Skip to content

Commit a67ce7f

Browse files
dumoldumol
authored
2024.08 updates. (#177)
* Updated libffi sources to 3.4.6. * Updated libffi version to build to 3.4.6. * Updated zlib sources to 1.3.1. * Updated zlib version to build to 1.3.1. * Security updates for OpenSSL 1.1.1w from Ubuntu 20.04. * Updated SQLite sources and DLLs to 3.46.0. * Updated SQLite version to build/use to 3.46.0. * Python hot patches for some CVE issues on all platforms. * Adjusted hot fixes to cleanly apply on Windows. * Patched Python sources for CVE-2022-48560, CVE-2022-48566, CVE-2023-40217. * Document today's patching. * Patched our cryptography sources for CVE-2023-49083. Other safety issues not relevant for our old versions. * Patched our cryptography sources for CVE-2023-49083, take two. * Ignore one more `safety` id for `requests`: 71064. * Ignore `safety` id for one more of its deps: `idna`. * Use last compat revision supporting Python 2.7. * Added more Safety IDs to ignore. * Clone more of compat to reach last revision supporting py27. * Updated psutil version to build and use to 6.0.0. * Try penultimate commit from py2-support branch of compat. * Deactivate compat tests in GitHub workflows for now. * Updated non-containerized workflows. * Try latest version to build on CentOS 5. * Try older psutil version to build on CentOS 5. * Try building ARM64 Linux package on macOS. * No Docker on GitHub's Apple Silicon macOS runners. * Properly set an older psutil version to build on generic Linux. * Try psutil version 5.9.6 on CentOS 5. * Try bulding Ubuntu 18.04 package in a container. * Try bulding Ubuntu 18.04 package in a container, take two. * Try bulding Ubuntu 18.04 package in a container, take three. * Patched our Python sources for CVE-2024-0397. * Patched our OpenSSL 1.1.1 sources for CVE-2024-2511, CVE-2024-4741, CVE-2024-5535. * Updated OpenSSL 1.1.1 version to build to 1.1.1w-chevah2. * Patch CVE-2023-49083 for cryptography 3.2.1 the same way as for CVE-2023-23931. * More changes after own review. * Updated documented external deps sheets. * Cosmetic changes for external deps sheets. * More changes after own review. * Fix CVE-2024-7592 for Python. * Fix CVE-2024-7592 for Python, take two. * Actually remove compat tests GitHub workflows.
1 parent c063ec2 commit a67ce7f

File tree

3,891 files changed

+35462
-13727
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

3,891 files changed

+35462
-13727
lines changed

‎.github/workflows/bare.yaml‎

Lines changed: 2 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
fail-fast: false
3131
matrix:
3232
# The ARM64 build actually runs on an Amazon Docker container on Laja.
33-
runs-on: [ ubuntu-20.04, ubuntu-18.04, amzn-2-arm64 ]
33+
runs-on: [ ubuntu-20.04, amzn-2-arm64 ]
3434
timeout-minutes: 120
3535
steps:
3636
- name: Prepare OS
@@ -66,11 +66,6 @@ jobs:
6666
cd $CHEVAH_REPO
6767
./chevah_build test
6868
69-
- name: Compat tests
70-
run: |
71-
cd $CHEVAH_REPO
72-
./chevah_build compat
73-
7469
# Upload using a (per-OS selected) sftp command, then show final links.
7570
- name: Upload testing package
7671
run: |
@@ -96,7 +91,7 @@ jobs:
9691
strategy:
9792
fail-fast: false
9893
matrix:
99-
runs-on: [ macos-11 ]
94+
runs-on: [ macos-13 ]
10095
timeout-minutes: 60
10196
steps:
10297
# Avoid linking to Homebrew's libintl during build.
@@ -138,11 +133,6 @@ jobs:
138133
cd $CHEVAH_REPO
139134
./chevah_build test
140135
141-
- name: Compat tests
142-
run: |
143-
cd $CHEVAH_REPO
144-
./chevah_build compat
145-
146136
- name: Upload testing package
147137
run: |
148138
mkdir -pv ~/.ssh/
@@ -206,12 +196,6 @@ jobs:
206196
cd $CHEVAH_REPO
207197
./chevah_build test
208198
209-
- name: Compat tests
210-
shell: bash
211-
run: |
212-
cd $CHEVAH_REPO
213-
./chevah_build compat
214-
215199
# To use an RSA key with SFTPPlus, install upstream OpenSSH package,
216200
# which is more finicky in regards to file permissions.
217201
# Beware the commands in this step run under PowerShell.

