Version 2.7.18.a67ce7f

Python was patched on all platforms for CVE-2017-18207, CVE-2021-4189, CVE-2022-45061, CVE-2022-48565, CVE-2024-7592. On non-Windows platforms it was also patched for CVE-2022-48560, CVE-2022-48566, CVE-2023-40217, CVE-2024-0397.

OpenSSL 1.1.1w sources were patched for CVE-2023-5678, CVE-2024-0727, CVE-2024-2511, CVE-2024-4741, CVE-2024-5535 on all platforms.

cryptography was patched for CVE-2023-49083 on all platforms.

ffi sources were updated to version 3.4.6.

SQLite sources and DLLs were updated to version 3.46.0.

zlib sources were updated to version 1.3.1.

The psutil Python module was updated to version 5.9.6 on generic Linux and to version 6.0.0 on all the other platforms.

The macOS package is now build on macOS 13.

SHA256 checksums:

7fdd06c38548921f78d1f1c431441932e5516f1b752d5162c776fe526547b0a8  python-2.7.18.a67ce7f-lnx-arm64.tar.gz
83def1a185963070f9d5a0f4f644e887171bcc376e4395dad872a949635b7518  python-2.7.18.a67ce7f-lnx_musl-x64.tar.gz
d36c90381fb1ccb4991724ce16b021ff6b06d8d08506b8d9d7140fd212f0a686  python-2.7.18.a67ce7f-lnx-x64.tar.gz
8b318b47c07775ef33f160205315619480764e13b3bd808aaa3891d754c8ac0d  python-2.7.18.a67ce7f-macos-x64.tar.gz
6bcd7781208592b37201e5807a9a54ad7df0e7a607fadfa0280b6f5a0f739295  python-2.7.18.a67ce7f-rhel8-x64.tar.gz
8a0f7e74fc9c089a94323595ac7a06e75e602d07d5be671ff44b6e7a9daa24aa  python-2.7.18.a67ce7f-ubuntu1804-x64.tar.gz
7cc581e70e7d312f92b7a97f9361320aacfebad8b1e74337a6108a02756e9bf9  python-2.7.18.a67ce7f-ubuntu2004-x64.tar.gz
db022400284eff717333cce08976afc48731fbd20b95b28cbed9ce599d767057  python-2.7.18.a67ce7f-win-x64.tar.gz
12fa61dc3b929ff02322664d4e14ec452dce15e0f1d7e4b3a75613acf4b11ee2  python-2.7.18.a67ce7f-win-x86.tar.gz

Version 2.7.18.c063ec2

OpenSSL 1.1.1 sources (used on Windows, macOS, and generic Linux) were updated to version 1.1.1w. This fixes CVE-2023-4807, CVE-2023-3817, CVE-2023-3446, CVE-2023-2975, CVE-2023-1255, CVE-2023-0466, CVE-2023-0464.

OpenSSL 1.0.2 sources (used on AIX) were updated to version 1.0.2v-chevah5 to fix CVE-2023-0286 (high severity update from Feb 2023).

Python was patched on all platforms for CVE-2023-24329 and on non-Windows platforms for CVE-2021-3177.

cryptography was patched for CVE-2023-23931 on all platforms.

SQLite sources and DLLs were updated to version 3.43.1 fixing CVE-2023-36191 and CVE-2021-31239.

zlib sources were updated to version 1.3.

The psutil Python module was updated to version 5.9.5 on all platforms.

The ARM64 build is now done on Amazon Linux 2, requires glibc version is 2.26 or higher.

The AIX package is no longer built.

SHA256 checksums:

