})),
++            # findmatch will return None because test/fail evaluates to false
++            ([caps, "test/fail", "test"], {}, (None, None))
++        ]
++        self._run_cases(cases)
++
++    def _run_cases(self, cases):
++        for c in cases:
++            self.assertEqual(mailcap.findmatch(*c[0], **c[1]), c[2])
++
++
++def test_main():
++    test.support.run_unittest(HelperFunctionTest, GetcapsTest, FindmatchTest)
+diff --git a/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst b/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst
+new file mode 100644
+index 00000000000..da81a1f6993
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst
+@@ -0,0 +1,4 @@
++The deprecated mailcap module now refuses to inject unsafe text (filenames,
++MIME types, parameters) into shell commands. Instead of using such text, it
++will warn and act as if a match was not found (or for test commands, as if
++the test failed).

SOURCES/00394-cve-2022-45061-cpu-denial-of-service-via-inefficient-idna-decoder.patch

@@ -0,0 +1,98 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Mon, 7 Nov 2022 19:22:14 -0800
+Subject: [PATCH] 
+ 00394-cve-2022-45061-cpu-denial-of-service-via-inefficient-idna-decoder.patch
+
+00394 #
+gh-98433: Fix quadratic time idna decoding.
+
+There was an unnecessary quadratic loop in idna decoding. This restores
+the behavior to linear.
+
+Backported from python3.
+
+(cherry picked from commit a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15)
+
+Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
+Co-authored-by: Gregory P. Smith <greg@krypto.org>
+---
+ Lib/encodings/idna.py                         | 32 +++++++++----------
+ Lib/test/test_codecs.py                       |  6 ++++
+ ...2-11-04-09-29-36.gh-issue-98433.l76c5G.rst |  6 ++++
+ 3 files changed, 27 insertions(+), 17 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst
+
+diff --git a/Lib/encodings/idna.py b/Lib/encodings/idna.py
+index ea90d67142f..2ce798cf47e 100644
+--- a/Lib/encodings/idna.py
++++ b/Lib/encodings/idna.py
+@@ -39,23 +39,21 @@ def nameprep(label):
+ 
+     # Check bidi
+     RandAL = map(stringprep.in_table_d1, label)
+-    for c in RandAL:
+-        if c:
+-            # There is a RandAL char in the string. Must perform further
+-            # tests:
+-            # 1) The characters in section 5.8 MUST be prohibited.
+-            # This is table C.8, which was already checked
+-            # 2) If a string contains any RandALCat character, the string
+-            # MUST NOT contain any LCat character.
+-            if filter(stringprep.in_table_d2, label):
+-                raise UnicodeError("Violation of BIDI requirement 2")
+-
+-            # 3) If a string contains any RandALCat character, a
+-            # RandALCat character MUST be the first character of the
+-            # string, and a RandALCat character MUST be the last
+-            # character of the string.
+-            if not RandAL[0] or not RandAL[-1]:
+-                raise UnicodeError("Violation of BIDI requirement 3")
++    if any(RandAL):
++        # There is a RandAL char in the string. Must perform further
++        # tests:
++        # 1) The characters in section 5.8 MUST be prohibited.
++        # This is table C.8, which was already checked
++        # 2) If a string contains any RandALCat character, the string
++        # MUST NOT contain any LCat character.
++        if any(stringprep.in_table_d2(x) for x in label):
++            raise UnicodeError("Violation of BIDI requirement 2")
++        # 3) If a string contains any RandALCat character, a
++        # RandALCat character MUST be the first character of the
++        # string, and a RandALCat character MUST be the last
++        # character of the string.
++        if not RandAL[0] or not RandAL[-1]:
++            raise UnicodeError("Violation of BIDI requirement 3")
+ 
+     return label
+ 
+diff --git a/Lib/test/test_codecs.py b/Lib/test/test_codecs.py
+index 0ec8bf5a4b4..76428e1794a 100644
+--- a/Lib/test/test_codecs.py
++++ b/Lib/test/test_codecs.py
+@@ -1318,6 +1318,12 @@ class IDNACodecTest(unittest.TestCase):
+         self.assertEqual(u"pyth\xf6n.org".encode("idna"), "xn--pythn-mua.org")
+         self.assertEqual(u"pyth\xf6n.org.".encode("idna"), "xn--pythn-mua.org.")
+ 
++    def test_builtin_decode_length_limit(self):
++        with self.assertRaisesRegexp(UnicodeError, "too long"):
++            (b"xn--016c"+b"a"*1100).decode("idna")
++        with self.assertRaisesRegexp(UnicodeError, "too long"):
++            (b"xn--016c"+b"a"*70).decode("idna")
++
+     def test_stream(self):
+         import StringIO
+         r = codecs.getreader("idna")(StringIO.StringIO("abc"))
+diff --git a/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst b/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst
+new file mode 100644
+index 00000000000..5185fac2e29
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst
+@@ -0,0 +1,6 @@
++The IDNA codec decoder used on DNS hostnames by :mod:`socket` or :mod:`asyncio`
++related name resolution functions no longer involves a quadratic algorithm.
++This prevents a potential CPU denial of service if an out-of-spec excessive
++length hostname involving bidirectional characters were decoded. Some protocols
++such as :mod:`urllib` http ``3xx`` redirects potentially allow for an attacker
++to supply such a name.

SOURCES/04000-modularity-disable-tk.patch

@@ -1,21 +0,0 @@
-diff -urN Python-2.7.13/Modules/Setup.dist Python-2.7.13_modul/Modules/Setup.dist
---- Python-2.7.13/Modules/Setup.dist	2017-04-21 14:57:13.767444374 +0200
-+++ Python-2.7.13_modul/Modules/Setup.dist	2017-04-21 14:56:49.658953833 +0200
-@@ -326,7 +326,7 @@
- # every system.
- 
- # *** Always uncomment this (leave the leading underscore in!):
--_tkinter _tkinter.c tkappinit.c -DWITH_APPINIT \
-+#_tkinter _tkinter.c tkappinit.c -DWITH_APPINIT \
- # *** Uncomment and edit to reflect where your Tcl/Tk libraries are:
- #	-L/usr/local/lib \
- # *** Uncomment and edit to reflect where your Tcl/Tk headers are:
-@@ -345,7 +345,7 @@
- # *** Uncomment and edit for TOGL extension only:
- #	-DWITH_TOGL togl.c \
- # *** Uncomment and edit to reflect your Tcl/Tk versions:
--	-ltk -ltcl \
-+#	-ltk -ltcl \
- # *** Uncomment and edit to reflect where your X11 libraries are:
- #	-L/usr/X11R6/lib \
- # *** Or uncomment this for Solaris: