Page MenuHomeFreeBSD
Files F171130538

D57717.id183721.diff
No OneTemporary
Actions

D57717.id183721.diff
View Options

Index: lang/python313/Makefile
===================================================================
--- lang/python313/Makefile
+++ lang/python313/Makefile
@@ -1,5 +1,6 @@
PORTNAME= python
DISTVERSION= ${PYTHON_DISTVERSION}
+PORTREVISION= 1
CATEGORIES= lang python
MASTER_SITES= PYTHON/ftp/python/${DISTVERSION:C/[a-z].*//}
PKGNAMESUFFIX= ${PYTHON_BASESUFFIX}${THREADFLAG}
Index: lang/python313/files/patch-CVE-2025-15367
===================================================================
--- /dev/null
+++ lang/python313/files/patch-CVE-2025-15367
@@ -0,0 +1,39 @@
+--- Lib/poplib.py.orig
++++ Lib/poplib.py
+@@ -122,6 +122,8 @@ def _putline(self, line):
+ def _putcmd(self, line):
+ if self._debugging: print('*cmd*', repr(line))
+ line = bytes(line, self.encoding)
++ if re.search(b'[\x00-\x1F\x7F]', line):
++ raise ValueError('Control characters not allowed in commands')
+ self._putline(line)
+
+
+--- Lib/test/test_poplib.py.orig
++++ Lib/test/test_poplib.py
+@@ -17,6 +17,7 @@
+ from test.support import threading_helper
+ from test.support import asynchat
+ from test.support import asyncore
++from test.support import control_characters_c0
+ from test.support.testcase import ExtraAssertions
+
+
+@@ -396,6 +397,13 @@ def test_quit(self):
+ self.assertIsNone(self.client.sock)
+ self.assertIsNone(self.client.file)
+
++ def test_control_characters(self):
++ for c0 in control_characters_c0():
++ with self.assertRaises(ValueError):
++ self.client.user(f'user{c0}')
++ with self.assertRaises(ValueError):
++ self.client.pass_(f'{c0}pass')
++
+ @requires_ssl
+ def test_stls_capa(self):
+ capa = self.client.capa()
+--- /dev/null
++++ Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+@@ -0,0 +1 @@
++Reject control characters in POP3 commands.
Index: security/vuxml/vuln/2026.xml
===================================================================
--- security/vuxml/vuln/2026.xml
+++ security/vuxml/vuln/2026.xml
@@ -14861,8 +14861,8 @@
<package><name>python310</name> <range><ge>0</ge></range></package>
<package><name>python311</name> <range><ge>0</ge></range></package>
<package><name>python312</name> <range><ge>0</ge></range></package>
- <package><name>python313</name> <range><ge>0</ge></range></package>
- <package><name>python313t</name> <range><ge>0</ge></range></package>
+ <package><name>python313</name> <range><lt>3.13.15_1</lt></range></package>
+ <package><name>python313t</name> <range><lt>3.13.15_1</lt></range></package>
<package><name>python314</name> <range><ge>0</ge></range></package>
<package><name>python314t</name> <range><ge>0</ge></range></package>
<package><name>python315</name> <range><ge>0</ge></range></package>

File Metadata

Mime Type
text/plain
Expires
Wed, Sep 9, 9:39 PM (3 h, 2 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
38589048
Default Alt Text
D57717.id183721.diff (2 KB)

Event Timeline