PT-2025-54912 · Opensuse · Python39+2

Publicado 2025-12-17 · Atualizado 2025-12-17

OSV

This update for python39 fixes the following issues:

• Update to 3.9.25:

• Security
  • gh-137836: Add support of the “plaintext” element, RAWTEXT elements “xmp”, “iframe”, “noembed” and “noframes”, and optionally RAWTEXT element “noscript” in html.parser.HTMLParser.
  • gh-136063: email.message: ensure linear complexity for legacy HTTP parameters parsing. Patch by Bénédikt Tran.
• Library
  • gh-98793: Fix argument typechecks in overlapped.WSAConnect() and overlapped.Overlapped.WSASendTo() functions. bpo-44817: Ignore WinError 53 (ERROR BAD NETPATH), 65 (ERROR NETWORK ACCESS DENIED) and 161 (ERROR BAD PATHNAME) when using ntpath.realpath().
• Core and Builtins
  • gh-120384: Fix an array out of bounds crash in list ass subscript, which could be invoked via some specificly tailored input: including concurrent modification of a list object, where one thread assigns a slice and another clears it.
  • gh-120298: Fix use-after free in list richcompare impl which can be invoked via some specificly tailored evil input.

Identificadores relacionados

SUSE-SU-2025:4433-1

Produtos afetados

Python39

Python39-Core

Python39-Documentation

Referências · 2

• https://suse.com/support/update/announcement/2025/suse-su-20254433-1 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2025:4433-1 · Aviso do Fabricante