‎.github/workflows/docker.yaml‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,18 +20,17 @@ env:
2020
USER: chevah
2121
CHEVAH_CONTAINER: yes
2222

23-
# Using a job name that doesn't contain the OS name, to minimize the risk of
24-
# confusion with the OS names of the containers, which are the relevant ones.
2523
jobs:
26-
latest:
24+
25+
x64:
2726
runs-on: ubuntu-latest
2827
container: ${{ matrix.container }}
2928
strategy:
3029
fail-fast: false
3130
matrix:
3231
# CentOS 5.11 setup was saved as an image pushed to Docker Hub. See the
3332
# Overview section at https://hub.docker.com/r/proatria/centos for details.
34-
container: [ 'alpine:3.12', 'centos:8.2.2004', 'proatria/centos:5.11-chevah1' ]
33+
container: [ 'alpine:3.12', 'centos:8.2.2004', 'proatria/centos:5.11-chevah1', 'ubuntu:18.04' ]
3534
timeout-minutes: 30
3635
steps:
3736

@@ -53,6 +52,13 @@ jobs:
5352
yum -y upgrade
5453
yum -y install git curl gcc make m4 automake libtool patch openssl-devel zlib-devel libffi-devel ncurses-devel sudo which openssh-clients
5554
55+
- name: Ubuntu setup
56+
if: startsWith(matrix.container, 'ubuntu')
57+
run: |
58+
apt update
59+
apt --yes dist-upgrade
60+
apt --yes install curl bash gcc make m4 automake libtool patch git libffi-dev zlib1g-dev libncurses5-dev libssl-dev
61+
5662
# On a Docker container, everything runs as root by default.
5763
- name: Chevah user setup
5864
run: |
@@ -90,13 +96,6 @@ jobs:
9096
cd /home/chevah/$CHEVAH_REPO
9197
./chevah_build test
9298
93-
# Compat tests must run as regular user with sudo rights.
94-
- name: Compat tests
95-
run: |
96-
chown -R chevah /home/chevah/$CHEVAH_REPO
97-
cd /home/chevah/$CHEVAH_REPO
98-
su chevah -c "./chevah_build compat"
99-
10099
# Using `~/` is problematic under Docker, use `/root/`.
101100
- name: Upload testing package
102101
run: |

‎chevah_build‎

Lines changed: 33 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -13,51 +13,58 @@ set -o errtrace # trap errors in functions as well
1313
set -o pipefail # don't ignore exit codes when piping output
1414

1515
PYTHON_BUILD_VERSION="2.7.18"
16-
LIBFFI_VERSION="3.4.4"
17-
ZLIB_VERSION="1.3"
16+
LIBFFI_VERSION="3.4.6"
17+
ZLIB_VERSION="1.3.1"
1818
BZIP2_VERSION="1.0.8"
1919
# We statically build the BSD libedit on selected platforms to get the
2020
# readline module available without linking to the GPL-only readline libs.
2121
LIBEDIT_VERSION="20170329-3.1"
22-
OPENSSL_VERSION="1.1.1w"
23-
SQLITE_VERSION="3.43.1"
22+
# As of November 2023, security patches for OpenSSL 1.1.1 are private.
23+
# More at https://openssl-library.org/news/vulnerabilities-1.1.1/index.html.
24+
# See src/openssl/README for details on where to get them anyway.
25+
OPENSSL_VERSION="1.1.1w-chevah2"
26+
SQLITE_VERSION="3.46.0"
2427

2528
# Python modules versions to be used everywhere possible.
2629
PYSQLITE_VERSION="2.8.3"
27-
CFFI_VERSION="1.15.1"
2830
SCANDIR_VERSION="1.10.0"
29-
PSUTIL_VERSION="5.9.5"
31+
# An older version is used on generic Linux to have it built on CentOS 5.
32+
PSUTIL_VERSION="6.0.0"
3033
SUBPROCESS32_VERSION="3.5.4"
3134

