Skip to content

Commit 9da28d2

Browse files
ned-deilyned-deily
committed
3.7.11
1 parent fee9642 commit 9da28d2

11 files changed

+91
-32
lines changed

‎Include/patchlevel.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@
1818
/*--start constants--*/
1919
#define PY_MAJOR_VERSION 3
2020
#define PY_MINOR_VERSION 7
21-
#define PY_MICRO_VERSION 10
21+
#define PY_MICRO_VERSION 11
2222
#define PY_RELEASE_LEVEL PY_RELEASE_LEVEL_FINAL
2323
#define PY_RELEASE_SERIAL 0
2424

2525
/* Version as a string */
26-
#define PY_VERSION "3.7.10+"
26+
#define PY_VERSION "3.7.11"
2727
/*--end constants--*/
2828

2929
/* Version as a single 4-byte hex number, e.g. 0x010502B2 == 1.5.2b2.

‎Lib/pydoc_data/topics.py

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# -*- coding: utf-8 -*-
2-
# Autogenerated by Sphinx on Mon Feb 15 20:10:03 2021
2+
# Autogenerated by Sphinx on Mon Jun 28 12:37:39 2021
33
topics = {'assert': 'The "assert" statement\n'
44
'**********************\n'
55
'\n'
@@ -5118,7 +5118,7 @@
51185118
'character that can be any character and defaults to a space '
51195119
'if\n'
51205120
'omitted. It is not possible to use a literal curly brace '
5121-
'(“"{"” or\n'
5121+
'(”"{"” or\n'
51225122
'“"}"”) as the *fill* character in a formatted string '
51235123
'literal or when\n'
51245124
'using the "str.format()" method. However, it is possible '
@@ -6742,7 +6742,7 @@
67426742
'\n'
67436743
'Note that numeric literals do not include a sign; a phrase like '
67446744
'"-1"\n'
6745-
'is actually an expression composed of the unary operator ‘"-"‘ '
6745+
'is actually an expression composed of the unary operator ‘"-"’ '
67466746
'and the\n'
67476747
'literal "1".\n',
67486748
'numeric-types': 'Emulating numeric types\n'

‎Misc/NEWS.d/3.7.11.rst

+84
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
.. bpo: 44022
2+
.. date: 2021-05-05-17-37-04
3+
.. nonce: bS3XJ9
4+
.. release date: 2021-06-28
5+
.. section: Security
6+
7+
mod:`http.client` now avoids infinitely reading potential HTTP headers after
8+
a ``100 Continue`` status response from the server.
9+
10+
..
11+
12+
.. bpo: 43882
13+
.. date: 2021-04-25-07-46-37
14+
.. nonce: Jpwx85
15+
.. section: Security
16+
17+
The presence of newline or tab characters in parts of a URL could allow some
18+
forms of attacks.
19+
20+
Following the controlling specification for URLs defined by WHATWG
21+
:func:`urllib.parse` now removes ASCII newlines and tabs from URLs,
22+
preventing such attacks.
23+
24+
..
25+
26+
.. bpo: 42988
27+
.. date: 2021-03-24-14-16-56
28+
.. nonce: P2aNco
29+
.. section: Security
30+
31+
CVE-2021-3426: Remove the ``getfile`` feature of the :mod:`pydoc` module
32+
which could be abused to read arbitrary files on the disk (directory
33+
traversal vulnerability). Moreover, even source code of Python modules can
34+
contain sensitive data like passwords. Vulnerability reported by David
35+
Schwörer.
36+
37+
..
38+
39+
.. bpo: 43285
40+
.. date: 2021-03-13-03-48-14
41+
.. nonce: g-Hah3
42+
.. section: Security
43+
44+
:mod:`ftplib` no longer trusts the IP address value returned from the server
45+
in response to the PASV command by default. This prevents a malicious FTP
46+
server from using the response to probe IPv4 address and port combinations
47+
on the client network.
48+
49+
Code that requires the former vulnerable behavior may set a
50+
``trust_server_pasv_ipv4_address`` attribute on their :class:`ftplib.FTP`
51+
instances to ``True`` to re-enable it.
52+
53+
..
54+
55+
.. bpo: 43075
56+
.. date: 2021-01-31-05-28-14
57+
.. nonce: DoAXqO
58+
.. section: Security
59+
60+
Fix Regular Expression Denial of Service (ReDoS) vulnerability in
61+
:class:`urllib.request.AbstractBasicAuthHandler`. The ReDoS-vulnerable
62+
regex has quadratic worst-case complexity and it allows cause a denial of
63+
service when identifying crafted invalid RFCs. This ReDoS issue is on the
64+
client side and needs remote attackers to control the HTTP server.
65+
66+
..
67+
68+
.. bpo: 43660
69+
.. date: 2021-03-29-19-50-34
70+
.. nonce: scTgag
71+
.. section: Core and Builtins
72+
73+
Fix crash that happens when replacing ``sys.stderr`` with a callable that
74+
can remove the object while an exception is being printed. Patch by Pablo
75+
Galindo.
76+
77+
..
78+
79+
.. bpo: 41561
80+
.. date: 2021-03-18-10-34-42
81+
.. nonce: pDg4w-
82+
.. section: Tests
83+
84+
Add workaround for Ubuntu's custom OpenSSL security level policy.

‎Misc/NEWS.d/next/Core and Builtins/2021-03-29-19-50-34.bpo-43660.scTgag.rst

-3
This file was deleted.

‎Misc/NEWS.d/next/Security/2021-01-31-05-28-14.bpo-43075.DoAXqO.rst

-1
This file was deleted.

‎Misc/NEWS.d/next/Security/2021-03-13-03-48-14.bpo-43285.g-Hah3.rst

-8
This file was deleted.

‎Misc/NEWS.d/next/Security/2021-03-24-14-16-56.bpo-42988.P2aNco.rst

-4
This file was deleted.

‎Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst

-6
This file was deleted.

‎Misc/NEWS.d/next/Security/2021-05-05-17-37-04.bpo-44022.bS3XJ9.rst

-2
This file was deleted.

‎Misc/NEWS.d/next/Tests/2021-03-18-10-34-42.bpo-41561.pDg4w-.rst

-1
This file was deleted.

‎README.rst

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
This is Python version 3.7.10+
2-
==============================
1+
This is Python version 3.7.11
2+
=============================
33

44
.. image:: https://travis-ci.org/python/cpython.svg?branch=3.7
55
:alt: CPython build status on Travis CI

0 commit comments

Comments
 (0)