python-2.7.18-150000.65.1

- bsc#1221854 (CVE-2024-0450) Add
  CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch
  detecting the vulnerability of the "quoted-overlap" zipbomb
  (from gh#python/cpython!110016).

- Switch to using the system libexpat (bsc#1219559,
  CVE-2023-52425)
- Make sure to remove all embedded versions of other packages
  (including expat).
- Add CVE-2023-52425-libexpat-2.6.0-remove-failing-tests.patch
  removing failing test fixing bpo#3151, which we just not
  support.
- Remove patches over those embedded packages (cffi):
  - python-2.7-libffi-aarch64.patch
  - sparc_longdouble.patch

- Modify CVE-2023-27043-email-parsing-errors.patch to fix the
  unicode string handling in email.utils.parseaddr()
  (bsc#1222537).
- Revert CVE-2022-48560-after-free-heappushpop.patch, the fix was
  unneeded.

- Switch off tests. ONLY FOR FACTORY!!! (bsc#1219306)

- Build with -std=gnu89 to build correctly with gcc14, bsc#1220970

- Add CVE-2022-48560-after-free-heappushpop.patch fixing
  use-after-free in Python via heappushpop in heapq (bsc#1214675,
  CVE-2022-48560).
- switch from %patchN style to the %patch -P N one.

- (bsc#1214691, CVE-2022-48566) Add
  CVE-2022-48566-compare_digest-more-constant.patch to make
  compare_digest more constant-time.
- Allow nis.so for SLE-12.

- Add CVE-2023-27043-email-parsing-errors.patch to
  gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043).

- (bsc#1214691, CVE-2022-48566) Add
  CVE-2022-48566-compare_digest-more-constant.patch to make
  compare_digest more constant-time.
- Allow nis.so for SLE-12.

- (bsc#1214685, CVE-2022-48565) Add
  CVE-2022-48565-plistlib-XML-vulns.patch (from
  gh#python/cpython#86217) reject XML entity declarations in
  plist files.
- Remove BOTH CVE-2023-27043-email-parsing-errors.patch and
  Revert-gh105127-left-tests.patch (as per discussion on
  bsc#1210638).

- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
  partially reverting CVE-2023-27043-email-parsing-errors.patch,
  because of the regression in gh#python/cpython#106669.

- (bsc#1210638, CVE-2023-27043) Add
  CVE-2023-27043-email-parsing-errors.patch, which detects email
  address parsing errors and returns empty tuple to indicate the
  parsing error (old API).

- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
  gh#python/cpython#108310, backport from upstream patch
  gh#python/cpython#108315
  (bsc#1214692, CVE-2023-40217)

- Fix the application of the python-2.7.17-switch-off-failing-SSL-tests.patch.

- python-2.7.5-multilib.patch: Update for riscv64
- Don't fail if _ctypes or dl extension was not built

- The condition around libnsl-devel BuildRequires is NOT
  switching off NIS support on SLE < 15, support for NIS used to
  be in the glibc itself. Partial revert of sr#1061583.

- Add PygmentsBridge-trime_doctest_flags.patch to allow build of
  the documentation even with the current Sphinx. (SUSE-ONLY
  PATCH, DO NOT SEND UPSTREAM!)

- Enable --with-system-ffi for non-standard architectures.

- SLE-12 builds nis.so as well.

- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters

- Disable NIS for new products, it's deprecated and gets removed

- Add skip_unverified_test.patch because apparently switching off
  SSL verification doesn't work on older SLE.

- Restore python-2.7.9-sles-disable-verification-by-default.patch
  for SLE-12.

- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.

- Add bpo34990-2038-problem-compileall.patch making compileall.py
  compliant with year 2038 (bsc#1202666, gh#python/cpython#79171),
  backport of fix to Python 2.7.

- Add patch CVE-2021-28861-double-slash-path.patch:
  * BaseHTTPServer: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)

- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.

- Filter out executable-stack error that is triggered for i586
  target.

- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).
- Recover again proper value of %python2_package_prefix
  (bsc#1175619).

- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.

- Older SLE versions should use old OpenSSL.

- Add CVE-2022-0391-urllib_parse-newline-parsing.patch
  (bsc#1195396, CVE-2022-0391, bpo#43882) sanitizing URLs
  containing ASCII newline and tabs in urlparse.

- Add CVE-2021-4189-ftplib-trust-PASV-resp.patch (bsc#1194146,
  bpo#43285, CVE-2021-4189, gh#python/cpython#24838) make ftplib
  not trust the PASV response.