3235
# Versions no longer upgradable because of Python 2 deprecation.
36+
CFFI_VERSION="1.15.1"
3337
# pyOpenSSL 19.1.0 is used with OpenSSL 1.0.2 libs.
3438
PYOPENSSL_VERSION="21.0.0"
3539
# Backported fix for https://github.com/pypa/pip/issues/9827
3640
# at https://github.com/chevah/pip/tree/20.3.4chevah.
3741
PIP_VERSION="20.3.4chevah1"
3842
# For safety alerts, we need to ignore some vulnerabilities which are either:
39-
# * not present in the final tarball, e.g. for wheel, safety, etc.,
43+
# * not present in the final tarball, e.g. for wheel, safety, requests, etc.,
4044
# * not at all relevant, e.g. those for cryptography's bundled openssl,
41-
# * not actually relevant for these old versions, e.g. 53048 for cryptography,
42-
# * patched by us, e.g. 40291 for pip, 53048 for cryptography,
43-
# * not patched: 52495 for setuptools.
45+
# * not actually relevant for these old versions, e.g. 65647 for cryptography,
46+
# * patched by us, e.g. 40291 for pip, 53048/62556 for cryptography,
47+
# * not patched: 52495/72236 for setuptools, 59473 for cryptography.
4448
# pip <21.1, click <8, dparse <0.5.2, wheel <0.38, safety <2.2, pywin32 <301.
4549
SAFETY_IGNORED_OPTS="-i 40291 -i 47833 -i 50571 -i 51499 -i 51358 -i 54687"
4650
# setuptools <65.5.1, requests <2.31.0, certifi <2023.07.22.
4751
SAFETY_IGNORED_OPTS="$SAFETY_IGNORED_OPTS -i 52495 -i 58755 -i 52365 -i 59956"
52+
# requests <2.32.2, idna <3.7, setuptools <70.0.0, certifi <2024.07.04.
53+
SAFETY_IGNORED_OPTS="$SAFETY_IGNORED_OPTS -i 71064 -i 67895 -i 72236 -i 72083"
4854
# These are related to cryptography's bundled OpenSSL libs. We don't use those.
4955
SAFETY_IGNORED_OPTS="$SAFETY_IGNORED_OPTS -i 53306 -i 53298 -i 53305 -i 53301"
5056
SAFETY_IGNORED_OPTS="$SAFETY_IGNORED_OPTS -i 53307 -i 53304 -i 53302 -i 53299"
5157
SAFETY_IGNORED_OPTS="$SAFETY_IGNORED_OPTS -i 53303 -i 59062 -i 60225 -i 60223"
52-
SAFETY_IGNORED_OPTS="$SAFETY_IGNORED_OPTS -i 60224"
53-
# Other cryptography vulnerabilities, see a few lines above for more details.
54-
SAFETY_IGNORED_OPTS="$SAFETY_IGNORED_OPTS -i 53048 -i 59473"
58+
SAFETY_IGNORED_OPTS="$SAFETY_IGNORED_OPTS -i 60224 -i 62451 -i 62452 -i 65278"
59+
SAFETY_IGNORED_OPTS="$SAFETY_IGNORED_OPTS -i 65510 -i 71680 -i 71681"
60+
# Other cryptography vulnerabilities, see above multi-line comment for more details.
61+
SAFETY_IGNORED_OPTS="$SAFETY_IGNORED_OPTS -i 53048 -i 59473 -i 62556 -i 65647"
5562
# setuptools 44.x is the last series to support Python 2.7.
5663
# More at https://github.com/pypa/setuptools/pull/1955.
5764
SETUPTOOLS_VERSION="44.1.1"
5865
# Version 3.2.1 (with patches) from python-modules/ is used with OpenSSL 1.0.2.
59-
# Our patched versions fix CVE-2023-23931.
60-
CRYPTOGRAPHY_VERSION="3.3.2chevah"
66+
# Our patched versions are not affected by CVE-2023-23931 and CVE-2023-49083.
67+
CRYPTOGRAPHY_VERSION="3.3.2chevah2"
6168
# bcrypt 3.2.0 requires at least Python 3.6.
6269
BCRYPT_VERSION="3.1.7"
6370
# setproctitle 1.2.x requires at least Python 3.6.
@@ -325,6 +332,16 @@ case $OS in
325332
export PATH="/usr/local/bin:$PATH"
326333
# In particular, Perl's Test::Simple and its deps are required.
327334
execute perl -MTest::Simple -e 1
335+
# Version 5.9.8 and newer of psutil can't build on RHEL 5 and clones.
336+
PIP_LIBRARIES="\
337+
cryptography==${CRYPTOGRAPHY_VERSION} \
338+
pyOpenSSL==${PYOPENSSL_VERSION} \
339+
scandir==${SCANDIR_VERSION} \
340+
subprocess32==${SUBPROCESS32_VERSION} \
341+
bcrypt==${BCRYPT_VERSION} \
342+
psutil==5.9.6 \
343+
setproctitle==${SETPROCTITLE_VERSION}
344+
"
328345
;;
329346
*)
330347
# Only supported Linux distributions should be left.
@@ -786,7 +803,7 @@ command_compat() {
786803
execute pushd build
787804
echo '##### Running chevah.compat tests... #####'
788805
execute rm -rf compat
789-
execute git clone https://github.com/chevah/compat.git --depth=1 -b py2-support
806+
execute git clone https://github.com/chevah/compat.git --depth 1 -b py2-support
790807
execute pushd compat
791808
# Copy over current brink stuff, as some changes might require it.
792809
execute cp ../../brink.{conf,sh} ./

