Backport patch for CVE-2025-15367.
MFH: 2026Q3
Details
Details
Diff Detail
Diff Detail
- Lint
Lint Skipped - Unit
Tests Skipped - Build Status
Buildable 75478 Build 72361: arc lint + arc unit
Event Timeline
Comment Actions
These are intentionally omitted because upstream is still evaluating their functional correctness relative to the RFCs these modules implement, despite having committed in trunk.
Comment Actions
That is not an accurate representation of the situation. Upstream has decided not to backport these patches not because they have doubts about their correctness but because they don't want to break backward compatibility on an existing release branch. We would not be the first redistributor to disagree with upstream and backport the patches; Red Hat for instance currently ships Python 3.12 with these patches backported.
Comment Actions
@vishwin have you found the time to correct your misapprehension of the imaplib / poplib situation?
Comment Actions
Speaking as a member of the ports-secteam: a solution needs to be found here as soon as possible! I would ask for a prompt resolution; otherwise, I will approve the commit for security reasons
Comment Actions
The correct fix for imaplib (CVE-2025-15366) included in the latest release, 3.14.7. poplib (CVE-2025-15367) remains not backported upstream for good reason. For commentary's sake however:
CVE-2025-15366: https://github.com/python/cpython/issues/143921
The initial fix rejected all control characters, which violates the IMAP RFC in regards to quoted characters, and explains "potentially breaking existing behaviour". Further evaluations were necessary to determine which control characters are not part of the quoted characters set. Introducing new bugs on our end was not tenable.
CVE-2025-15367: https://github.com/python/cpython/issues/143923
Similar deal. However, possible ENOTIME to work out which specific control characters should actually be rejected, whilst also preserving backwards compatibility as much as practicable.
In all, we should not be breaking existing functionality for a cross-platform language runtime, especially one where many users are not apt to diagnose operating system-specific nuances, so upstream will continue to be followed here.