------------------------------------------------------------------- Fri Sep 22 22:50:23 UTC 2023 - Matej Cepl - (bsc#1215469, CVE-2023-41419) Add CVE-2023-41419-http-req-smuggle.patch preventing http request smuggling. Make ``gevent.pywsgi`` comply more closely with the HTTP specification for chunked transfer encoding. In particular, we are much stricter about trailers, and trailers that are invalid (too long or featuring disallowed characters) forcibly close the connection to the client *after* the results have been sent. Trailers otherwise continue to be ignored and are not available to the WSGI application. Previously, carefully crafted invalid trailers in chunked requests on keep-alive connections might appear as two requests to ``gevent.pywsgi``. Because this was handled exactly as a normal keep-alive connection with two requests, the WSGI application should handle it normally. However, if you were counting on some upstream server to filter incoming requests based on paths or header fields, and the upstream server simply passed trailers through without validating them, then this embedded second request would bypass those checks. (If the upstream server validated that the trailers meet the HTTP specification, this could not occur, because characters that are required in an HTTP request, like a space, are not allowed in trailers.) CVE-2023-41419 was reserved for this. ------------------------------------------------------------------- Tue Dec 13 14:46:50 UTC 2016 - dmueller@suse.com - update to 1.1.2: * Python 2: ``sendall`` on a non-blocking socket could spuriously fail with a timeout. * If ``sys.stderr`` has been monkey-patched (not recommended), exceptions that the hub reports aren't lost and can still be caught. Reported in :issue:`825` by Jelle Smet. * :class:`selectors.SelectSelector` is properly monkey-patched regardless of the order of imports. Reported in :issue:`835` by Przemysław Węgrzyn. * Python 2: ``reload(site)`` no longer fails with a ``TypeError`` if gevent has been imported. Reported in :issue:`805` by Jake Hilton. * Nested callbacks that set and clear an Event no longer cause ``wait`` to return prematurely. Reported in :issue:`771` by Sergey Vasilyev. * Fix build on Solaris 10. Reported in :issue:`777` by wiggin15. * The ``ref`` parameter to :func:`gevent.os.fork_and_watch` was being ignored. * Python 3: :class:`gevent.queue.Channel` is now correctly iterable, instead of raising a :exc:`TypeError`. * Python 3: Add support for :meth:`socket.socket.sendmsg`, :meth:`socket.socket.recvmsg` and :meth:`socket.socket.recvmsg_into` on platforms where they are defined. Initial :pr:`773` by Jakub Klama. ------------------------------------------------------------------- Thu Mar 10 20:20:38 UTC 2016 - toddrme2178@gmail.com - Update to 1.1.0 (final): * See changelog.rst for detailed informations ------------------------------------------------------------------- Fri Jan 29 09:14:54 UTC 2016 - tchvatal@suse.com - Update to 1.1rc3: * See changelog.rst for detailed informations ------------------------------------------------------------------- Wed Jul 1 12:54:10 UTC 2015 - tchvatal@suse.com - Bump once more to 1.1a1: * See changelog.rst for detailed informations * The py2.7 compat in 1.0.2 behaves weirdly on openSUSE, this release seems way nicer on that front ------------------------------------------------------------------- Tue Jun 30 08:48:56 UTC 2015 - tchvatal@suse.com - Version bump to 1.0.2: - Fix LifoQueue.peek() to return correct element. PR #456. Patch by Christine Spang. - Upgrade to libev 4.19 - Remove SSL3 entirely as default TLS protocol - Import socket on Windows (closes #459) - Fix C90 syntax error (PR #449) - Add compatibility with Python 2.7.9's SSL changes. Issue #477. ------------------------------------------------------------------- Tue Nov 18 14:00:29 UTC 2014 - toddrme2178@gmail.com - Update to 1.0.1 - Upgrade libev to 4.15. This fixes #361: installation on armv5. - Better support for win64. Patch by Alexey Borzenkov. - Fix #423: Pool's imap/imap_unordered could hang forever. Based on patch and test by Jianfei Wang. - Enable libev's check watchers. - Add dummy Event._reset_internal_locks() method. Only relevant if patch_all(Event=True) is enabled (non-default). - Backport new testrunner.py from master branch. - Removed upstream included libev.patch ------------------------------------------------------------------- Thu Jun 12 08:47:18 UTC 2014 - schwab@suse.de - libev.patch: fix syntax error in preprocessor conditional ------------------------------------------------------------------- Sun Dec 15 15:01:04 UTC 2013 - p.drouand@gmail.com - Update to version 1.0 + pywsgi: Pass copy of error list instead of direct reference + Ignore the autogenerated doc/gevent.*.rst files. + Fix cythonpp.py on Windows. + Remove gevent.run (use gevent.wait). ------------------------------------------------------------------- Fri Oct 26 16:23:38 UTC 2012 - douglarek@outlook.com - Update to version 0.13.8: * Fixed issue #80: gevent.httplib failed with RequestFailed errors because timeout was reset to 1s. Patch by Tomasz Prus. * core: fix compilation with the latest Cython: remove emit_ifdef/emit_else/emit_endif. * Fixed issue #132: gevent.socket.gethostbyname() now does ascii encoding and uses gevent's resolver rather than calling built-in resolver. Patch by Alexey Borzenkov. ------------------------------------------------------------------- Mon Jun 25 15:19:15 UTC 2012 - saschpe@suse.de - Update to version 0.13.7: + Fixed #94: fallback to buffer if memoryview fails in _get_memory on python 2.7. + Fixed #103: ``Queue(None).full()`` returns ``False`` now (previously it returned ``True``). + Fixed #112: threading._sleep is not patched. + Fixed #115: _dummy gets unexpected Timeout arg. ------------------------------------------------------------------- Tue Mar 27 11:41:44 UTC 2012 - saschpe@suse.de - Run testsuite - Require python-greenlet - Simplify macro usage ------------------------------------------------------------------- Fri Nov 18 14:17:34 UTC 2011 - saschpe@suse.de - Cython should not be needed, gevent is build as a binary module ------------------------------------------------------------------- Tue Jul 19 12:23:20 UTC 2011 - saschpe@suse.de - Initial version