‎external_deps.csv‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,35 @@
11
OS,AIX,,,Amazon,Alpine,Debian,FreeBSD,,HP-UX,macOS,OS X,RHEL,,,SLES,Solaris,,,,Ubuntu Server,,,,Windows,
2-
OS Version,5.3³,6.1³,7.1+¹,2+¹,3.12+¹,5.0+²,11.4³,12.2+³,11.31³,10.13+¹,10.8³,5.11-7.x¹,8.x¹,9.x¹,11SP4+²,10u8+³,11.0/11.1³,11.2³,11.4³,14.04/16.04¹,18.04¹,20.04¹,22.04¹,"XP, 2003, 2008³","2012r2, 2016, 2019, 2022¹"
2+
OS Version,5.3³,6.1³,7.1+²,2+¹,3.12+¹,6.0+²,11.4³,12.2+³,11.31³,10.13+¹,10.8³,5.11-7.x¹,8.x¹,9.x+¹,11SP4+²,10u8+³,11.0/11.1³,11.2³,11.4³,16.04²,18.04¹,20.04¹,22.04+¹,"XP, 2003, 2008³","2012r2, 2016, 2019, 2022¹"
33
OpenSSL⁶,"1.0.2v-chevah2 (statically linked with stdlib “ssl”)
44
1.0.2v-chevah2 (statically linked with cryptography)",1.0.2k (from AIX Web Download Pack Programs),"1.0.2v-chevah5¹⁵ (statically linked with stdlib “ssl”)
5-
1.0.2v-chevah5¹⁵ (statically linked with cryptography)","1.1.1w (statically linked with stdlib “ssl”)
6-
1.1.1w (statically linked with cryptography)","1.1.1w (statically linked with stdlib “ssl”)
7-
1.1.1w (statically linked with cryptography)","1.1.1w (statically linked with stdlib “ssl”)
8-
1.1.1w (statically linked with cryptography)",1.0.1u,1.0.2s,1.0.2h,"1.1.1w (statically linked with stdlib “ssl”)
9-
1.1.1w (statically linked with cryptography)","1.1.1g (statically built for stdlib “ssl”)
10-
1.1.1g (bundled with upstream cryptography 2.9.1)","1.1.1w (statically linked with stdlib “ssl”)
11-
1.1.1w (statically linked with cryptography)","1.1.1cFIPS /
12-
1.1.1k FIPS","1.1.1w (statically linked with stdlib “ssl”)
13-
1.1.1w (statically linked with cryptography)","1.1.1w (statically linked with stdlib “ssl”)
14-
1.1.1w (statically linked with cryptography)",1.0.2n (from upstream Oracle patches),1.0.0x,1.0.1h,"
15-
1.0.2o","1.1.1w (statically linked with stdlib “ssl”)
16-
1.1.1w (statically linked with cryptography)",1.1.0g,1.1.1f,"1.1.1w (statically linked with stdlib “ssl”)
17-
1.1.1w (statically linked with cryptography)","1.0.2t (bundled with upstream Python 2.7.18)
5+
1.0.2v-chevah5¹⁵ (statically linked with cryptography)","1.1.1w-chevah2 (statically linked with stdlib “ssl”)
6+
1.1.1w-chevah2 (statically linked with cryptography)","1.1.1w-chevah2 (statically linked with stdlib “ssl”)
7+
1.1.1w-chevah2 (statically linked with cryptography)","1.1.1w-chevah2 (statically linked with stdlib “ssl”)
8+
1.1.1w-chevah2 (statically linked with cryptography)",1.0.1u,1.0.2s,1.0.2h,"1.1.1w-chevah2 (statically linked with stdlib “ssl”)
9+
1.1.1w-chevah2 (statically linked with cryptography)","1.1.1g (statically built for stdlib “ssl”)
10+
