diff --git a/Misc/NEWS.d/next/Windows/2022-03-07-17-46-40.bpo-44549.SPrGS9.rst b/Misc/NEWS.d/next/Windows/2022-03-07-17-46-40.bpo-44549.SPrGS9.rst new file mode 100644 index 0000000000000000000000000000000000000000..0f1ef9af6c617b1a7a4b7e0f744c5fcee690a656 --- /dev/null +++ b/Misc/NEWS.d/next/Windows/2022-03-07-17-46-40.bpo-44549.SPrGS9.rst @@ -0,0 +1,2 @@ +Update bzip2 to 1.0.8 in Windows builds to mitigate CVE-2016-3189 and +CVE-2019-12900 diff --git a/PCbuild/get_externals.bat b/PCbuild/get_externals.bat index d975f05d8f3a940379d7eeb473432f3612675817..2eff5e0bd0a0002e5a3c967a4f5fd08844f3bce8 100644 --- a/PCbuild/get_externals.bat +++ b/PCbuild/get_externals.bat @@ -51,7 +51,7 @@ if NOT DEFINED PYTHON ( echo.Fetching external libraries... set libraries= -set libraries=%libraries% bzip2-1.0.6 +set libraries=%libraries% bzip2-1.0.8 if NOT "%IncludeLibffiSrc%"=="false" set libraries=%libraries% libffi-3.3.0 if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-1.1.1l set libraries=%libraries% sqlite-3.35.5.0 diff --git a/PCbuild/python.props b/PCbuild/python.props index 0d25e51126a714d16c1a20041ef6f89b6e8593a7..7dfcf8f8a25d90c2f8385b3aed1ce9693095967d 100644 --- a/PCbuild/python.props +++ b/PCbuild/python.props @@ -57,7 +57,7 @@ <ExternalsDir Condition="$(ExternalsDir) == ''">$([System.IO.Path]::GetFullPath(`$(PySourcePath)externals`))</ExternalsDir> <ExternalsDir Condition="!HasTrailingSlash($(ExternalsDir))">$(ExternalsDir)\</ExternalsDir> <sqlite3Dir>$(ExternalsDir)sqlite-3.35.5.0\</sqlite3Dir> - <bz2Dir>$(ExternalsDir)bzip2-1.0.6\</bz2Dir> + <bz2Dir>$(ExternalsDir)bzip2-1.0.8\</bz2Dir> <lzmaDir>$(ExternalsDir)xz-5.2.2\</lzmaDir> <libffiDir>$(ExternalsDir)libffi-3.3.0\</libffiDir> <libffiOutDir>$(ExternalsDir)libffi-3.3.0\$(ArchName)\</libffiOutDir> diff --git a/PCbuild/readme.txt b/PCbuild/readme.txt index e6b9a78ea8286cab66281fc04cf544631f855f09..6ad55ab922e1b5a2824f3290de8945b2d1d81c6e 100644 --- a/PCbuild/readme.txt +++ b/PCbuild/readme.txt @@ -157,7 +157,7 @@ interpreter, but they do implement several major features. See the about getting the source for building these libraries. The sub-projects are: _bz2 - Python wrapper for version 1.0.6 of the libbzip2 compression library + Python wrapper for version 1.0.8 of the libbzip2 compression library Homepage: http://www.bzip.org/ _lzma