Security fix for CVE-2025-56005 for the bundled ply within the bundled pycparser. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-98502d7938 2026-03-29 00:48:39.566739+00:00 -------------------------------------------------------------------------------- Name : pypy3.10 Product : Fedora 43 Version : 7.3.19 Release : 11.3.10.fc43 URL : https://pypy.org/ Summary : Python 3.10 implementation with a Just-In-Time compiler Description : PyPy's implementation of Python 3.10, featuring a Just-In-Time compiler on some CPU architectures, and various optimized implementations of the standard types (strings, dictionaries, etc.). This build of PyPy has JIT-compilation enabled. -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2025-56005 for the bundled ply within the bundled pycparser -------------------------------------------------------------------------------- ChangeLog: * Thu Mar 19 2026 Charalampos Stratakis - 7.3.19-11 - Security fix for CVE-2025-56005 for the bundled ply within the bundled pycparser - Fixes: rhbz#2431977 * Sat Jan 17 2026 Fedora Release Engineering - 7.3.19-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Wed Jan 7 2026 Miro Hron\u010dok - 7.3.19-9 - Enable JIT on riscv64 * Tue Jan 6 2026 Miro Hron\u010dok - 7.3.19-8 - Inject SBOM into the installed wheels (when using the bundled ones) * Thu Aug 14 2025 Miro Hron\u010dok - 7.3.19-5 - Don't use the gold linker - https://fedoraproject.org/wiki/Changes/DeprecateGoldLinker -------------------------------------------------------------------------------- References: [ 1 ] Bug #2431977 - CVE-2025-56005 pypy3.10: From CVEorg collector [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2431977 -------------------------------------------------------------------------------- This update can be installed with the "dnf" updateprogram. Use su -c 'dnf upgrade --advisory FEDORA-2026-98502d7938' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- . CVE-2025-56005 affects the bundled ply in PyPy 3.10. This advisory details the importance of the security update.. Fedora Update,CVE Fix,Pypy3 Security. . Severity: Important. LinuxSecurity.com Team
Multiple vulnerabilities have been fixed in pypy3, an alternative implementation of the Python 3.x language. CVE-2020-10735 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3966-1
Brief introduction CVE-2023-6597 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3948-1
Multiple vulberabilities have been discovered in Python and PyPy3, the worst of which can lead to privilege escalation.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202405-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Python, PyPy3: Multiple Vulnerabilities Date: May 04, 2024 Bugs: #884653, #897958, #908018, #912976, #919475, #927299 ID: 202405-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulberabilities have been discovered in Python and PyPy3, the worst of which can lead to privilege escalation. Background ========== Python is an interpreted, interactive, object-oriented, cross-platform programming language. Affected packages ================= Package Vulnerable Unaffected ------------------- -------------- --------------- dev-lang/python < 3.10.14:3.10 > = 3.10.14:3.10 < 3.11.8:3.11 > = 3.11.8:3.11 < 3.12.1:3.12 > = 3.12.1:3.12 < 3.8.19:3.8 > = 3.8.19:3.8 < 3.9.19:3.9 > = 3.9.19:3.9 dev-python/pypy3 < 7.3.16 > = 7.3.16 dev-python/pypy3_10 < 7.3.16 > = 7.3.16 dev-python/pypy3_9 < 7.3.16 > = 7.3.16 Description =========== Multiple vulnerabilities have been discovered in Python, PyPy3. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Python, PyPy3 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-lang/python-3.12.1:3.12" # emerge --ask --oneshot --verbose ">=dev-lang/python-3.11.9:3.11" # emerge --ask --oneshot --verbose "> =dev-lang/python-3.10.14:3.10" # emerge --ask --oneshot --verbose "> =dev-lang/python-3.9.19:3.9" # emerge --ask --oneshot --verbose "> =dev-lang/python-3.8.19:3.8" # emerge --ask --oneshot --verbose "> =dev-python/pypy3-7.3.16" # emerge --ask --oneshot --verbose "> =dev-python/pypy3_10-7.3.16" # emerge --ask --oneshot --verbose "> =dev-python/pypy3_9-7.3.16" References ========== [ 1 ] CVE-2023-6507 https://nvd.nist.gov/vuln/detail/CVE-2023-6507 [ 2 ] CVE-2023-6597 https://nvd.nist.gov/vuln/detail/CVE-2023-6597 [ 3 ] CVE-2023-24329 https://nvd.nist.gov/vuln/detail/CVE-2023-24329 [ 4 ] CVE-2023-40217 https://nvd.nist.gov/vuln/detail/CVE-2023-40217 [ 5 ] CVE-2023-41105 https://nvd.nist.gov/vuln/detail/CVE-2023-41105 [ 6 ] CVE-2024-0450 https://nvd.nist.gov/vuln/detail/CVE-2024-0450 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202405-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Security fix for CVE-2023-24329. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-81bb8e3b99 2023-05-31 17:29:34.390134 --------------------------------------------------------------------------------Name : pypy3.9 Product : Fedora 38 Version : 7.3.11 Release : 4.3.9.fc38 URL : https://pypy.org/ Summary : Python 3.9 implementation with a Just-In-Time compiler Description : PyPy's implementation of Python 3.9, featuring a Just-In-Time compiler on some CPU architectures, and various optimized implementations of the standard types (strings, dictionaries, etc.). This build of PyPy has JIT-compilation enabled. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2023-24329 --------------------------------------------------------------------------------ChangeLog: * Mon May 29 2023 Charalampos Stratakis - 7.3.11-4.3.9 - Security fix for CVE-2023-24329 Resolves: rhbz#2174020 --------------------------------------------------------------------------------References: [ 1 ] Bug #2174020 - CVE-2023-24329 pypy3.9: python: urllib.parse url blocklisting bypass [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2174020 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-81bb8e3b99' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list
Nicky Mouha discovered a buffer overflow in the sha3 module of PyPy, a fast, compliant alternative implementation of the Python language. For the stable distribution (bullseye), this problem has been fixed in . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5269-1
Security fix for CVE-2015-20107. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-20e87fb0d1 2022-07-08 01:15:45.190384 --------------------------------------------------------------------------------Name : pypy3.7 Product : Fedora 36 Version : 7.3.9 Release : 2.3.7.fc36 URL : https://pypy.org/ Summary : Python 3.7 implementation with a Just-In-Time compiler Description : PyPy's implementation of Python 3.7, featuring a Just-In-Time compiler on some CPU architectures, and various optimized implementations of the standard types (strings, dictionaries, etc.). This build of PyPy has JIT-compilation enabled. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2015-20107 --------------------------------------------------------------------------------ChangeLog: * Tue Jun 28 2022 Charalampos Stratakis - 7.3.9-2.3.7 - Security fix for CVE-2015-20107 - Fixes: rhbz#2075390 --------------------------------------------------------------------------------References: [ 1 ] Bug #2076530 - CVE-2015-20107 pypy3.7: python(mailcap): findmatch() function does not sanitise the second argument [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2076530 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-20e87fb0d1' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list
Get the latest Linux and open source security news straight to your inbox.