c154372c1f67e1aeb3b247113fba160a91f9e839c8420472619317533867d315  python-2.7.18.c063ec2-lnx-arm64.tar.gz
378bca556237069b4be4a3dba8fe6aaec1b85ec898261a2de9b0016df0cce472  python-2.7.18.c063ec2-lnx_musl-x64.tar.gz
61afaa23d7f937a8fdf6070d2c0b41051e7638a5be5af0585c7866298b0386ec  python-2.7.18.c063ec2-lnx-x64.tar.gz
7de3295bb38fefa5cbb69f03ec06a970fefa5dffbaca8df6994b5b300e41e6f1  python-2.7.18.c063ec2-macos-x64.tar.gz
427baa98f411fc526acfadde2baec00a54a7fd1a851d26018f8e39e90b8330f7  python-2.7.18.c063ec2-rhel8-x64.tar.gz
da594b909ced7d9a299b13947436a6f05292660273ad8b89258d05f946478be4  python-2.7.18.c063ec2-ubuntu1804-x64.tar.gz
bad17ab348ce84429e98061f1a00985f26ca34f4617e8c29877aeb5f3342e461  python-2.7.18.c063ec2-ubuntu2004-x64.tar.gz
17cd3416a0cf5fe2797289555b0a4d8453e97ce6bccecc58a870acad5c06ed5b  python-2.7.18.c063ec2-win-x64.tar.gz
79567cf5d367fb2413cdbd127923e7d28f0cee5b79746f4dea37d7ed4c3b518a  python-2.7.18.c063ec2-win-x86.tar.gz

Version 2.7.18.52fb2f5

OpenSSL 1.1.1 sources (used on Windows, macOS, and generic Linux) were updated to version 1.1.1t. This fixes CVE-2023-0286, CVE-2023-0215, CVE-2022-4450, and CVE-2022-4450.

Python sources were updated from ActiveState's fork to fix CVE-2015-20107 and CVE-2020-10735. On Windows, the upstream Python packages were hot patched for the former.

SQLite sources and DLLs were updated to version 3.40.1.

The wheel Python module is no longer packaged.

SHA256 checksums:

f6900ace0b2e333ae6e8b4c76b77768789a65a2e3b75e6d379896eab4a148462  python-2.7.18.52fb2f5-aix71-ppc.tar.gz
98793f408e0b5fc5efc4d942f1950d29a320e967476aa7c29992b275cea0bf96  python-2.7.18.52fb2f5-lnx-arm64.tar.gz
5a9a5ccc9faa46692b86312892b33395097dea4d2d6226969168527427c10767  python-2.7.18.52fb2f5-lnx-x64.tar.gz
8254c5e7a09b1a67ec932178f3017023afa417e175204e0c9d44a87d4be5fb3d  python-2.7.18.52fb2f5-lnx_musl-x64.tar.gz
efe3915154f293d16e6d854bcf1e0c404151108b1dc958ca790e7f66e1d1154a  python-2.7.18.52fb2f5-macos-x64.tar.gz
2a8b5f7ba05f6cda15002112364317d765dfb370b239ab114d55df69e8f9fc87  python-2.7.18.52fb2f5-rhel8-x64.tar.gz
5143444075a60c03fb3e874edb8b75e56601c28d785505c3cfa83790754df68c  python-2.7.18.52fb2f5-ubuntu1804-x64.tar.gz
c3496d01f65c156a464d8e2d9861f8f79b8a4febc41084f63cb3ceb5ca46bf54  python-2.7.18.52fb2f5-ubuntu2004-x64.tar.gz
e655b1ab8f6918f5871506fcbccea861f9620949a6d576c46493b1e2ce8c0a61  python-2.7.18.52fb2f5-win-x64.tar.gz
2eed349b37fd33887490506a10b1cca006f169a2e65dbeee8e7802a83d72cee3  python-2.7.18.52fb2f5-win-x86.tar.gz

Version 2.7.18.d2b7dcc

Zlib was updated to version 1.2.13 on all platforms except Windows to fix CVE-2022-37434.

OpenSSL 1.1.1 sources (used on Windows, macOS, and generic Linux) were updated to version 1.1.1s.

SQLite sources and DLLs were updated to version 3.39.4.

Libffi was updated to version 3.4.4.

Python module psutil updated to 5.9.1 on generic glibc-based Linux and to 5.9.3 on other platforms.

