# changelog

author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.18-2
changelog:
  - Security fix for CVE-2020-26116: Reject control chars in HTTP method in httplib.putrequest
  Resolves: rhbz#1883258


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.18-6
changelog:
  - Security fix for CVE-2020-27619: eval() call on content received via HTTP in the CJK codec tests
  Resolves: rhbz#1889886


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.18-9
changelog:
  - Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response
  Resolves: rhbz#2036020


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.18-10
changelog:
  - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs
  Resolves: rhbz#2047376


author: Aleksey Deyneko <adeyneko@cloudlinux.com> - 2.7.18-10.tuxcare.els1
changelog:
  - Add AlmaLinux to supported distros
  - Security fix for CVE-2015-20107
  - Fix the test suite support for Expat >= 2.4.5
  - Fix passing test_codecs and test_locale


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 2.7.18-10.tuxcare.els3
changelog:
  - CVE-2023-24329: Prevent urllib.parse.urlparse from accepting schemes that
    don't begin with an alphabetical ASCII character
  - Exclude unstable 'test_smtplib' from testing on aarch64


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 2.7.18-10.tuxcare.els4
changelog:
  - CVE-2023-24329: part2: Start stripping C0 control and space chars in `urlsplit`
  - Also correct the first CVE-2023-24329 patch: Fix test_attributes_bad_scheme
    to check for non-ascii symbol as first character of url


author: Dmitriy Popov <dpopov@cloudlinux.com> - 2.7.18-10.tuxcare.els9
changelog:
  - CVE-2024-6232: remove backtracking when parsing tarfile headers
  - CVE-2024-7592: fix quadratic complexity in parsing "-quoted cookie values
    with backslashes


author: Petr Viktorin <pviktori@redhat.com> - 1.0.2-10
changelog:
  - Skip python2 tests to allow removing python2-unittest2 from the distribution
  - Fix workaround for allowing Python 2 for build


author: Petr Viktorin <pviktori@redhat.com> - 1.0.2-11
changelog:
  - Disable the python3 subpackage
    Functionality of funcsigs is available in Python 3's inspect module.


author: Petr Viktorin <pviktori@redhat.com> - 2.0.0-9
changelog:
  - Drop dependency on python3-funcsigs
    (funcsigs functionality is in the Python 3 standard library -- inspect)
  - Drop dependency on python2-unittest2
    (Not available in the distro)

  - Fix python2 requires names


author: Charalampos Stratakis <cstratak@redhat.com> - 9.0.3-15
changelog:
  - Use the system level root certificate instead of the one bundled in certifi
  Resolves: rhbz#1659551


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-16
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1702473
  Resolves: rhbz#1643829


author: Tomas Orsava <torsava@redhat.com> - 9.0.3-18
changelog:
  - Patch for pip install <url> allow directory traversal, leading to arbitrary file write
  Resolves: rhbz#1870184


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.3.1-9
changelog:
  - Python 2 binary package renamed to python2-pluggy
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Iryna Shcherbina <ishcherb@redhat.com> - 1.5.2-3
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Petr Viktorin <pviktori@redhat.com> - 3.4.2-3
changelog:
  - Use python3-sphinx to build the documentation
  - Skip the `non_ascii_paste_text` test, which needs internet access


author: Petr Viktorin <pviktori@redhat.com> - 3.4.2-6
changelog:
  - Don't use timeout in tests
    https://bugzilla.redhat.com/show_bug.cgi?id=1592940
  - Add missing BuildRequires


author: Petr Viktorin <pviktori@redhat.com> - 3.4.2-7
changelog:
  - Remove BuildRequires on python2-hypothesis, a circular dependency
  - Explicitly BuildRequire python-attrs


author: Tomas Orsava <torsava@redhat.com> - 3-28
changelog:
  - Fix the %py_dist_name macro to not convert dots (".") into dashes, so that
    submodules can be addressed as well
  Resolves: rhbz#1564095


author: Tomas Orsava <torsava@redhat.com> - 3-29
changelog:
  - Switch the Python 3 executable to /usr/libexec/platform-python
  - Update macros using pip or easy_install to be invoked through the main
    executable


author: Tomas Orsava <torsava@redhat.com> - 3-30
changelog:
  - Explicitly enable Python 2 when invoking Python 2 macros
    See: https://url.corp.redhat.com/rhel8-py2


author: Tomas Orsava <torsava@redhat.com> - 3-31
changelog:
  - Remove RHEL_ALLOW_PYTHON2_FOR_BUILD=1 from build and install macros,
    as that is where the user needs to set it themself


author: Tomas Orsava <torsava@redhat.com> - 3-32
changelog:
  - Merging: (Tue Jul 10 2018 Tomas Orsava <torsava@redhat.com> - 3-32)
    - Fix %py_byte_compile macro: when invoked with a Python 2 binary it also
      mistakenly ran py3_byte_compile
  - Merging: (Tue Jul 03 2018 Miro Hrončok <mhroncok@redhat.com> - 3-31)
    - Add %python3_platform useful for PYTHONPATH on arched builds
  - Merging: (Mon Jun 18 2018 Jason L Tibbitts III <tibbs@math.uh.edu> - 3-30)
    - Add %pypi_source macro, as well as %__pypi_url and
      %_pypi_default_extension.
  - Merging: (Wed Apr 18 2018 Miro Hrončok <mhroncok@redhat.com> - 3-29)
    - move macros.pybytecompile from python3-devel


author: Tomas Orsava <torsava@redhat.com> - 3-33
changelog:
  - macros.pybytecompile: Detect Python version through sys.version_info instead
    of guessing from the executable name


