Skip to content

Commit 35d3ba3

Browse files
CBL-Mariner-Botjykanasembykhovtsev-ms
authored
[AUTO-CHERRYPICK] [High] Patch python3 for CVE-2025-4516, CVE-2025-4517, CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435 - branch 3.0-dev (#14005)
Co-authored-by: jykanase <v-jykanase@microsoft.com> Co-authored-by: Mykhailo Bykhovtsev <108374904+mbykhovtsev-ms@users.noreply.github.com>
1 parent 328d46a commit 35d3ba3

7 files changed

Lines changed: 2528 additions & 21 deletions

File tree

‎SPECS/python3/CVE-2025-4516.patch‎

Lines changed: 565 additions & 0 deletions
Large diffs are not rendered by default.

‎SPECS/python3/CVE-2025-4517.patch‎

Lines changed: 1937 additions & 0 deletions
Large diffs are not rendered by default.

‎SPECS/python3/python3.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
Summary: A high-level scripting language
77
Name: python3
88
Version: 3.12.9
9-
Release: 1%{?dist}
9+
Release: 2%{?dist}
1010
License: PSF
1111
Vendor: Microsoft Corporation
1212
Distribution: Azure Linux
@@ -17,6 +17,8 @@ Source0: https://www.python.org/ftp/python/%{version}/Python-%{version}.t
1717
# It has been removed in Python-3.12.0.tar.xz, but as our packages still require it, we will still provide for now.
1818
Source1: https://github.com/python/cpython/blob/3.9/Tools/scripts/pathfix.py
1919
Patch0: cgi3.patch
20+
Patch1: CVE-2025-4516.patch
21+
Patch2: CVE-2025-4517.patch
2022

2123
BuildRequires: bzip2-devel
2224
BuildRequires: expat-devel >= 2.1.0
@@ -238,6 +240,9 @@ rm -rf %{buildroot}%{_bindir}/__pycache__
238240
%{_libdir}/python%{majmin}/test/*
239241

240242
%changelog
243+
* Tue Jun 10 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 3.12.9-2
244+
- Patch CVE-2025-4516, CVE-2025-4517, CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4330
245+
241246
* Mon Feb 17 2025 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 3.12.9-1
242247
- Auto-upgrade to 3.12.9 - to fix CVE-2025-0938 & CVE-2024-4032
243248
- Clean up the earlier patches not needed anymore

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -244,9 +244,9 @@ ca-certificates-base-3.0.0-8.azl3.noarch.rpm
244244
ca-certificates-3.0.0-8.azl3.noarch.rpm
245245
dwz-0.14-2.azl3.aarch64.rpm
246246
unzip-6.0-22.azl3.aarch64.rpm
247-
python3-3.12.9-1.azl3.aarch64.rpm
248-
python3-devel-3.12.9-1.azl3.aarch64.rpm
249-
python3-libs-3.12.9-1.azl3.aarch64.rpm
247+
python3-3.12.9-2.azl3.aarch64.rpm
248+
python3-devel-3.12.9-2.azl3.aarch64.rpm
249+
python3-libs-3.12.9-2.azl3.aarch64.rpm
250250
python3-setuptools-69.0.3-5.azl3.noarch.rpm
251251
python3-pygments-2.7.4-2.azl3.noarch.rpm
252252
which-2.21-8.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -244,9 +244,9 @@ ca-certificates-base-3.0.0-8.azl3.noarch.rpm
244244
ca-certificates-3.0.0-8.azl3.noarch.rpm
245245
dwz-0.14-2.azl3.x86_64.rpm
246246
unzip-6.0-22.azl3.x86_64.rpm
247-
python3-3.12.9-1.azl3.x86_64.rpm
248-
python3-devel-3.12.9-1.azl3.x86_64.rpm
249-
python3-libs-3.12.9-1.azl3.x86_64.rpm
247+
python3-3.12.9-2.azl3.x86_64.rpm
248+
python3-devel-3.12.9-2.azl3.x86_64.rpm
249+
python3-libs-3.12.9-2.azl3.x86_64.rpm
250250
python3-setuptools-69.0.3-5.azl3.noarch.rpm
251251
python3-pygments-2.7.4-2.azl3.noarch.rpm
252252
which-2.21-8.azl3.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -531,18 +531,18 @@ pyproject-rpm-macros-1.12.0-2.azl3.noarch.rpm
531531
pyproject-srpm-macros-1.12.0-2.azl3.noarch.rpm
532532
python-markupsafe-debuginfo-2.1.3-1.azl3.aarch64.rpm
533533
python-wheel-wheel-0.43.0-1.azl3.noarch.rpm
534-
python3-3.12.9-1.azl3.aarch64.rpm
534+
python3-3.12.9-2.azl3.aarch64.rpm
535535
python3-audit-3.1.2-1.azl3.aarch64.rpm
536536
python3-cracklib-2.9.11-1.azl3.aarch64.rpm
537-
python3-curses-3.12.9-1.azl3.aarch64.rpm
537+
python3-curses-3.12.9-2.azl3.aarch64.rpm
538538
python3-Cython-3.0.5-2.azl3.aarch64.rpm
539-
python3-debuginfo-3.12.9-1.azl3.aarch64.rpm
540-
python3-devel-3.12.9-1.azl3.aarch64.rpm
539+
python3-debuginfo-3.12.9-2.azl3.aarch64.rpm
540+
python3-devel-3.12.9-2.azl3.aarch64.rpm
541541
python3-flit-core-3.9.0-1.azl3.noarch.rpm
542542
python3-gpg-1.23.2-2.azl3.aarch64.rpm
543543
python3-jinja2-3.1.2-3.azl3.noarch.rpm
544544
python3-libcap-ng-0.8.4-1.azl3.aarch64.rpm
545-
python3-libs-3.12.9-1.azl3.aarch64.rpm
545+
python3-libs-3.12.9-2.azl3.aarch64.rpm
546546
python3-libxml2-2.11.5-5.azl3.aarch64.rpm
547547
python3-lxml-4.9.3-1.azl3.aarch64.rpm
548548
python3-magic-5.45-1.azl3.noarch.rpm
@@ -554,8 +554,8 @@ python3-pygments-2.7.4-2.azl3.noarch.rpm
554554
python3-rpm-4.18.2-1.azl3.aarch64.rpm
555555
python3-rpm-generators-14-11.azl3.noarch.rpm
556556
python3-setuptools-69.0.3-5.azl3.noarch.rpm
557-
python3-test-3.12.9-1.azl3.aarch64.rpm
558-
python3-tools-3.12.9-1.azl3.aarch64.rpm
557+
python3-test-3.12.9-2.azl3.aarch64.rpm
558+
python3-tools-3.12.9-2.azl3.aarch64.rpm
559559
python3-wheel-0.43.0-1.azl3.noarch.rpm
560560
readline-8.2-2.azl3.aarch64.rpm
561561
readline-debuginfo-8.2-2.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -539,18 +539,18 @@ pyproject-rpm-macros-1.12.0-2.azl3.noarch.rpm
539539
pyproject-srpm-macros-1.12.0-2.azl3.noarch.rpm
540540
python-markupsafe-debuginfo-2.1.3-1.azl3.x86_64.rpm
541541
python-wheel-wheel-0.43.0-1.azl3.noarch.rpm
542-
python3-3.12.9-1.azl3.x86_64.rpm
542+
python3-3.12.9-2.azl3.x86_64.rpm
543543
python3-audit-3.1.2-1.azl3.x86_64.rpm
544544
python3-cracklib-2.9.11-1.azl3.x86_64.rpm
545-
python3-curses-3.12.9-1.azl3.x86_64.rpm
545+
python3-curses-3.12.9-2.azl3.x86_64.rpm
546546
python3-Cython-3.0.5-2.azl3.x86_64.rpm
547-
python3-debuginfo-3.12.9-1.azl3.x86_64.rpm
548-
python3-devel-3.12.9-1.azl3.x86_64.rpm
547+
python3-debuginfo-3.12.9-2.azl3.x86_64.rpm
548+
python3-devel-3.12.9-2.azl3.x86_64.rpm
549549
python3-flit-core-3.9.0-1.azl3.noarch.rpm
550550
python3-gpg-1.23.2-2.azl3.x86_64.rpm
551551
python3-jinja2-3.1.2-3.azl3.noarch.rpm
552552
python3-libcap-ng-0.8.4-1.azl3.x86_64.rpm
553-
python3-libs-3.12.9-1.azl3.x86_64.rpm
553+
python3-libs-3.12.9-2.azl3.x86_64.rpm
554554
python3-libxml2-2.11.5-5.azl3.x86_64.rpm
555555
python3-lxml-4.9.3-1.azl3.x86_64.rpm
556556
python3-magic-5.45-1.azl3.noarch.rpm
@@ -562,8 +562,8 @@ python3-pygments-2.7.4-2.azl3.noarch.rpm
562562
python3-rpm-4.18.2-1.azl3.x86_64.rpm
563563
python3-rpm-generators-14-11.azl3.noarch.rpm
564564
python3-setuptools-69.0.3-5.azl3.noarch.rpm
565-
python3-test-3.12.9-1.azl3.x86_64.rpm
566-
python3-tools-3.12.9-1.azl3.x86_64.rpm
565+
python3-test-3.12.9-2.azl3.x86_64.rpm
566+
python3-tools-3.12.9-2.azl3.x86_64.rpm
567567
python3-wheel-0.43.0-1.azl3.noarch.rpm
568568
readline-8.2-2.azl3.x86_64.rpm
569569
readline-debuginfo-8.2-2.azl3.x86_64.rpm

0 commit comments

Comments
 (0)