SHA256 checksums:

85bf7c3fbd07d732505173a91ad2219d434b738eb0471a3e6487f92de4cf1935  python-2.7.18.d2b7dcc-aix71-ppc.tar.gz
74b41744d6c3fd5bf6d389e26b4397e37b20466a62ce0e0a47b23e1bededbdff  python-2.7.18.d2b7dcc-lnx_musl-x64.tar.gz
698c1e381b0074f4e52614c93f0bc84ccdd35ad2d1885519a313973e57c9b466  python-2.7.18.d2b7dcc-lnx-x64.tar.gz
581f9f03aa372a43f4cf90ef1674a1654b1d6266fb4e3104b220a9ae4805b16b  python-2.7.18.d2b7dcc-macos-x64.tar.gz
8656a21a7e6b9213f79e30e237c595c260773a2fead7164e2b0641c2c6d66aaf  python-2.7.18.d2b7dcc-rhel8-x64.tar.gz
6edad67dc2f669f94217d39befc071ec3d5562220e9bb99d90f7ca7460d1ad2e  python-2.7.18.d2b7dcc-ubuntu1804-x64.tar.gz
5618dfbfb040c2f08c2083a484983f7f25a0bb8d113839f35d8b260e6e3d3e11  python-2.7.18.d2b7dcc-ubuntu2004-x64.tar.gz
c00a7c86e5cb04eda98b17bf30b96475be2e79a7d29372c1dfd9ca8381d9912f  python-2.7.18.d2b7dcc-win-x64.tar.gz
ca4390af84e86e3c3adb0203d3ee56a00bc2a427c5e98acb73d83cb1229291f4  python-2.7.18.d2b7dcc-win-x86.tar.gz

Version 2.7.18.90dc4a6

Python sources were patched to address CVE-2022-0391 for urlparse.

A generic musl Linux version is now built on Alpine 3.12, similar to the lnx generic build for glibc-based distributions. All Alpine Linux releases starting with 3.12 are now supported through the lnx_musl package.

An AIX 7.1 package built on AIX 7100-05-09 was uploaded on September 28. Initially, a package built on AIX 7.2, requiring service pack 7200-05-03, was uploaded. The AIX 7.1 package runs on versions 7.2 and 7.3 too.

OpenSSL 1.1.1 sources (used on Windows, macOS, and generic Linux) were updated to version 1.1.1q.

Python modules cffi and psutil were updated to their latest versions (except on generic Linux, where version 5.9.0 is now pinned for the latter).

SHA256 checksums:

0c67dd0af5e289d47ae583fc3bdbe170c37a5e3fa850fd7401ac9146a937e082  python-2.7.18.90dc4a6-aix71-ppc.tar.gz
15d3d827370018e9414ef136fe25a687575a52d62f2b9a88e2185b85e9991631  python-2.7.18.90dc4a6-lnx_musl-x64.tar.gz
76289ec3112b42d9cf536925d4f98f3150eb6df3d44a75f83b90d688d36888ca  python-2.7.18.90dc4a6-lnx-x64.tar.gz
fad489b550f4a5ddade7ef00498a5ab116f8cb40bca46d6a90c630035e027ff2  python-2.7.18.90dc4a6-macos-x64.tar.gz
af3e462e247198d3b2cd45898a691c08d66de3243138ce6b03586876f60c1e1a  python-2.7.18.90dc4a6-rhel8-x64.tar.gz
8ef525b186097c5d4944a9dbb459d1b94ceadb6b8f91219f3840ceef5c8aea84  python-2.7.18.90dc4a6-ubuntu1804-x64.tar.gz
f0362003978dd2029cf8ff4accf11bb5e7a0c3b956be6bca7ca50d289ea64154  python-2.7.18.90dc4a6-ubuntu2004-x64.tar.gz
1ce0d7736d46a658a393aeb1a544216abc63228f738f2b1e4e4150674c64ecd8  python-2.7.18.90dc4a6-win-x64.tar.gz
2e6139dab893aeb2a1eb65c11b8df9e2f2b02f49a8f78ec9b7efd48c8e391d52  python-2.7.18.90dc4a6-win-x86.tar.gz

Version 2.7.18.93dc340

OpenSSL 1.1.1 sources (used on Windows, macOS, and generic Linux) were updated to version 1.1.1n to fix CVE-2022-0778.

OpenSSL 1.0.2 sources (used exclusively on AIX) were patched to fix CVE-2022-0778.

zlib was updated to version 1.2.12 to fix CVE-2018-25032.

libffi was updated to version 3.4.2.

Starting with this release, AIX packages are built on version 7.1 TL 7100-05.

