[CVE-2022-0391] bpo-43882 - urllib.parse should sanitize urls containing ASCII newline and tabs. (GH-25595) (GH-25726)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
(cherry picked from commit 76cd81d)
Co-authored-by: Senthil Kumaran <senthil@uthcode.com>
Co-authored-by: Senthil Kumaran <skumaran@gatech.edu>
(cherry picked from commit 515a7bc)

Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Change-Id: Ia736aa48623abda5b1f8d10c9512dcbb139db492
Signed-off-by: JinWang An <jinwang.an@samsung.com>

[CVE-2022-45061] gh-98433: Fix quadratic time idna decoding. (GH-99092) (GH-99232)

From b0b590be9597fd5919228d251812dd54145f70a7 Mon Sep 17 00:00:00 2001
From: "Miss Islington (bot)"
 <31488909+miss-islington@users.noreply.github.com>
Date: Mon, 7 Nov 2022 19:22:14 -0800

There was an unnecessary quadratic loop in idna decoding. This restores
the behavior to linear.

(cherry picked from commit a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15)

Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Change-Id: I9a1277f3b3c6d07f04787402400a859a015fab21
Signed-off-by: JinWang An <jinwang.an@samsung.com>

Fix infinite loop in the tarfile module

In Lib/tarfile.py in Python through 3.8.3, an attacker
is able to craft a TAR archive leading to an infinite
loop when opened by tarfile.open, because _proc_pax
lacks header validation.

Change-Id: I3834647b15fc334cdd2d878c6cb4f368844edbb0
Signed-off-by: JinWang An <jinwang.an@samsung.com>

[CVE-2019-18348] Disallow control characters in hostnames in http.client

An issue was discovered in urllib2 in Python 2.x through 2.7.17
and urllib in Python 3.x through 3.8.0. CRLF injection
is possible if the attacker controls a url parameter,
as demonstrated by the first argument to urllib.request.
urlopen with \r\n (specifically in the host component
of a URL) followed by an HTTP header.

Change-Id: I733ec1d4986c5b638865ed70530f70a3ea0bd524
Signed-off-by: JinWang An <jinwang.an@samsung.com>

[CVE-2017-18207]Improve exceptions in aifc, wave and sunau.

** DISPUTED ** The Wave_read._read_fmt_chunk function
in Lib/wave.py in Python through 3.6.4 does not ensure
a nonzero channel value, which allows attackers to cause
a denial of service (divide-by-zero and exception) via
a crafted wav format audio file. NOTE: the vendor disputes
this issue because Python applications "need
to be prepared to handle a wide variety of exceptions."

Change-Id: Ia7b958c4d95596552802eda52f257fcc3fcc7469
Signed-off-by: JinWang An <jinwang.an@samsung.com>

[CVE-2020-8492] Fix AbstractBasicAuthHandler

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10,
3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server
to conduct Regular Expression Denial of Service (ReDoS) attacks
against a client because of urllib.request.AbstractBasicAuthHandler
catastrophic backtracking.

Change-Id: I44694a5b63583e554fcb6c6ec0b78c1c640d8f85
Signed-off-by: JinWang An <jinwang.an@samsung.com>

Remove gcc_version macro at spec file

Change-Id: If74f7d4bd5deff2d60fa4051e09bc20f648353d4

Fix build error

Add gcc version check logic for nis.so

Change-Id: I9ea2b37545e0c4aaf5a96cdbfc00a7c9bd58f721

Merge "[Tizen 6.0] Enable build" into tizen_base

[Tizen 6.0] Enable build

The NIS(+) name service modules are deprecated since glibc 2.27 and will not be
built or installed by default.

Change-Id: I7837dcd2b8fe52c210d01510a1f2fc3e58554073
Signed-off-by: Mikhail Kashkarov <m.kashkarov@partner.samsung.com>

Bump to python 2.7.17

Change-Id: I2fd8a054291e106d15ec215436225e05f1892bce
Signed-off-by: Hyunjee Kim <hj0426.kim@samsung.com>

Merge branch 'tizen_base' of ssh://review.tizen.org:29418/platform/upstream/python into tizen_base

Change-Id: I9fd2ad642ab1efbdb407fcbf5c7401346ecf8076
Signed-off-by: Hyunjee Kim <hj0426.kim@samsung.com>

Rebase for python 2.7.17

Change-Id: Icff2d8252c3fa81efa45f009602a6088c27f47c4
Signed-off-by: Hyunjee Kim <hj0426.kim@samsung.com>

Imported Upstream version 2.7.17

Imported Upstream version 2.7.16

[CVE-2019-16935] bpo-38243: Escape the server title of DocXMLRPCServer (GH-16447)

Escape the server title of DocXMLRPCServer.DocXMLRPCServer
when rendering the document page as HTML.

Change-Id: Id7e5a2c440b9a2e9bc832bd321740ce0c1581edf
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>

bpo-34155: Dont parse domains containing @ (GH-13079) (GH-16006)

This change skips parsing of email addresses where domains include a "@" character, which can be maliciously used since the local part is returned as a complete address.

(cherry picked from commit 8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9)

Excludes changes to Lib/email/_header_value_parser.py, which did not
exist in 2.7.

Co-authored-by: jpic <jpic@users.noreply.github.com>
https://bugs.python.org/issue34155
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>
Change-Id: Ice4cb0bcaf4fdd4172b603d1a19def3bbbbec2ea

Migrate to openssl 1.1

Change-Id: Ifefed273e76951c416b527c9ceee26c9a9df449b

Add PIE option at python makefile

Change-Id: I4138e7d42a195099781148100220dc1c136d5714

[CVE-2019-9636]bpo-36216: Add check for characters in netloc that normalize to separators (GH-12201)

Change-Id: I728d96130c1208753eae3f0646aa9cab2b76dd9b
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>

Bump to python 2.7.15

[Model] All
[BinType] AP
[Customer] OPEN

[Issue#] N/A
[Request] N/A
[Occurrence Version] N/A

[Problem] python version upgrade
[Cause & Measure]
[Checking Method]

[Team] Open Source Management and Setting Part
[Developer] dh0128.kwak
[Solution company] Samsung
[Change Type] N/A

Change-Id: I28e8832b87b20556efd740ce95c0be11c94bc206
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>

Imported Upstream version 2.7.15

Change-Id: Id9c63619cb3e0b8e0af22357474f6f6429c63c61
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>

Imported Upstream version 2.7.14

Change-Id: Icfe8dc39f6e866f9cdf059cfd57789fed01f9469
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>

Imported Upstream version 2.7.13

Change-Id: Ide143efb88a819e2d9b350dbcbbfa75b890f0667
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>

Imported Upstream version 2.7.12

Change-Id: Id086dcc8e315c8ad61502768ef9b92372461e560
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>

Imported Upstream version 2.7.11

Change-Id: I6fd1d4f1828aa56cf9e1ece97699852529157243
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>

Imported Upstream version 2.7.10

Change-Id: I71e04a6e83b31198e3aff21913814359e60b7843
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>

Imported Upstream version 2.7.9

Change-Id: If7320cd9a5b047aa0471ec569221ef7d9bc978b4
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>

Imported Upstream version 2.7.8

Imported Upstream version 2.7.3