[#52] Fix CVE-2023-40217. - Githubissues

chevah / pythia

Chevah's Python 3 distribution

MIT License

4 stars 2 forks source link

[#52] Fix CVE-2023-40217. #53

Closed dumol closed 10 months ago

dumol commented 10 months ago

Scope

Fixes #52

Changes

Updates used Python version to 3.11.6 to fix CVE-2023-40217.

Drive-by changes:

Updates OpenSSL to 3.1.3 for Python's ssl to fix CVE-2023-4807 (where built from sources).
Updates cryptography to version 41.0.4 with OpenSSL 3.1.3 to fix CVE-2023-4807.
Updates SQLite to version 3.43.1 fixing CVE-2023-36191 and CVE-2021-31239.
Updates other Python modules to latest version: setuptools to 68.2.2, cffi to 1.16.0, setproctitle to 1.3.3, charset_normalizer to 3.3.0.

Testing

Review changes.

Check the automated tests.

dumol commented 10 months ago

The 3.11.6.b5ae34b testing packages are already used in SFTPPlus 4.33.0.

To avoid their automatic removal, they've been copied manually to production at https://bin.chevah.com:20443/production/3.11.6.b5ae34b/ without being released through GitHub releases.