SHA256 checksums:

b9e834022b36f3d25fa6d56cc0ce32d14bfbd31458d9b2b9f3f7020aea8f5de9  python-2.7.18.93dc340-aix71-ppc.tar.gz
8f4dc122bbb09041fb4d8cb11077e414025b2ce9774df226f60f86692bac3891  python-2.7.18.93dc340-alpine314-x64.tar.gz
a707522b7878ca4ddd683c5611324f4b2e3ed8e0c828e78d14f73862ab9d172d  python-2.7.18.93dc340-lnx-arm64.tar.gz
f8205d3d3f1e8fb1a9d30a936e8e447ae3644f3f5d473b0dba289aa18c63c0b4  python-2.7.18.93dc340-lnx-x64.tar.gz
ab7d670a042ad8cce549c63d54504a72973fe6853ed3df818210af1827fd8ea6  python-2.7.18.93dc340-macos-x64.tar.gz
1a25fe4be9beda8b9e5e3e77794df7ffd579efba217433a78e70d6d35852c3f8  python-2.7.18.93dc340-rhel8-x64.tar.gz
a9175c696a709201e11a7e2deb975bbce1adbd1d49a8db2afdc51e1248c04fe2  python-2.7.18.93dc340-ubuntu1804-x64.tar.gz
02e05b880482bcd78a53846d42a1abc881fe749af192eef1b4dd674adb8fbeb7  python-2.7.18.93dc340-ubuntu2004-x64.tar.gz
284b5d8129226715b8be82bd0bcb1c53b164d213f1089b7be030a38464f40154  python-2.7.18.93dc340-win-x64.tar.gz
e4b47e9e61f293e8dd681744547681ce42cf175804bbcde88bbc5de028a7cbc8  python-2.7.18.93dc340-win-x86.tar.gz

Version 2.7.18.241e9fe

pip version 20.3.4 was patched for CVE-2021-3572 by backporting the fix from https://github.com/pypa/pip/pull/9827/files.

OpenSSL 1.1.1 sources (used on Windows, macOS, and generic Linux) were updated to version 1.1.1m.

SQLite sources and DLLs were updated to version 3.37.2.

pyOpenSSL was updated to version 21.0.0 on all supported OS'es except AIX.

Python modules cffi, psutil, and pycparser were updated to their latest versions.

SHA256 checksums:

320aa748f0e98dc7405be3589c1b7a603c4070f841a50978a610f8ce16e260a5  python-2.7.18.241e9fe-aix71-ppc.tar.gz
713e4c76af6fdddf7d058bc194d0d3e29648b065cad82af3cbb3b6f76a927e43  python-2.7.18.241e9fe-alpine314-x64.tar.gz
4c378f945649f19c66c92359648b3f52f9cd3c53b7271a2e957777bb9bb62269  python-2.7.18.241e9fe-lnx-arm64.tar.gz
30a999acb525373318c08fbfa20aee6ab2b433b3d11daf8a22dccd4de35608f9  python-2.7.18.241e9fe-lnx-x64.tar.gz
886b30d07c2b5bdce8cd34398eebebeffcc8251a1c7971f716e447f3914afbe6  python-2.7.18.241e9fe-macos-x64.tar.gz
825bfa1e5f97ab88f0e6df53497a603767a770c350ac14c80e2824aeba76943d  python-2.7.18.241e9fe-rhel8-x64.tar.gz
ade1c22d4346c1b75911f94badaf166e1c1aa65ae6163d23f691677f36f777fa  python-2.7.18.241e9fe-ubuntu1804-x64.tar.gz
71fbb0ee6d34ac037efedbdae47ecf585f59f604efaf909449f11ca3551f90d0  python-2.7.18.241e9fe-ubuntu2004-x64.tar.gz
7b6b061acacd7d01d5c4cc7f94436949677a5449814eba0dfdcf5ed797217dbc  python-2.7.18.241e9fe-win-x64.tar.gz
5863093bbbe6e43af26da8cd918ed4c5effb6ec659699436fe9cf77ceff84578  python-2.7.18.241e9fe-win-x86.tar.gz

Version 2.7.18.ad5a0e1

OpenSSL 1.1.1 sources (used on Windows, macOS, and generic Linux) were updated to version 1.1.1l to fix CVE-2021-3711 and CVE-2021-3712.

OpenSSL 1.0.2 sources (used exclusively on AIX) were patched to fix CVE-2021-3712. This version is not affected by CVE-2021-3711.

