Fedora 40: python3.9 2024-607a0047bc Security Release Details

Python 3.9 package for developers.

This package exists to allow developers to test their code against an older

version of Python. This is not a full Python stack and if you wish to run

your applications with Python 3.9, see other distributions

that support it, such as CentOS or RHEL or older Fedora releases.

Python 3.9.21 security release. Security content in this release gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified. CVE-2024-9287: gh-124651: Properly quote template strings in venv activation scripts. gh-103848: Added checks to ensure that [ bracketed ] hosts found by urllib.parse.urlsplit() are of IPv6 or IPvFuture format. gh-95588: Clarified the conflicting advice given in the ast documentation about ast.literal_eval() being "safe" for use on untrusted input while at the same time warning that it can crash the process. The latter statement is true and is deemed unfixable without a large amount of work unsuitable for a bugfix. So we keep the warning and no longer claim that literal_eval is safe.