Skip to content

ActiveState Release of Python 3.7.17.8

Choose a tag to compare

View all tags
@icanhasmath icanhasmath released this 29 Oct 22:50
· 4484 commits to 2.7 since this release
v3.7.17.8
b01c43f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Python 3.7.17.8, an ActiveState security release on top of 3.7.17.7. Merged in #117 and #120. It brings the 3.7 line to the same footing as 3.9.25.x.

Security

  • ssl: eMudhra distrust (CVE-2026-115557, pythongh-160040). Chains with a compromised eMudhra key are rejected.
  • Upstream security fixes since 3.7 went EOL, everything with a PSF advisory or a Security NEWS entry for 3.8–3.11 that applies to 3.7, ported from the 3.9.25.x line:
    • tarfile: the filter-bypass family (CVE-2024-12718, CVE-2025-4138/4330/4435/4517) and every later link fix, plus pythongh-151497 (no pre-allocation from oversized GNU/pax extended-header sizes).
    • Other modules: urlsplit host checks, zipfile overlap/zip64, the tempfile race and symlink fixes, the Windows mkdir(0o700) ACL, the unicode-escape UAF, the HTML5 HTMLParser (pythongh-137836), the http.client, email, imaplib and poplib injection fixes, ipaddress leading zeros and network hash collisions (pythongh-134062), .pth hidden files, and the list comparison use-after-free and slice-assignment out-of-bounds (pythongh-120298, pythongh-120384).
    • DoS fixes in csv, configparser, unicodedata, expandvars, minidom and ElementPath.
  • libexpat 2.6.4 → 2.9.0, plus the reparse-deferral API (pythongh-115398). pyexpatns.h prefixes the new Expat functions so they can't clash with a system libexpat.
  • ensurepip: pip 23.0.1 → 24.0.post4 and setuptools 47.1.0 → 68.0.0.post3, the ActiveState security releases of the last lines that support 3.7.

Other changes

  • Windows os.path.realpath now resolves symlinks (bpo-9949, from 3.9.25.x). Without it the tarfile data filter can't see symlinks pointing outside the destination on Windows, so 3.7.17.7 is affected. This is a behavior change, matching 3.8+.
  • Windows build: /OPT:REF,NOICF (bpo-42825), and the zlib import library is z.lib when shared/zlib 1.3.2+ provides one.

The full list is in Doc/whatsnew/3.7.rst. Not included: fixes that don't apply to 3.7 (CVE-2024-8088, CVE-2026-2297, CVE-2026-12003, pythongh-121957, pythongh-98793), behavior changes upstream kept to 3.13+ (CVE-2025-12781, CVE-2026-3446, CVE-2026-6019), and the disputed CVE-2023-36632 and CVE-2026-3479.

Testing

  • Linux x86_64 (OpenSSL 1.1.1w), full suite against a 3.7.17.7 build: no test case fails only on the new build, and test_ipaddress, test_tempfile and the etree tests, which fail on 3.7.17.7, now pass.
  • Windows x64 (VS 2022 v143, ActiveState zlib 1.3.2 / xz 5.8.4): 46 test modules covering every change, no case fails only on the new build.
  • Review follow-ups were rerun module by module on both platforms; pythongh-151497 was checked with a crafted 512-byte header that raises MemoryError before the fix and ReadError after.
Assets 2
Loading