Skip to content

Commit 8652702

Browse files
ambvambv
committed
Python 3.9.23
1 parent 920a1c3 commit 8652702

12 files changed

+100
-29
lines changed

‎Include/patchlevel.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@
1818
/*--start constants--*/
1919
#define PY_MAJOR_VERSION 3
2020
#define PY_MINOR_VERSION 9
21-
#define PY_MICRO_VERSION 22
21+
#define PY_MICRO_VERSION 23
2222
#define PY_RELEASE_LEVEL PY_RELEASE_LEVEL_FINAL
2323
#define PY_RELEASE_SERIAL 0
2424

2525
/* Version as a string */
26-
#define PY_VERSION "3.9.22+"
26+
#define PY_VERSION "3.9.23"
2727
/*--end constants--*/
2828

2929
/* Version as a single 4-byte hex number, e.g. 0x010502B2 == 1.5.2b2.

‎Misc/NEWS.d/3.9.23.rst

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
.. date: 2025-06-02-11-32-23
2+
.. gh-issue: 135034
3+
.. nonce: RLGjbp
4+
.. release date: 2025-06-03
5+
.. section: Security
6+
7+
Fixes multiple issues that allowed ``tarfile`` extraction filters
8+
(``filter="data"`` and ``filter="tar"``) to be bypassed using crafted
9+
symlinks and hard links.
10+
11+
Addresses CVE 2024-12718, CVE 2025-4138, CVE 2025-4330, and CVE 2025-4517.
12+
13+
..
14+
15+
.. date: 2025-05-09-20-22-54
16+
.. gh-issue: 133767
17+
.. nonce: kN2i3Q
18+
.. section: Security
19+
20+
Fix use-after-free in the "unicode-escape" decoder with a non-"strict" error
21+
handler.
22+
23+
..
24+
25+
.. date: 2025-01-14-11-19-07
26+
.. gh-issue: 128840
27+
.. nonce: M1doZW
28+
.. section: Security
29+
30+
Short-circuit the processing of long IPv6 addresses early in
31+
:mod:`ipaddress` to prevent excessive memory consumption and a minor
32+
denial-of-service.
33+
34+
..
35+
36+
.. date: 2024-08-06-11-43-08
37+
.. gh-issue: 80222
38+
.. nonce: wfR4BU
39+
.. section: Security
40+
41+
Fix bug in the folding of quoted strings when flattening an email message
42+
using a modern email policy. Previously when a quoted string was folded so
43+
that it spanned more than one line, the surrounding quotes and internal
44+
escapes would be omitted. This could theoretically be used to spoof header
45+
lines using a carefully constructed quoted string if the resulting rendered
46+
email was transmitted or re-parsed.
47+
48+
..
49+
50+
.. date: 2025-05-28-15-53-27
51+
.. gh-issue: 128840
52+
.. nonce: Nur2pB
53+
.. section: Library
54+
55+
Fix parsing long IPv6 addresses with embedded IPv4 address.
56+
57+
..
58+
59+
.. date: 2025-05-15-14-27-01
60+
.. gh-issue: 134062
61+
.. nonce: fRbJet
62+
.. section: Library
63+
64+
:mod:`ipaddress`: fix collisions in :meth:`~object.__hash__` for
65+
:class:`~ipaddress.IPv4Network` and :class:`~ipaddress.IPv6Network` objects.
66+
67+
..
68+
69+
.. date: 2024-08-28-13-03-36
70+
.. gh-issue: 123409
71+
.. nonce: lW0YF-
72+
.. section: Library
73+
74+
Fix :attr:`ipaddress.IPv6Address.reverse_pointer` output according to
75+
:rfc:`RFC 3596, §2.5 <3596#section-2.5>`. Patch by Bénédikt Tran.
76+
77+
..
78+
79+
.. bpo: 43633
80+
.. date: 2021-10-31-16-06-28
81+
.. nonce: vflwXv
82+
.. section: Library
83+
84+
Improve the textual representation of IPv4-mapped IPv6 addresses
85+
(:rfc:`4291` Sections 2.2, 2.5.5.2) in :mod:`ipaddress`. Patch by Oleksandr
86+
Pavliuk.
87+
88+
..
89+
90+
.. bpo: 25264
91+
.. date: 2021-04-08-22-11-27
92+
.. nonce: b33fa0
93+
.. section: Library
94+
95+
:func:`os.path.realpath` now accepts a *strict* keyword-only argument. When
96+
set to ``True``, :exc:`OSError` is raised if a path doesn't exist or a
97+
symlink loop is encountered.

‎Misc/NEWS.d/next/Library/2021-04-08-22-11-27.bpo-25264.b33fa0.rst

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎Misc/NEWS.d/next/Library/2021-10-31-16-06-28.bpo-43633.vflwXv.rst

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎Misc/NEWS.d/next/Library/2024-08-28-13-03-36.gh-issue-123409.lW0YF-.rst

Lines changed: 0 additions & 2 deletions
This file was deleted.

‎Misc/NEWS.d/next/Library/2025-05-15-14-27-01.gh-issue-134062.fRbJet.rst

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎Misc/NEWS.d/next/Library/2025-05-28-15-53-27.gh-issue-128840.Nur2pB.rst

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎Misc/NEWS.d/next/Security/2024-08-06-11-43-08.gh-issue-80222.wfR4BU.rst

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎Misc/NEWS.d/next/Security/2025-01-14-11-19-07.gh-issue-128840.M1doZW.rst

Lines changed: 0 additions & 2 deletions
This file was deleted.

‎Misc/NEWS.d/next/Security/2025-05-09-20-22-54.gh-issue-133767.kN2i3Q.rst

Lines changed: 0 additions & 2 deletions
This file was deleted.

‎Misc/NEWS.d/next/Security/2025-06-02-11-32-23.gh-issue-135034.RLGjbp.rst

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎README.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
This is Python version 3.9.22
1+
This is Python version 3.9.23
22
=============================
33

44
.. image:: https://travis-ci.org/python/cpython.svg?branch=3.9

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy