Python官网安全更新（2022-03-16）

Python 3.10.3, 3.9.11, 3.8.13, and 3.7.13 are now available with security content

Python 3.10.3, 3.9.11, 3.8.13, and 3.7.13 are now available with security content Welcome again to the exciting world of releasing new Python versions!<br/>Last time around I was complaining about cursed releases. This time around I could complain about security content galore and how one of them ruined my ingenious idea to release Python on Pi Day and call it Py Day. Well, you can’t have everything in life. Or at least not everything at once.<br/>And yet it seems this time around we’ve got a lot of security fixes all at once. Just look at this list: 15 (sic!) CVEs: libexpat upgraded from 2.4.1 to 2.4.7 (BPO-46794, BPO-46932, BPO-46811, BPO-46784, BPO-46400)<br/>CVE-2022-0778: OpenSSL upgraded from 1.1.1l to 1.1.1n in macOS and Windows installers (BPO-47024)<br/>CVE-2016-3189, CVE-2019-12900: bzip2 upgraded from 1.0.6 to 1.0.8 in Windows installers (BPO-44549)<br/>CVE-2022-26488: Windows installer now ensures the correct path is being repaired when “Add to PATH” is used (BPO-46948)<br/>CVE-2021-28363: bundled pip upgraded from 21.2.4 to 22.0.4 (BPO-46985)authorization bypass fixed in urllib.request (BPO-46756)REDoS avoided in importlib.metadata (BPO-46474)SQLite upgraded from 3.36.0 to 3.37.2 in macOS and Windows installers (BPO-45925) Python 3.10.3Get it here: https://www.python.org/downloads/release/python-3103/Python 3.10.3 is the third maintenance release of the newest version <br/>of the Python programming language, which contains many new features and<br/> optimizations. We recommend it over the other releases listed below.<br/>This is a large bugfix release with 220 commits since 3.10.2. Just look at the change log!<br/>The next maintenance release of Python 3.10 is planned for early June. Python 3.9.11Get it here: https://www.python.org/downloads/release/python-3911/ This is the penultimate planned full bugfix release of Python 3.9. In<br/> mid-May, we’ll be releasing the last one, after which the 3.9 series <br/>will enter its security-only fixes period. More details in PEP 596.<br/>Python 3.9 is the first Python version since 2.7 to have a regular <br/>bugfix release larger than “.10”. It’s also still a significant release <br/>at 163 commits since 3.9.10. That’s in fact 30+ commits more than <br/>between 3.9.9 and 3.9.10. The change log isn’t as long as the 3.10.3 one but it’s still pretty extensive!<br/>As a reminder, on macOS, the default installer is now the new universal2<br/> variant. It’s compatible with Mac OS X 10.9 and newer, including macOS <br/>11 Big Sur and macOS 12 Monterey. Python installed with this variant <br/>will work natively on Apple Silicon processors. Python 3.8.13Get it here: https://www.python.org/downloads/release/python-3813/Changes<br/> here are almost exclusively security-only as the life cycle of Python <br/>versions prescribes. You might have noticed there is a small number of <br/>regular bug fixes nonetheless. This is because without those we wouldn’t<br/> be able to continue running the full test suite for the 3.8 branch. <br/>This in turn could hide regressions in future security fixes. Python 3.7.13Get it here: https://www.python.org/downloads/release/python-3713/Just like 3.8, Python 3.7 is in its security-only fixes period. In turn, the changes in 3.7.13 look almost identical to the ones in 3.8.13.<br/>Python 3.7 will continue to receive source-only releases until June 2023. We hope you enjoy the new releases<br/>Your friendly release team,<br/>Łukasz Langa @ambv<br/>Pablo Galindo Salgado @pablogsal<br/>Ned Deily @nad<br/>Steve Dower @steve.dower <br/>Posted by<br/>Łukasz Langa <br/>at<br/>11:55 AM <br/>Email ThisBlogThis!Share to TwitterShare to FacebookShare to Pinterest

Python是一种跨平台的计算机程序设计语言。是一种面向对象的动态类型语言,

<p><a target="_blank" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0778">CVE-2022-0778</a></p><p><a target="_blank" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3189">CVE-2016-3189</a></p><p><a target="_blank" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12900">CVE-2019-12900</a></p><p><a target="_blank" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28363">CVE-2021-28363</a></p><p><a target="_blank" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26488">CVE-2022-26488</a></p>

暂无

暂无

https://blog.python.org/search?q=security&max-results=20&by-date=true