1.1.1g (bundled with upstream cryptography 2.9.1)","1.1.1w-chevah2 (statically linked with stdlib “ssl”)
11+
1.1.1w-chevah2 (statically linked with cryptography)","1.1.1cFIPS /
12+
1.1.1k FIPS","1.1.1w-chevah2 (statically linked with stdlib “ssl”)
13+
1.1.1w-chevah2 (statically linked with cryptography)","1.1.1w-chevah2 (statically linked with stdlib “ssl”)
14+
1.1.1w-chevah2 (statically linked with cryptography)",1.0.2n (from upstream Oracle patches),1.0.0x,1.0.1h,"
15+
1.0.2o","1.1.1w-chevah2 (statically linked with stdlib “ssl”)
16+
1.1.1w-chevah2 (statically linked with cryptography)",1.1.0g,1.1.1f,"1.1.1w-chevah2 (statically linked with stdlib “ssl”)
17+
1.1.1w-chevah2 (statically linked with cryptography)","1.0.2t (bundled with upstream Python 2.7.18)
1818
1.1.1g (bundled with upstream cryptography 2.9.1)","1.0.2t⁹ (bundled with upstream Python 2.7.18)
19-
1.1.1w (built from upstream sources for cryptography)"
19+
1.1.1w-chevah2 (built from upstream sources for cryptography)"
2020
Python,2.7.18+patches,2.7.18¹¹,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18¹¹,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18¹¹,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.8⁴,2.7.18¹¹,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18¹¹,2.7.18¹³
21-
SQLite,3.34.1,3.34.1,3.43.1,3.43.1,3.43.1,3.43.1,3.30.1,3.34.1,3.34.1,3.43.1,3.30.1,3.43.1,3.43.1,3.43.1,3.43.1,3.34.1,3.30.1,3.34.1,3.34.1,3.43.1,3.43.1,3.43.1,3.43.1,3.30.1 (we overwrite version from upstream Python at build time),3.43.1 (we overwrite version from upstream Python at build time)
21+
SQLite,3.46.0,3.34.1,3.46.0,3.46.0,3.46.0,3.46.0,3.30.1,3.46.0,3.46.0,3.46.0,3.30.1,3.46.0,3.46.0,3.46.0,3.46.0,3.46.0,3.30.1,3.46.0,3.46.0,3.46.0,3.46.0,3.46.0,3.46.0,3.30.1 (we overwrite version from upstream Python at build time),3.46.0 (we overwrite version from upstream Python at build time)
2222
Expat,2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.1.0⁵ (bundled with Python 2.7.8),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python)
23-
zlib,1.2.12,p/o,1.3,1.3,p/o,1.3,p/o,p/o,1.2.12,1.3,p/o,1.3,p/o,1.3,1.3,p/o,p/o,p/o,p/o,1.3,p/o,p/o,1.3,1.2.11⁸ (bundled with Python),1.2.11⁸ (bundled with Python)
23+
zlib,1.2.12,p/o,1.3.1,1.3.1,1.3.1,1.3.1,p/o,p/o,1.2.12,1.3.1,p/o,1.3.1,p/o,1.3.1,1.3.1,p/o,p/o,p/o,p/o,1.3.1,p/o,p/o,1.3.1,1.2.11⁸ (bundled with Python),1.2.11⁸ (bundled with Python)
2424
bzip2,1.0.8,1.0.8,1.0.8,1.0.8,1.0.8,1.0.8,p/o,p/o,1.0.8,p/o,p/o,1.0.8,1.0.8,1.0.8,1.0.8,p/o,p/o,p/o,p/o,1.0.8,1.0.8,1.0.8,1.0.8,1.0.6 (bundled with Python),1.0.6 (bundled with Python)
25-
libffi,3.4.4,3.4.2,3.4.4,p/o,3.4.4,3.4.4,3.4.2,3.4.2,3.4.2,p/o,p/o,3.4.4,p/o,3.4.4,3.4.4,n/a,n/a,3.4.2,3.4.2,p/o,p/o,p/o,p/o,n/a,n/a