FreeBSD 13 package was added on October 19.

Python modules cffi and wheel were updated to their latest versions.

SHA256 checksums:

68193c279f06011f7bf13b0060689a4379041de8d94c5dd7a2cd64e40483e891  python-2.7.18.ad5a0e1-aix71-ppc.tar.gz
eca8b9dd19d2bed2ba6c8fdeff2790aa5b947a70c09a0c00dd9a2a644003dc4a  python-2.7.18.ad5a0e1-alpine314-x64.tar.gz
e0b1aa4a285059c33d9f7535900b782a1d18079a17b7febac961e5dc90a717d0  python-2.7.18.ad5a0e1-fbsd13-x64.tar.gz
210d46127791c78946926702d3dfb1205682624df5ee2f650736d0625e56f929  python-2.7.18.ad5a0e1-lnx-arm64.tar.gz
76ba02e3a6f6b58feec88c60d4529d0d0c3735884ffe1a5ec5ebaf5e3e63cf02  python-2.7.18.ad5a0e1-lnx-x64.tar.gz
01374ec03283d1cb5cd395f73b7d77db06195465708909454c3980ae22fad9a4  python-2.7.18.ad5a0e1-macos-x64.tar.gz
f5984202a52cc0f5aae39d7bbe4b2b42fd1ca137207827f35f8dbf124f583f25  python-2.7.18.ad5a0e1-rhel8-x64.tar.gz
7632ea2256a82bf7cefb4408046c8877e1427fed4e502945898eeda26dd8ee59  python-2.7.18.ad5a0e1-ubuntu1804-x64.tar.gz
e62c1b1d8f83f744a14e04caff377d4bdd405be2ef7802f22be38d6f7b0eaa51  python-2.7.18.ad5a0e1-ubuntu2004-x64.tar.gz
3cd0f14f4905ab32904f8f3d6846efc149f637510b3fe74b2bdb82a687be0c0b  python-2.7.18.ad5a0e1-win-x64.tar.gz
326050eeeb28d0e6849f0b7c0fec11909d784018d1bfe50d42cd2acb1a3af74c  python-2.7.18.ad5a0e1-win-x86.tar.gz

Version 2.7.18.c3cdaec

Python sources were updated from ActiveState's fork to fix CVE-2021-23336. On Windows, the upstream Python packages were hot patched too.

SQLite source and binaries were updated from 3.34.1 to 3.36.0.

GMP, gmpy2, pycrypto, pycryptodomex, and cython were removed.

Further cleanups were applied to reduce the sizes of the packages to 30-50% of the previous ones.

PYTHON_PACKAGE_VERSION file now also contains OS and ARCH, just like a package name.

Only 7 characters are used for the Git revision from now on.

Alpine 3.14 is now supported.

Alpine 3.12 is no longer supported.

FreeBSD 12 is no longer supported.

OpenBSD 6.8 is no longer supported.

Solaris 11.4 is no longer supported.

SHA256 checksums:

18acf9ef4f3dceb5bdcbf274630a8d44c36c3b6f27e3d71970fccf4ec1f590be  python-2.7.18.c3cdaec-aix71-ppc.tar.gz
f1a0eb8ff98d4fb5f6550c02b1d9641fa6c1f4554a337b86c88fbc43220d9507  python-2.7.18.c3cdaec-alpine314-x64.tar.gz
f56e1adfdeaccc4aed0cf4dcd1d6e3853ce337c7147b7f01845c2d0f4c6b31a3  python-2.7.18.c3cdaec-lnx-arm64.tar.gz
09e676e782ce0f877edfa7e5b48f3963459321bc77dba82339c94316fabde490  python-2.7.18.c3cdaec-lnx-x64.tar.gz
d118a987e0ec360171a5bf75fda5e8c00bd07841d58516a81ae723b5aa8e749c  python-2.7.18.c3cdaec-macos-x64.tar.gz
89efaaf2945cf4e91d6d7a815b5a2ffd82c4922b4ae98fe5c262566ad9049b07  python-2.7.18.c3cdaec-rhel8-x64.tar.gz
7cead1dbc27c8cac7814f8aa7788e971b207b3d500059f6067032c1c5f4ce068  python-2.7.18.c3cdaec-ubuntu1804-x64.tar.gz
fb5ec54367379ca5c5e28d0b6468e06adafe312a19a3d7f221ad78c76671cfe5  python-2.7.18.c3cdaec-ubuntu2004-x64.tar.gz
69d340313cd9dbfda2c6e95d8a764c41d0a3178d6a0b31fc1efafa228902be5f  python-2.7.18.c3cdaec-win-x64.tar.gz
4484f840b61606891d1d149765ec91738b564d8448e7efce1ba1faea2746eccc  python-2.7.18.c3cdaec-win-x86.tar.gz

