Re: SA 12.3 087 Python

On 8/10/25 1:33 PM, "Douglas R. Reno" ([email protected] via 
blfs-dev Mailing List) wrote:
> On 8/10/25 7:54 AM, Rainer Fiebig ([email protected] via blfs-dev 
> Mailing List) wrote:
>> I think the security advisory mentioned above should be reworked.  It
>> still refers to a sed that is not necessary for -3.13.6 and therefore is
>> not longer mentioned in the BLFS-pages the SA refers to.
>>
>> However, the sed may be valuable for those using older Python-versions
>> for which a new release is not yet out.
>>
>>
>> Rainer
>>
>> p.s.: I didn't like the reference point of the original sed and thus
>> used this one:
>>
>> sed -i.orig '/def _block(self, count):/{n;n;n;a\
>>          # Only non-negative offsets are allowed\
>>          if count < 0:\
>>              raise InvalidHeaderError("invalid offset")
>> ;}' Lib/tarfile.py
>>
> Hi Rainer,
>
> I will be filing a new security advisory for some HTML Parser 
> vulnerabilities fixed in Python-3.13.6 later today, and will also 
> update SA-12.3-087 about the sed for previous versions of Python. 
> Unfortunately as far as I can tell there hasn't been a release for 
> older Python versions yet to fix the HTML Parser issues, so I'll 
> probably just add a note about which patches to backport for older 
> versions of Python.
>
> - Doug
>
>
Hi Rainer,

Thank you again for bringing this up! I just issued SA-12.3-088 and 
elected to include the Tarfile patch in the list of patches suggested 
for users of Python-3.12.x and prior to use.

- Doug

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page