25+
libffi,3.4.6,3.4.2,3.4.6,3.4.6,3.4.6,3.4.6,3.4.2,3.4.2,3.4.2,p/o,p/o,3.4.6,p/o,3.4.6,3.4.6,n/a,n/a,3.4.2,3.4.2,3.4.6,p/o,p/o,3.4.6,n/a,n/a
2626
libedit,n/a,n/a,n/a,n/a,20170329-3.1,n/a,20170329-3.1,20170329-3.1,n/a,n/a,20170329-3.1,n/a,20170329-3.1,n/a,n/a,n/a,20170329-3.1,20170329-3.1,20170329-3.1,n/a,20170329-3.1,20170329-3.1,n/a,n/a,n/a
2727
pysqlite,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,"n/a, upstream sqlite3 is used","n/a, upstream sqlite3 is used"
2828
pip,20.3.4¹⁴,9.0.3¹⁴,20.3.4chevah1,20.3.4chevah1,20.3.4chevah1,20.3.4chevah1,9.0.3¹⁴,20.3.4chevah1,20.3.4¹⁴,20.3.4chevah1,9.0.3¹⁴,20.3.4chevah1,20.3.4chevah1,20.3.4chevah1,20.3.4chevah1,20.3.4¹⁴,9.0.3¹⁴,20.3.4¹⁴,20.3.4chevah1,20.3.4chevah1,20.3.4chevah1,20.3.4chevah1,20.3.4chevah1,20.3.4¹⁴,20.3.4chevah1
2929
setuptools,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,41.6.0¹⁷,41.6.0¹⁷,41.6.0¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷,44.1.1¹⁷
3030
pycparser,2.20,2.20,2.21,2.21,2.21,2.21,2.20,2.21,2.20,2.21,2.20,2.21,2.21,2.21,2.21,2.20,2.20,2.20,2.21,2.21,2.21,2.21,2.21,2.20,2.21
3131
setproctitle,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10
32-
cryptography,3.2.1¹²,2.9.2¹²,3.2.1¹⁶,3.3.2¹⁶,3.3.2¹⁶,3.3.2¹⁶,2.9.2¹²,3.3.2¹⁶,n/a,3.3.2¹⁶,2.9.2¹² (wheel includes OpenSSL),3.3.2¹⁶,3.3.2¹⁶,3.3.2¹⁶,3.3.2¹⁶,n/a,n/a,n/a,3.2.1¹²,3.3.2¹⁶,3.3.2¹⁶,3.3.2¹⁶,3.3.2¹⁶,2.9.2¹² (wheel includes OpenSSL),3.3.2¹⁶
32+
cryptography,3.2.1¹²,2.9.2¹²,3.2.1+patches,3.3.2+patches¹⁶,3.3.2+patches¹⁶,3.3.2+patches¹⁶,2.9.2¹²,3.3.2+patches¹⁶,n/a,3.3.2+patches¹⁶,2.9.2¹² (wheel includes OpenSSL),3.3.2+patches¹⁶,3.3.2+patches¹⁶,3.3.2+patches¹⁶,3.3.2+patches¹⁶,n/a,n/a,n/a,3.2.1¹²,3.3.2+patches¹⁶,3.3.2+patches¹⁶,3.3.2+patches¹⁶,3.3.2+patches¹⁶,2.9.2¹² (wheel includes OpenSSL),3.3.2+patches¹⁶
3333
six,1.15.0,1.13.0,1.15.0,1.15.0,1.15.0,1.15.0,1.11.0,1.15.0,1.15.0,1.15.0,1.11.0,1.15.0,1.15.0,1.15.0,1.15.0,1.15.0,1.11.0,1.15.0,1.15.0,1.11.0,1.11.0,1.11.0,1.11.0,1.11.0,1.11.0
3434
ipaddress,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,n/a,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,n/a,n/a,n/a,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23
3535
cffi,1.14.5,1.14.0,1.15.1,1.15.1,1.15.1,1.15.1,1.14.0,1.15.1,n/a,1.15.1,1.14.0,1.15.1,1.15.1,1.15.1,1.15.1,n/a,1.14.0,1.14.5,1.15.1,1.15.1,1.15.1,1.15.1,1.15.1,1.14.0,1.15.1
@@ -38,10 +38,10 @@ enum34,1.1.10,1.1.6,1.1.10,1.1.10,1.1.10,1.1.10,1.1.6,1.1.10,n/a,1.1.10,1.1.6,1.
3838
idna,n/a,2.6,n/a,n/a,n/a,n/a,2.6,n/a,n/a,n/a,2.6,n/a,n/a,n/a,n/a,n/a,2.6,n/a,n/a,n/a,n/a,n/a,n/a,2.6,n/a
3939