Version 2.7.18.e26e753c

The embedded OpenSSL libraries for the cryptography module on Windows have been rebuilt to use latest OpenSSL 1.1.1 releases. Fixes CVE-2021-23840 (for which cryptography 3.2 already had a workaround) and CVE-2021-23841 on Windows, enabling future security updates for new OpenSSL 1.1.1 releases.

The upstream Python 2.7.18 Windows packages are hot patched with fixes from ActivePython's maintained fork. Fixes CVE-2019-20907, CVE-2020-26116, CVE-2020-27619, CVE-2020-8492 on Windows.

OpenSSL sources for Python's stdlib ssl module and cryptography were updated from 1.1.1j to 1.1.1k. Fixes CVE-2021-3449 and CVE-2021-3450 on Windows (only for cryptography), generic Linux, and macOS.

AIX versions older than 7.1 are no longer supported.

HP-UX is no longer supported.

Solaris versions older than 11.4 are no longer supported.

Errata: The Red Hat Enterprise Linux 8 package was initially built against OpenSSL 1.1.1g. Do not use it on RHEL 8.0-8.2, which shipped with OpenSSL 1.1.1c. This problem was fixed on Apr 16, please use the current rhel8 package instead, which should work on all RHEL 8.x versions and derivatives.

SHA256 checksums:

5b43459d5fea2c745cc0cde9a687cfc271f6c51699bbc260ae5760e8372c53be  python-2.7.18.e26e753c-aix71-ppc.tar.gz
4620e01ef685f452d83a4145b1cc32fc7621253fc7d20332575f7c9608730400  python-2.7.18.e26e753c-alpine312-x64.tar.gz
f05f1f2e440ed69e4d45e195cfbe9dff47158bea5bbd216c41d82bcc873f759c  python-2.7.18.e26e753c-fbsd12-x64.tar.gz
c264a904cbdc85659fdefa053a1aef8c32a16ff4dd45e9d2c1a9679b4b0cfbf8  python-2.7.18.e26e753c-lnx-arm64.tar.gz
f3038c8b9338a41ec775cb04c011664149e74cc0a7a7bfb8ec109debcfc4c236  python-2.7.18.e26e753c-lnx-x64.tar.gz
78ac4a3e6c6d173fcdc41c4023278a5a7c6f876b0c1dcf1e8b2e54daf3aa6843  python-2.7.18.e26e753c-macos-x64.tar.gz
54d08d6073ebfc6ded4a5377c3299ad12e01f4da8b9f5e056f17911367d9ed67  python-2.7.18.e26e753c-obsd68-x64.tar.gz
be6f5113e4f9153c114af2847c278e581cd0b0954c78493aa6c66fcae4bf5dd7  python-2.7.18.e26e753c-rhel8-x64.tar.gz
d51d8948563cf29feb8c879dbde572aed7b686f298e207a4ad320056ce37f6cb  python-2.7.18.e26e753c-sol114-x64.tar.gz
3771339ec1b8a5d2f4952afb7e7547707052a96baa93c4a7046d8d5517e0ed15  python-2.7.18.e26e753c-ubuntu1804-x64.tar.gz
feb716429e8ed0f6bec4e1a1a8258b0b78603a87c6de5393270bf83f8da8954d  python-2.7.18.e26e753c-ubuntu2004-x64.tar.gz
64d8253118a13e5241c9ff9cfd78c92ecd30ae61ec5f8ca38508ae1f943e85ec  python-2.7.18.e26e753c-win-x64.tar.gz
e28e78a437a3e16e669c468e47638a831090947d4e09661a4b9b19f753f5fec4  python-2.7.18.e26e753c-win-x86.tar.gz