Page MenuHomeFreeBSD
Files F172241150

D57718.id183722.diff
No OneTemporary
Actions

D57718.id183722.diff
View Options

Index: lang/python314/Makefile
===================================================================
--- lang/python314/Makefile
+++ lang/python314/Makefile
@@ -1,5 +1,6 @@
PORTNAME= python
DISTVERSION= ${PYTHON_DISTVERSION}
+PORTREVISION= 1
CATEGORIES= lang python
MASTER_SITES= PYTHON/ftp/python/${DISTVERSION:C/[a-z].*//}
PKGNAMESUFFIX= ${PYTHON_BASESUFFIX}${THREADFLAG}
Index: lang/python314/files/patch-CVE-2025-15367
===================================================================
--- /dev/null
+++ lang/python314/files/patch-CVE-2025-15367
@@ -0,0 +1,41 @@
+--- Lib/poplib.py.orig
++++ Lib/poplib.py
+@@ -122,6 +122,8 @@ def _putline(self, line):
+ def _putcmd(self, line):
+ if self._debugging: print('*cmd*', repr(line))
+ line = bytes(line, self.encoding)
++ if re.search(b'[\x00-\x1F\x7F]', line):
++ raise ValueError('Control characters not allowed in commands')
+ self._putline(line)
+
+
+diff --git Lib/test/test_poplib.py Lib/test/test_poplib.py
+index ef2da97f867..18ca7cb5568 100644
+--- Lib/test/test_poplib.py.orig
++++ Lib/test/test_poplib.py
+@@ -17,6 +17,7 @@
+ from test.support import threading_helper
+ from test.support import asynchat
+ from test.support import asyncore
++from test.support import control_characters_c0
+
+
+ test_support.requires_working_socket(module=True)
+@@ -395,6 +396,13 @@ def test_quit(self):
+ self.assertIsNone(self.client.sock)
+ self.assertIsNone(self.client.file)
+
++ def test_control_characters(self):
++ for c0 in control_characters_c0():
++ with self.assertRaises(ValueError):
++ self.client.user(f'user{c0}')
++ with self.assertRaises(ValueError):
++ self.client.pass_(f'{c0}pass')
++
+ @requires_ssl
+ def test_stls_capa(self):
+ capa = self.client.capa()
+--- /dev/null
++++ Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+@@ -0,0 +1 @@
++Reject control characters in POP3 commands.
Index: security/vuxml/vuln/2026.xml
===================================================================
--- security/vuxml/vuln/2026.xml
+++ security/vuxml/vuln/2026.xml
@@ -14863,8 +14863,8 @@
<package><name>python312</name> <range><ge>0</ge></range></package>
<package><name>python313</name> <range><lt>3.13.15_1</lt></range></package>
<package><name>python313t</name> <range><lt>3.13.15_1</lt></range></package>
- <package><name>python314</name> <range><ge>0</ge></range></package>
- <package><name>python314t</name> <range><ge>0</ge></range></package>
+ <package><name>python314</name> <range><lt>3.14.7_1</lt></range></package>
+ <package><name>python314t</name> <range><lt>3.14.7_1</lt></range></package>
<package><name>python315</name> <range><ge>0</ge></range></package>
</affects>
<description>

File Metadata

Mime Type
text/plain
Expires
Fri, Sep 18, 4:22 AM (2 h, 50 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
39119423
Default Alt Text
D57718.id183722.diff (2 KB)

Event Timeline