pyOpenSSL,19.1.0,19.1.0,19.1.0,21.0.0,21.0.0,21.0.0,19.1.0,21.0.0,0.13.1⁷,21.0.0,19.1.0,21.0.0,21.0.0,21.0.0,21.0.0,0.13.1⁷,0.13.1⁷,0.13.1⁷,19.1.0,21.0.0,21.0.0,21.0.0,21.0.0,19.1.0,21.0.0
4040
scandir,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0,1.10.0
41-
psutil,n/a,5.6.5,5.9.5,5.9.5,5.9.5,5.9.5,n/a,5.9.2,n/a,5.9.5,5.6.5,5.9.5,5.9.5,5.9.5,5.9.5,n/a,n/a,n/a,5.9.2,5.9.5,5.9.5,5.9.5,5.9.5,n/a,5.9.5
41+
psutil,n/a,5.6.5,6.0.0,5.9.6,6.0.0,5.9.6,n/a,5.9.2,n/a,6.0.0,5.6.5,5.9.6,6.0.0,5.9.6,5.9.6,n/a,n/a,n/a,6.0.0,5.9.6,6.0.0,6.0.0,5.9.6,n/a,6.0.0
4242
subprocess32,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4,3.5.4
4343
bcrypt,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,n/a,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7,3.1.7
44-
pywin32,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,,n/a,227,228
44+
pywin32,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,n/a,227,228
4545
,,,,,,,,,,,,,,,,,,,,,,,,,
4646
Abbreviations:,n/a: not applicable,,,,,,,,,,Notes:,"0. Dependencies above are listed as per the current build process, not necessarily for the latest released versions of python-package.",,,,,,,,,,,,,
4747
,p/o: provided with OS,,,,,,,,,,,"1. Tier 1 platforms, fully supported and tested",,,,,,,,,,,,,
@@ -56,8 +56,8 @@ Colour codes:,DARKGREY: Tier 2 platforms and their problematic dependencies,,,,,
5656
,,,,,,,,,,,,10. https://www.openssl.org/news/openssl-1.1.1-notes.html,,,,,,,,,,,,,
5757
,,,,,,,,,,,,11. https://github.com/ActiveState/cpython/tags,,,,,,,,,,,,,
5858
,,,,,,,,,,,,12. https://cryptography.io/en/latest/changelog.html,,,,,,,,,,,,,
59-
,,,,,,,,,,,,"13. On Windows, the upstream Python 2.7.18 packages are hot patched for all known issues except CVE-2021-3177 and CVE-2020-10735",,,,,,,,,,,,,
59+
,,,,,,,,,,,,"13. On Windows, the upstream Python 2.7.18 packages are not patched for CVE-2020-10735, CVE-2021-3177, CVE-2022-48560, CVE-2022-48566, CVE-2023-40217, CVE-2024-0397.",,,,,,,,,,,,,
6060
,,,,,,,,,,,,14. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3572,,,,,,,,,,,,,
6161
,,,,,,,,,,,,15. Corresponds to upstream OpenSSL version 1.0.2zg from 07 Feb 2023.,,,,,,,,,,,,,
62-
,,,,,,,,,,,,"16. Both cryptography 3.2.1 and version 3.3.2 have been patched for CVE-2023-23931, but not for CVE-2023-38325.",,,,,,,,,,,,,
63-
,,,,,,,,,,,,17. Versions older than 65.5.1 are vulnerable to CVE-2022-40897.,,,,,,,,,,,,,
62+
,,,,,,,,,,,,"16. Both cryptography 3.2.1 and version 3.3.2+patches have been patched for CVE-2023-23931 and CVE-2023-49083, but not for CVE-2023-38325. Other issues might be present.",,,,,,,,,,,,,
63+
,,,,,,,,,,,,"17. Vulnerable to CVE-2022-40897, CVE-2024-6345.",,,,,,,,,,,,,

0 commit comments

Comments
 (0)