Re: SA 12.3 087 Python

On 8/10/25 7:54 AM, Rainer Fiebig ([email protected] via blfs-dev Mailing 
List) wrote:
> I think the security advisory mentioned above should be reworked.  It
> still refers to a sed that is not necessary for -3.13.6 and therefore is
> not longer mentioned in the BLFS-pages the SA refers to.
>
> However, the sed may be valuable for those using older Python-versions
> for which a new release is not yet out.
>
>
> Rainer
>
> p.s.: I didn't like the reference point of the original sed and thus
> used this one:
>
> sed -i.orig '/def _block(self, count):/{n;n;n;a\
>          # Only non-negative offsets are allowed\
>          if count < 0:\
>              raise InvalidHeaderError("invalid offset")
> ;}' Lib/tarfile.py
>
Hi Rainer,

I will be filing a new security advisory for some HTML Parser 
vulnerabilities fixed in Python-3.13.6 later today, and will also update 
SA-12.3-087 about the sed for previous versions of Python. Unfortunately 
as far as I can tell there hasn't been a release for older Python 
versions yet to fix the HTML Parser issues, so I'll probably just add a 
note about which patches to backport for older versions of Python.

- Doug

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page